Security & Testing
unmark.ing
Reads and removes C2PA content credentials from files, reporting signer information like whether the file was made with Claude.
ENDPOINT 1
https://api.unmark.ing/mcp
MCP server metadata
- Name
- unmarking
- Version
- 0.1.0
This hosted server only reads files from public URLs. For a file on the user's machine, either install the local server (claude mcp add unmarking -- npx -y unmarking-mcp), which takes paths and writes the cleaned copy next to the original, or upload the file to the HTTP API from a shell: curl -F file=@<path> https://api.unmark.ing/api/strip -o <output>
Known tools 2
inspect_fileReads the C2PA content credential embedded in a file and reports its signer, including whether the file was made with Claude.
Inferred read-onlystrip_fileRemoves the C2PA content credential from a file and returns a download link for the cleaned copy.
Inferred read-onlyCONNECT WITH APPROVAL
Client installation
Review this server and its permissions before adding it. Secret placeholders must be set locally.
Codex
~/.codex/config.toml
[mcp_servers.unmarking]
url = "https://api.unmark.ing/mcp"
enabled = true
Claude Code
.mcp.json
{
"mcpServers": {
"unmarking": {
"type": "http",
"url": "https://api.unmark.ing/mcp"
}
}
}
Claude Desktop
Settings → Connectors → Add custom connector
Name: unmarking
Remote MCP URL: https://api.unmark.ing/mcp
Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.
Cursor
.cursor/mcp.json
{
"mcpServers": {
"unmarking": {
"url": "https://api.unmark.ing/mcp"
}
}
}
Visual Studio Code
.vscode/mcp.json
Add to Visual Studio Code{
"servers": {
"unmarking": {
"type": "http",
"url": "https://api.unmark.ing/mcp"
}
}
}
Generic MCP
Client-specific MCP configuration
{
"name": "unmarking",
"transport": "streamable-http",
"url": "https://api.unmark.ing/mcp"
}
MCP Inspector
Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.
TRUST AND VERIFICATION EVIDENCE
Loading Trust v2 evidence…
Checking the associated registrable domain. The BuiltWith key remains server-side.
Evidence is source-attributed and does not guarantee that a third-party server is safe. Risk labels are conservative metadata heuristics.