Skip to content
anlyon.devby Anlyon

Proofestry MCP server

com.proofestry/proofestryproofestry.comstreamable-httpv0.1.0Scanned

Provenance and metadata tools for AI agents. Paid tools use x402 (USDC) at /mcp/<tool>.

15 tools: 1 can delete or cancel things, 9 change things and 5 only read.

Tools: 1 delete, 0 irreversible, 9 write, 5 read.
  • Reads private data · 3
  • Reads text others write · 2
  • Can send data out · 2
  • 6 findings

Tools listed without sign-in. Remote posture

With Anlyon

1 tool here can delete or cancel things. Govern it.

  • Anlyon lists the tools and adopts none.
  • Each tool you adopt gets approvals and receipts.
  • Your agent never holds the key.
Govern this server →

A tool your agent calls directly is not routed through Anlyon and is not governed by it. anlyon.dev only lists and labels, and these labels are the same either way.

Compare with similar serversMarkdownJSONReport this listing

What the Proofestry MCP server can do

The Proofestry MCP server is published by proofestry.com, a domain the MCP Registry verified. It has 15 tools. It can delete or cancel things (1 tool: clean_metadata) and create or change data (9 tools: mark_content, scan_file, verify_provenance, compliance_report and 5 more). 5 tools only read.

3 tools read private data (scan_metadata, detect_provenance and check_redactions); 2 tools bring in text other people can write (snapshot_citation and snapshot_citations); 2 tools can send data out of your system (snapshot_citation and snapshot_citations). On its own it has all three parts of a prompt-injection exfiltration path: private data, text others write, and a way out.

The fixed checks matched 6 findings (credentials-mention and annotation-conflict). Each one comes with the text it matched.

Its remote endpoint lists its tools without sign-in.

Last scanned Nov 10, 2026, version 0.1.0.

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

15 tools

Deletes or cancels 1Claude Code: deny
  • clean_metadataRemoves EXIF (GPS, device, timestamps), XMP, IPTC and text metadata from a JPEG, PNG or WebP and returns the cleaned file, with a list of what was removed and what was kept (the pi…3 findings

    Why it is in this group

    • The description's first verb is "remove": a word for removing or ending something.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    • The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.

    Findings

    • Info

      The description mentions "Credentials".

      Matched text

      description: "...re-encoded. A file that carries Content Credentials (C2PA) is refused with 409, since clean..."

      What this check looks for
    • Warn

      The server marks "clean_metadata" read-only (readOnlyHint: true), and its own name, description or input give the class "destructive".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "remove": a word for removing or ending something.

      What this check looks for
    • Warn

      The server marks "clean_metadata" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "remove": a word for removing or ending something.

      What this check looks for
    Description, as the server wrote it
    Removes EXIF (GPS, device, timestamps), XMP, IPTC and text metadata from a JPEG, PNG or WebP and returns the cleaned file, with a list of what was removed and what was kept (the picture, the color profile, the display orientation and the IPTC digital source type). The pixels are not re-encoded. A file that carries Content Credentials (C2PA) is refused with 409, since cleaning it would break their signature. Images up to 1 MiB inline; larger files use the upload job routes. Failed calls are never charged. MCP tool: `clean_metadata`. Price: 0.01 USDC per file.

    Annotations the server declares

    • title: Remove private metadata from an image and return the cleaned copy
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Changes things 9Claude Code: ask
  • compliance_reportAn audit record of what was marked, when, with which layers and standard versions, for one ledger.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    An audit record of what was marked, when, with which layers and standard versions, for one ledger. Counts unique assets (a retry never adds one). Requires `Authorization: Bearer <ledger token>`; unknown ledgers and wrong tokens get the same 404, which is not charged. Price: 0.10 USDC. MCP tool: `compliance_report`.

    Annotations the server declares

    • title: Compliance report for a ledger
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • mark_contentMarks an AI-generated or human-made image with a compliance profile: a signed C2PA manifest with the profile's disclosure, an invisible watermark (the AI profiles), an ISCC fingerp…No findings

    Why it is in this group

    • The name "mark_content" says "mark": a word for a change.
    Description, as the server wrote it
    Marks an AI-generated or human-made image with a compliance profile: a signed C2PA manifest with the profile's disclosure, an invisible watermark (the AI profiles), an ISCC fingerprint registered with Proofestry, and a trusted timestamp when the signing provider has one. Returns the marked file (base64 in the REST response; a short-lived download link over MCP). Marking the same image again is idempotent: it returns the same asset id and never creates a second record. Profiles help meet obligations and do not guarantee compliance; they are in beta until the signer is on the C2PA trust list. Images up to 1 MiB inline (JPEG, PNG, WebP); larger files use the upload job routes. Failed calls are never charged. MCP tool: `mark_content`. Price: 0.01 USDC per image.

