Pixels Lose Their History
A rendered image does not reveal whether it came from a camera, an editor, or a generator. C2PA attaches a signed provenance graph, but the manifest still needs to be opened, summarized, and checked.
manifestlens reads C2PA data with the official Python library and surfaces the active manifest, claim generator, signer context, ingredients, actions, assertions, validation entries, and hard-binding state.
Separate Integrity From Truth
Policy output is structured and explicit, available from the CLI, API, responsive workbench, Docker image, and an integration test against a real signed C2PA sample.
The Demo
The demo manifest is valid and hard-bound, with one ingredient and three actions: opened, cropped, and color adjusted. The report also surfaces its issuer and signing time.
A valid credential supports provenance integrity and signer context. It does not prove that the depicted event happened or that every step before signing was honest.
A Validator That Failed Open
A missing field and an empty one are not the same thing, and this validator was treating them as if they were. If the validation_status array was present but empty, that legitimately means "checked, nothing wrong." If the field was entirely absent, no check ran at all — but the code defaulted both cases to the same empty list, so a manifest with zero cryptographic verification reported valid: true. Verified directly: deleting the field from the demo payload before the fix still returned a clean bill of health.
That matters for a tool whose API accepts arbitrary JSON: anyone posting to /api/analyze could mark an unverified manifest valid simply by leaving one field out. A second, related issue: has_hard_binding only checked whether a hash-assertion label existed in the manifest, not whether that specific binding check had actually passed — so a manifest whose validation status explicitly reported a hash mismatch, a genuine tampering signal, still claimed a valid hard binding.
Fixed both: the report now distinguishes "validation never ran" from "validation ran and passed," and a hard binding is only reported when there's no error specifically about hashing or data binding — while an unrelated error, like an expired signing credential, no longer falsely clears a genuinely intact binding. The published demo output and the real-asset integration test (which reads an actual signed sample through the official SDK) are both unaffected.
Standards Basis
The implementation follows the C2PA manifest model and uses the official Content Authenticity Initiative tooling for asset inspection.
Read the C2PA manifest model.