# Mtl C2pa Mcp

> MCP server for reading C2PA content provenance manifests from media files (Google Lyria AI MP3s, Adobe Content Credentials, etc.)

- **Type:** MCP server
- **Install:** `agentstack add mcp-musictechlab-mtl-c2pa-mcp`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [musictechlab](https://agentstack.voostack.com/s/musictechlab)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [musictechlab](https://github.com/musictechlab)
- **Source:** https://github.com/musictechlab/mtl-c2pa-mcp

## Install

```sh
agentstack add mcp-musictechlab-mtl-c2pa-mcp
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# mtl-c2pa-mcp

[](LICENSE)
[](https://github.com/musictechlab/mtl-c2pa-mcp/actions/workflows/ci.yml)
[](https://www.python.org/)
[](https://docs.astral.sh/ruff/)
[](https://modelcontextprotocol.io/)
[](https://musictechlab.io)

MCP server for reading [C2PA](https://c2pa.org/) content provenance manifests from media files — built for [Claude Code](https://claude.com/claude-code).

> **⚠️ Experimental** — Early development. The C2PA spec and tooling are still evolving. Don't rely on this for legal evidence or compliance work.

C2PA (Coalition for Content Provenance and Authenticity) is the open standard behind Adobe's Content Credentials and is now embedded in **Google Lyria** AI-generated MP3s. Each manifest records who created the file, what tool produced it, whether it's AI-generated, what watermarks (e.g. SynthID) were applied, and who signed the claim.

This MCP wraps the official [`c2pa-python`](https://github.com/contentauth/c2pa-python) library so Claude can read those manifests in plain language.

## Tools

| Tool | Description |
|------|-------------|
| `c2pa_summary` | Human-friendly summary: generator, AI flag, actions, ingredients, watermarks, signature |
| `c2pa_read` | Full raw manifest store as JSON |
| `c2pa_assertions` | List all assertions from the active manifest |
| `c2pa_ingredients` | List ingredients (sources used) from the active manifest |
| `c2pa_verify` | Signature issuer, validation state, successes & failures |
| `c2pa_scan` | Audit a directory: which files carry C2PA, which are AI-generated |
| `c2pa_info` | Library version and supported MIME types |

## Supported formats

The underlying `c2pa-python` library supports many formats. Most relevant here:

- **Audio**: MP3, WAV, FLAC, OGG, M4A, AAC
- **Image**: JPG, PNG, WebP, TIFF, AVIF, HEIC, GIF, SVG
- **Video**: MP4, MOV, AVI
- **Other**: PDF

Call `c2pa_info` for the full live list.

## Setup

```bash
git clone https://github.com/musictechlab/mtl-c2pa-mcp.git
cd mtl-c2pa-mcp
poetry install
```

## Claude Code configuration

```bash
claude mcp add -s user mtl-c2pa -- poetry --directory /path/to/mtl-c2pa-mcp run python -m mtl_c2pa_mcp
```

## Usage examples

Once configured, just ask Claude in natural language.

### Quick summary of a Lyria-generated MP3

> "What does the C2PA manifest in `~/Downloads/Sovereign_Ascent.mp3` say?"

```json
{
  "file": "/Users/you/Downloads/Sovereign_Ascent.mp3",
  "active_manifest": "urn:c2pa:80faaddf-fe27-1e7d-0ce5-4a70eeba2dd1",
  "generator": {
    "name": "Google C2PA Core Generator Library",
    "version": "916434528:916944653"
  },
  "is_ai_generated": true,
  "digital_source_types": [
    "http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia"
  ],
  "actions": [
    {
      "action": "c2pa.created",
      "digitalSourceType": "http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia",
      "description": "Created by Google Generative AI."
    },
    {
      "action": "c2pa.edited",
      "digitalSourceType": "http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia",
      "description": "Applied imperceptible SynthID watermark."
    }
  ],
  "ingredients_count": 0,
  "watermarks": [
    {
      "label": "c2pa.actions.v2",
      "action": "c2pa.edited",
      "description": "Applied imperceptible SynthID watermark."
    }
  ],
  "signature_issuer": "Google LLC",
  "validation": "valid"
}
```

### Verify a signature

> "Is the C2PA signature on `track.mp3` valid? Who signed it?"

### Audit a music folder

> "Scan my `~/Music` directory and prepare a list of tracks with info if c2pa is included."

Or in raw JSON form:

```json
{
  "directory": "/Users/you/Downloads",
  "total_files": 12,
  "with_manifest": 3,
  "files": [
    {
      "file": "/Users/you/Downloads/Sovereign_Ascent.mp3",
      "has_manifest": true,
      "generator": {"name": "Google C2PA Core Generator Library", "version": "..."},
      "is_ai_generated": true,
      "digital_source_types": ["http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia"]
    },
    {
      "file": "/Users/you/Downloads/photo.jpg",
      "has_manifest": false
    }
  ]
}
```

### Inspect raw manifest

> "Dump the full C2PA manifest store of `track.mp3`."

Returns the same JSON shape produced by `c2patool ./track.mp3` — useful when you need every field.

## Why this exists

When Google shipped C2PA in Lyria MP3 downloads in May 2026, it became the first major DSP-adjacent player to embed AI provenance directly in music files. Inspecting those manifests usually means installing the Rust `c2patool` binary and reading raw JSON. This MCP lets you ask Claude *"is this AI-generated?"* and get a clean answer — same workflow as `mtl-metadata-mcp` and `mtl-vhc`, but for provenance instead of ID3 tags or human-cert registry lookups.

## Tech stack

- Python 3.10+
- [c2pa-python](https://github.com/contentauth/c2pa-python) — Adobe's official Rust-backed Python binding
- [MCP SDK](https://modelcontextprotocol.io/) (FastMCP)
- [Poetry](https://python-poetry.org/) — dependency management

## Contributing

See [CONTRIBUTING.md](CONTRIBUTING.md).

## Security

To report a vulnerability, see [SECURITY.md](SECURITY.md).

## License

MIT — see [LICENSE](LICENSE).

---

  MusicTech Lab - Rockstars Developers dedicated to the Music Industry
  Website
   | 
  LinkedIn
   | 
  Let's talk
  Crafted by musictechlab.io

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [musictechlab](https://github.com/musictechlab)
- **Source:** [musictechlab/mtl-c2pa-mcp](https://github.com/musictechlab/mtl-c2pa-mcp)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-musictechlab-mtl-c2pa-mcp
- Seller: https://agentstack.voostack.com/s/musictechlab
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.