    Annotations the server declares

    • title: Apply a compliance profile to an image
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • request_missing_toolFree.No findings

    Why it is in this group

    • The name "request_missing_tool" says "request": a word for a change.
    Description, as the server wrote it
    Free. MCP tool: `request_missing_tool`.

    Annotations the server declares

    • title: Request a missing tool
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • scan_fileLooks inside a PDF, Word, Excel or PowerPoint file, an image or a text/HTML file for what a reader does not see: scripts and launch actions, hidden or invisible text, embedded file…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Looks inside a PDF, Word, Excel or PowerPoint file, an image or a text/HTML file for what a reader does not see: scripts and launch actions, hidden or invisible text, embedded files, trailing data, and phrases that try to instruct an AI that reads the file. Reports each finding's kind, severity and location; for an injection phrase it quotes only the matched phrase (up to 80 characters), never other content. Not an antivirus and not a guarantee: `checks_run` lists what was inspected, and a file type with no checks returns `overall_risk: unknown`. Price: 0.01 USDC per file. MCP tool: `scan_file`.

    Annotations the server declares

    • title: Scan a file for hidden content, active content and prompt-injection text
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • snapshot_citationFetches a public web page and records what it served: the final URL, the time, the HTTP status, the content type, the SHA-256 of the bytes and the title.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "snapshot_citation" says "snapshot": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "fetch" and "web": it reads web pages, which anyone can write.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Findings

    • Warn

      The server marks "snapshot_citation" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "snapshot_citation" says "snapshot": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Fetches a public web page and records what it served: the final URL, the time, the HTTP status, the content type, the SHA-256 of the bytes and the title. The record is timestamped (RFC 3161) and gets a permanent proof link. Proofestry does not store the page; set `include_content` to get the bytes back to keep. Only public http(s) pages on ports 80 and 443 are fetched; pages that need a login or JavaScript are captured as served to a plain request. A page that cannot be fetched, or answers with an error status, is a 4xx/5xx and is never charged. Price: 0.02 USDC per URL. MCP tool: `snapshot_citation`.

    Annotations the server declares

    • title: Snapshot a citation
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • snapshot_citationsLike `snapshot_citation` for one to five URLs in a single call, fetched in parallel.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "snapshot_citations" says "snapshot": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe input takes a URL (input.urls), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.urls): a request to a URL can carry data to whoever runs it.

    Findings

    • Warn

      The server marks "snapshot_citations" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "snapshot_citations" says "snapshot": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Like `snapshot_citation` for one to five URLs in a single call, fetched in parallel. All or nothing: if any URL fails, the call fails and nothing is charged. Price: 0.075 USDC per batch. MCP tool: `snapshot_citations`.

    Annotations the server declares

    • title: Snapshot up to five citations
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • timestampObtains an RFC 3161 timestamp token for a SHA-256 hash from a public timestamp authority and stores it, so the hash can be shown to have existed at that time.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Obtains an RFC 3161 timestamp token for a SHA-256 hash from a public timestamp authority and stores it, so the hash can be shown to have existed at that time. Only the hash is sent: Proofestry never sees the content. Returns the token (verifiable with `openssl ts -verify`) and a record id. A timestamp proves the hash existed then, not who made the content or that it is true. A failure at the authority is a 5xx and is never charged. Price: 0.01 USDC per hash. MCP tool: `timestamp`.

    Annotations the server declares

    • title: Timestamp a hash
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • verify_provenanceFree.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Free. Checks a file for Proofestry's marks: the C2PA manifest (validated against Proofestry's records), the invisible watermark, and an exact fingerprint of files Proofestry delivered. Reports what was found; not finding marks never means a file is unmarked. Up to 4 MiB. MCP tool: `verify_provenance`.

