How to use MUTANT Inspect
MUTANT Inspect helps you see which provenance signals are present in an image file. It checks the file locally in your browser and explains what it found, what it did not find and what that evidence cannot prove.
It is not an AI detector and it does not force a human-made/AI-made verdict.
1. Choose an image
Select Choose image or drop an image into the inspection area.
The original file stays in your browser for the local inspection flow. This release rejects files larger than 25 MB before inspection so the browser does not attempt an unexpectedly expensive operation.
Supported working examples include ordinary JPEG and PNG files, images with EXIF metadata, images with PNG metadata, and images containing C2PA Content Credentials.
2. Run the inspection
Select Inspect image. MUTANT checks the file in stages:
- loads the selected image locally;
- checks for a MUTANT Signature;
- records safe file facts such as type, size and dimensions;
- checks for embedded Content Credentials and runs the official local C2PA verifier;
- reads ordinary metadata such as location where available; and
- writes a plain-English report.
MUTANT does not treat an empty result as proof that an image has no history. Metadata can disappear when an image is edited, re-saved, screenshotted or photographed from another screen.
3. Read the result cards
MUTANT Signature
A detected MUTANT Signature means the file contains the MUTANT processing marker that Inspect knows how to read.
It is a provenance signal about the file’s passage through a MUTANT workflow. It is not a proof of original authorship, originality or a complete creation history.
Content Credentials
Content Credentials are the user-facing term for a C2PA manifest. They can carry information about origin, edits, tools and signing information. The C2PA project describes them as a way to establish provenance, not as a universal real/fake verdict.^1
Inspect should keep these states separate:
- Not found: no readable C2PA manifest was found in this file.
- Detected: a manifest is present, but presence alone is not cryptographic verification.
- Valid: the credential and asset bindings passed cryptographic validation, but the signer may not be trusted.
- Trusted: the credential validated against the configured official trust anchors.
- Invalid: a signature, hash or other validation check failed.
- Verification error: the file could not be parsed or the verification operation could not complete.
Inspect uses the official C2PA verifier locally. A valid credential may still show Valid · signer untrusted when its signer is outside the configured trust policy, while an altered fixture shows Invalid. Inspect only uses Trusted when the signer chain passes the configured official trust policy. The official browser library supports explicit verification contexts and trust-anchor configuration.^2
Ordinary file metadata
JPEG and PNG files may contain technical metadata even when they have no Content Credentials. Examples include image dimensions, camera information, creation dates and GPS data.
Metadata is supplied by the file or its creator. It can be incomplete, inaccurate, copied or removed. It should be treated as evidence to inspect, not as an unquestionable statement of truth.
4. Location metadata and privacy
Location data can be sensitive. MUTANT Inspect shows an approximate area by default, rounded to roughly a one-kilometre grid. Exact coordinates, altitude, capture time and device identifiers are hidden in the normal report.
The technical-evidence panel includes an explicit local reveal control for people who need to inspect the exact values. Revealing them is a deliberate choice; do not include exact location data in a certificate or share it unnecessarily.
Before sharing an image publicly, consider whether its metadata reveals a home address, workplace, routine or other private location.
5. Creator-supplied details
You may add a creator, website, copyright or description to an export. These fields are labelled creator-supplied because MUTANT does not independently verify them.
They should never be presented as equivalent to a cryptographically verified Content Credential.
6. Download a provenance certificate
After inspection, select Download provenance certificate.
The certificate is a local HTML record of what MUTANT observed at inspection time. It is explicitly unsigned. It is not:
- a cryptographic signature;
- proof of authorship;
- proof that an image is original;
- proof that an image is human-made or AI-made; or
- a complete history of the image.
The certificate hides exact location values by default and records the result wording, file facts and available provenance summaries.
7. What the results do and do not mean
Content Credentials can provide a positive signal about an asset’s origin and history, and an AI-enabled tool may record that an image was generated with AI. But missing credentials do not prove an image is fake or human-made. The Content Authenticity Initiative’s FAQ makes the same distinction: absence of credentials means that historical information is not available in that file, not that the file is fraudulent.^3
A useful interpretation is:
“This file contains these signals” is stronger and safer than “this image is definitely real” or “this image is definitely AI-generated.”
For high-stakes decisions, use Inspect as supporting evidence and combine it with context, source records and human review. Provenance results should not be used as an automatic accusation or rejection rule.^4
8. Common situations
A screenshot has no credentials
That is expected. Screenshots commonly do not carry the original file’s C2PA metadata. The absence tells you that this copy has no readable credential; it does not tell you how the original was made.^3
An image has metadata but no Content Credentials
That is a normal result. Ordinary EXIF or PNG metadata and C2PA Content Credentials are different evidence layers. Inspect reports them separately.
Content Credentials are present but untrusted
The credential may still be cryptographically valid, but Inspect could not establish that the signer belongs to the configured trusted ecosystem. Do not collapse “valid” and “trusted” into one label.
Content Credentials are missing
No readable credentials were found in this copy. Editing, export settings, screenshots and messaging platforms can remove metadata. Missing credentials are not a verdict about the image.
The file fails to parse
Try the original JPEG or PNG rather than a partial download. If the image opens in another application but Inspect cannot read it, keep the original and report the file type and failure message. Do not repeatedly upload sensitive copies to unknown services just to obtain a second opinion.
9. Local-first privacy promise
The intended Inspect flow is local-first:
- the original image is checked in the browser;
- the product does not need the image to be uploaded for ordinary inspection;
- exact sensitive metadata is hidden by default;
- certificates are generated locally; and
- experimental forensic analysis is not presented as a confident public verdict.
This guide should be updated if a future feature requires a network request. The interface must say what leaves the browser, why it is needed and how long it is retained.
10. Short version
MUTANT Inspect answers:
- What provenance markers are in this file?
- Are Content Credentials present?
- What readable creator, tool or location metadata is available?
- What can be validated, and what remains untrusted or unknown?
- What should I avoid assuming from the absence of metadata?
It does not answer “Is this image definitely real?” or “Was this image definitely made by AI?” from weak or missing evidence.
→ Open MUTANT Inspect