# The image tool

```
inspect_image_credentials(image_url)
```

It asks Mintall's backend to fetch one image and read the C2PA credential
embedded in its bytes: whether one is present, whether it validates, who signed
it and when, and the blockchain record the image claims.

It describes the image file only. To check the product page, use
[`verify_mintall_certificate`](/mcp/tool).

## Arguments

| Argument    | Type   | Notes                                                                                               |
| ----------- | ------ | --------------------------------------------------------------------------------------------------- |
| `image_url` | string | Required. One image file: a `contentUrl` from a certificate's `certifiedImages`, or an `<img>` src. |

## The result

An image with a credential:

```json
{
  "scope": "image_bytes",
  "verdict": "credential_present",
  "requestedUrl": "https://store.example/images/everyday-tote.jpg",
  "finalUrl": "https://store.example/images/everyday-tote.jpg",
  "mediaType": "image/jpeg",
  "embeddedCredential": {
    "present": true,
    "activeManifest": "...",
    "claimGenerator": "...",
    "signingTime": "2026-09-09T08:30:00+00:00",
    "signer": { "issuer": "...", "commonName": "..." },
    "assertionLabels": ["c2pa.actions", "c2pa.nft"],
    "assertionsTruncated": false
  },
  "blockchain": {
    "name": "...",
    "network": "...",
    "chainId": "...",
    "tokenId": "...",
    "transactionHash": "...",
    "certificateTime": "2026-09-09T08:30:00+00:00",
    "explorerUrl": "..."
  },
  "warnings": [
    "This result describes the image file only. To check the product page, use verify_mintall_certificate."
  ],
  "errors": []
}
```

### Fields

| Field                | Meaning                                                                                        |
| -------------------- | ---------------------------------------------------------------------------------------------- |
| `scope`              | Always `image_bytes`. The result describes the image file, never a page.                       |
| `verdict`            | The verdict, always present. The five values are listed below.                                 |
| `requestedUrl`       | The URL you submitted.                                                                         |
| `finalUrl`           | Where the fetch landed after redirects.                                                        |
| `mediaType`          | The image format, read from the file's bytes, not its `Content-Type`.                          |
| `embeddedCredential` | The manifest: signer, signing time, the signing tool, and its assertion labels.                |
| `blockchain`         | What the image's `c2pa.nft` assertion claims. `null` when it makes no claim.                   |
| `warnings`           | Sentences an agent can act on. The first always says the result describes the image file only. |
| `errors`             | Why the fetch failed, as `image fetch failed: <finding>`. Empty otherwise.                     |

## Verdicts

| `verdict`            | Meaning                                                  |
| -------------------- | -------------------------------------------------------- |
| `credential_present` | A manifest was read and C2PA did not mark it invalid.    |
| `credential_invalid` | A manifest was read and C2PA marked it invalid.          |
| `no_credential`      | The image carries no C2PA manifest.                      |
| `image_fetch_failed` | Blocked, timed out, too large, or non-2xx. See `errors`. |
| `not_an_image`       | The bytes are not a supported image format.              |

**Editing an image can remove its credential:** `no_credential` describes the file at `image_url`, not the original. Resizing
  or re-encoding an image often removes its credential. A storefront CDN such as
  Shopify's re-encodes the images it serves, so an image read from
  `cdn.shopify.com` usually comes back `no_credential`. Read the original asset,
  such as a `contentUrl` from the certificate, instead.

## Plain HTTP

The same read is a single POST to the
[credential reads](/api/credential-reads) endpoint, with no MCP client
involved.