    Annotations the server declares

    • title: Check whether a file is marked by Proofestry
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • verify_timestampFree.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Free. Re-checks a stored timestamp: the authority's signature over the token, that it covers the recorded hash, and optionally that a hash you supply matches. Lists each check with its result; the authority's certificate chain is not evaluated against a trust list. MCP tool: `verify_timestamp`.

    Annotations the server declares

    • title: Verify a timestamp
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 5Show 5 read-only tools
  • check_redactionsFinds black boxes drawn over text in a PDF and reports where the text underneath can still be selected or copied, and redaction annotations that were never applied.Reads private dataNo findings

    Why it is in this group

    • The description's first verb is "find": a word for reading.

    What it can reach

    • private-dataThe input names a file (input.file_base64), and the tool reads: it reads files.
    Description, as the server wrote it
    Finds black boxes drawn over text in a PDF and reports where the text underneath can still be selected or copied, and redaction annotations that were never applied. Returns locations and counts, never the hidden text. Checks text only: it does not look at images, metadata or earlier revisions. Price: 0.01 USDC per PDF. MCP tool: `check_redactions`.

    Annotations the server declares

    • title: Check a PDF for redactions that did not remove the text
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • detect_provenanceReads and validates C2PA manifests (signature and hashes), IPTC DigitalSourceType, and generator metadata.Reads private data1 finding

    Why it is in this group

    • The description's first verb is "read": a word for reading.

    What it can reach

    • private-dataThe input names a file (input.file_base64), and the tool reads: it reads files.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...Flags stripped, invalid or conflicting credentials. Reports signals and confidence, never..."

      What this check looks for
    Description, as the server wrote it
    Reads and validates C2PA manifests (signature and hashes), IPTC DigitalSourceType, and generator metadata. Flags stripped, invalid or conflicting credentials. Reports signals and confidence, never a definitive 'not AI-generated'; the C2PA signer is not yet checked against the trust list. C2PA manifests are read and validated in images, PDF, Office and OpenDocument files, audio and video (see supported-formats.json). IPTC, XMP, EXIF and generator-name signals are read for JPEG, PNG, HEIC/HEIF, WebP, TIFF and AVIF; `checks_run` says what ran for each file. MCP tool: `detect_provenance`. Price: 0.002 USDC per image.

    Annotations the server declares

    • title: Detect provenance and AI-generation signals
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_compliance_profilesFree.No findings

    Why it is in this group

    • The name "list_compliance_profiles" says "list": a word for reading.
    Description, as the server wrote it
    Free. The compliance profiles `mark_content` can apply, the layers each uses, the regulatory basis, and whether they are beta (until the signer is on the C2PA trust list). MCP tool: `list_compliance_profiles`.

    Annotations the server declares

    • title: List compliance profiles
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • scan_metadataLists EXIF, XMP and PNG text metadata with a risk rating.Reads private dataNo findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.

    What it can reach

    • private-dataThe input names a file (input.file_base64), and the tool reads: it reads files.
    Description, as the server wrote it
    Lists EXIF, XMP and PNG text metadata with a risk rating. Inspects JPEG, PNG, HEIC/HEIF, WebP, TIFF and AVIF. Any other format returns `supported: false` and `overall_risk: unknown`: nothing was inspected, so no findings does not mean no metadata. MCP tool: `scan_metadata`. Price: 0.002 USDC per file.

    Annotations the server declares

    • title: Scan a file's metadata for privacy risks
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • verify_snapshotFree.No findings

    Why it is in this group

    • The name "verify_snapshot" says "snapshot": a word for reading.
    Description, as the server wrote it
    Free. Re-checks a stored snapshot: that its fields still hash to the timestamped record, the timestamp authority's signature, and optionally that a content hash you supply is the recorded one. MCP tool: `verify_snapshot`.

    Annotations the server declares

    • title: Verify a snapshot
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

12 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 2 outbound tools breaks every one.

Reads private data3
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write2
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out2
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__proofestry__snapshot_citation",
      "mcp__proofestry__snapshot_citations"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Tools listed without sign-in

Looked at Nov 10, 2026, 08:19 UTC, unchanged since Nov 10, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
10
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
not observed
RFC 9728 protected resource metadata
not observed
Authorization servers
not observed
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • HighThe whole server

    The endpoint served tools/list without credentials, and the list has 10 tools that change things (1 destructive, 9 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://api.proofestry.dev/mcp: tools/list returned 15 tools to an anonymous client, including clean_metadata (destructive), mark_content (write), scan_file (write), verify_provenance (write), compliance_report (write) and 5 more

    What this check looks for

Findings

Matches of fixed checks, with the text they matched.

4 warn2 info
  • Warnclean_metadata

    The server marks "clean_metadata" read-only (readOnlyHint: true), and its own name, description or input give the class "destructive".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "remove": a word for removing or ending something.

    What this check looks for
  • Warnclean_metadata

    The server marks "clean_metadata" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "remove": a word for removing or ending something.

    What this check looks for
  • Warnsnapshot_citation

    The server marks "snapshot_citation" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "snapshot_citation" says "snapshot": a word for reading.

    What this check looks for
  • Warnsnapshot_citations

    The server marks "snapshot_citations" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "snapshot_citations" says "snapshot": a word for reading.

    What this check looks for
  • Infodetect_provenance

    The description mentions "credentials".

    Matched text

    description: "...Flags stripped, invalid or conflicting credentials. Reports signals and confidence, never..."

    What this check looks for
  • Infoclean_metadata

    The description mentions "Credentials".

    Matched text

    description: "...re-encoded. A file that carries Content Credentials (C2PA) is refused with 409, since clean..."

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 0.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http proofestry https://api.proofestry.dev/mcp
claude mcp add --transport http proofestry https://api.proofestry.dev/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__proofestry__scan_metadata",
      "mcp__proofestry__detect_provenance",
      "mcp__proofestry__check_redactions",
      "mcp__proofestry__list_compliance_profiles",
      "mcp__proofestry__verify_snapshot"
    ],
    "ask": [
      "mcp__proofestry__mark_content",
      "mcp__proofestry__scan_file",
      "mcp__proofestry__verify_provenance",
      "mcp__proofestry__compliance_report",
      "mcp__proofestry__timestamp",
      "mcp__proofestry__verify_timestamp",
      "mcp__proofestry__snapshot_citation",
      "mcp__proofestry__snapshot_citations",
      "mcp__proofestry__request_missing_tool"
    ],
    "deny": [
      "mcp__proofestry__clean_metadata"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as proofestry. Review it before you use it.

Capability tags behind 5 rules
  • mcp__proofestry__scan_metadata private-data
  • mcp__proofestry__detect_provenance private-data
  • mcp__proofestry__check_redactions private-data
  • mcp__proofestry__snapshot_citation untrusted-input, outbound
  • mcp__proofestry__snapshot_citations untrusted-input, outbound

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/com.proofestry/proofestry/verify?hash=d328df50cdcd3e72d06c58d947ccf7f7c50d0a0e4502339e484994da9813752d" | jq -e '.changed == false'

Pinned hash d328df50cdcd, from Nov 10, 2026, 00:17 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.proofestry/proofestry/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for com.proofestry/proofestry
[![anlyon.dev](https://anlyon.dev/badge/com.proofestry/proofestry.svg)](https://anlyon.dev/servers/com.proofestry/proofestry)

Source: MCP Registry. Synced Nov 10, 2026, 00:17 UTC.

Proofestry MCP server: questions and answers

Answered from the scan above, not from the publisher's description.

Is the Proofestry MCP server safe?

No scan can promise that. What its definitions show: 15 tools, 10 of which can change, send or delete something, and 6 findings from fixed checks. Allow the reads, ask before each change, and deny the deletes; the permissions block on this page does that.

Can the Proofestry MCP server delete data?

Yes. 1 tool can delete, cancel or revoke something: clean_metadata.

Can the Proofestry MCP server do things that cannot be undone?

No tool is classed as irreversible: none of them sends, pays, publishes or merges, going by their definitions.

What tools does the Proofestry MCP server have?

15 tools: 1 destructive, 9 write, 5 read. clean_metadata, mark_content, scan_file, verify_provenance, compliance_report, timestamp, verify_timestamp, snapshot_citation and 7 more.

Does the Proofestry MCP server need sign-in or OAuth?

Its remote endpoint listed its tools to an anonymous client, without sign-in.

Does the Proofestry MCP server send data to outside services?

2 tools can carry data out (it sends, posts or publishes, or takes a recipient, channel or URL): snapshot_citation and snapshot_citations.

Has the Proofestry MCP server changed its tools?

Not since anlyon.dev started tracking it. Last scanned Nov 10, 2026.