AI Watermark & Metadata Remover MCP

An MCP server that finds and strips AI provenance marks from text and files — invisible Unicode characters, C2PA / Content Credentials, EXIF and XMP metadata, and document properties.

No API keys. No configuration. Connect it and the tools work.

Why you want this

LLM output and AI-generated media carry markers you cannot see:

• Invisible Unicode — zero-width spaces, word joiners, tag characters and bidirectional controls embedded between ordinary letters. They survive copy-paste, break string comparisons, and silently corrupt config files, SQL, and JSON with syntax errors that show up nowhere in your editor.
• C2PA / Content Credentials — signed provenance manifests attached to generated images.
• EXIF / XMP — GPS coordinates, device identifiers, and the software that produced the file.
• Document properties — author, last-modified-by, and generator strings inside DOCX, XLSX, PPTX, ODT and PDF.

If you have ever chased a bug caused by a character you could not see, this is the tool that finds it in one call.

Where to use it

Before pasting AI output into code. LLM text carries zero-width characters that survive copy-paste. They turn valid JSON, YAML, SQL and .env files into parse errors with nothing visibly wrong — the bug you spend an hour on and then find by hex-dumping the file. One clean_text call before it lands in the repo.

Before committing. Run it over anything an assistant generated. Once an invisible character is in a commit, finding it later means bisecting history for a character you cannot see.

Before publishing photos. Phone photos carry GPS coordinates. Posting one from home publishes your address, precisely, to anyone who opens the EXIF.

Before sending documents to a client. DOCX, XLSX, PPTX and PDF carry dc:creator, lastModifiedBy and Producer — your username, your colleague's name, the AI tool that drafted it, and sometimes the file path it was saved from. Most people have never looked.

Before uploading AI-generated images. Generated images carry C2PA / Content Credentials manifests and XMP blocks naming the model that produced them.

When handling files from someone else. inspect_file tells you what a file is carrying before you forward it, publish it, or commit it — without changing anything.

Auditing in bulk. inspect_batch scans up to 50 files in one call, so you can sweep an outbound folder or a content directory and see exactly which files leak what.

Checking pasted text you did not write. Invisible characters are also used to fingerprint documents — a distinct pattern per recipient, so a leak traces back to whoever it was sent to. inspect_text shows you the pattern.

Works with

Any client that speaks the Model Context Protocol — Claude Code, Claude Desktop, Cursor, Cline, Windsurf, VS Code (GitHub Copilot), Zed, Continue, LibreChat, and anything built on the MCP SDKs or LangChain's MCP adapters.

The endpoint is Streamable HTTP, so there is nothing to install locally — no Python, no Docker, no dependencies. You need an Apify API token, which you can get free at console.apify.com.

Endpoint

https://ankitsharma-29--ai-marks-remover-mcp.apify.actor/mcp

Claude Code

claude mcp add --transport http ai-marks \
  https://ankitsharma-29--ai-marks-remover-mcp.apify.actor/mcp \
  --header "Authorization: Bearer YOUR_APIFY_TOKEN"

Claude Desktop / Cursor / Windsurf — add to the MCP config file (claude_desktop_config.json, .cursor/mcp.json, or the equivalent):

{
  "mcpServers": {
    "ai-marks": {
      "url": "https://ankitsharma-29--ai-marks-remover-mcp.apify.actor/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_APIFY_TOKEN"
      }
    }
  }
}

VS Code — add to .vscode/mcp.json:

{
  "servers": {
    "ai-marks": {
      "type": "http",
      "url": "https://ankitsharma-29--ai-marks-remover-mcp.apify.actor/mcp",
      "headers": { "Authorization": "Bearer YOUR_APIFY_TOKEN" }
    }
  }
}

Then just ask: "check this text for invisible characters", "strip the metadata from this screenshot", or "clean the EXIF from these images before I publish them."

Tools

Tool	What it does
inspect_text	Report every invisible mark in a string, with codepoints, names and positions
clean_text	Strip them. Visible wording is never changed
inspect_file	Report C2PA, EXIF/XMP, document properties and hidden Unicode in a file
clean_file	Strip all of it and return the cleaned file
detect_watermark	Run statistical text-watermark detectors
inspect_batch	Inspect up to 50 files in one call
capabilities	Report which optional backends this deployment has

Supported formats

PNG, JPEG, WebP, AVIF, HEIC, BMP, GIF, TIFF, SVG, PDF, DOCX, XLSX, PPTX, EPUB, ODT, HTML, Markdown, plain text, MP4, MOV, M4A, WAV, MP3.

What it does not change

• Your wording. Punctuation, em dashes and curly quotes are left exactly as written. Only characters that render as nothing are removed; characters that render as whitespace are normalised to a plain space.
• Your pixels. Images are never re-encoded. Metadata chunks are dropped and the image data passes through byte for byte, so there is no quality loss.
• Load-bearing characters. Emoji joiners, script joiners in Arabic, Devanagari, Thai and similar, complete flag sequences, and directional marks next to right-to-left text are preserved by default. Pass strict: true to remove those too.

Files whose format cannot be recognised are refused rather than guessed at, so the tool never writes back mangled bytes.

Usage

// Find what is hidden in a string
inspect_text({ "text": "Hello​ world" })
// → suspicious_total: 1, U+200B ZERO WIDTH SPACE at offset 5

// Remove it
clean_text({ "text": "Hello​ world" })
// → "Hello world"

// Strip a generated image
clean_file({ "file_base64": "<base64>", "filename": "render.png" })
// → cleaned file, plus a report of every chunk dropped

Honest limits

• Statistical text watermarks (SynthID-class token-sampling schemes) live in the word choices themselves, not in any removable character. detect_watermark reports what it can, but no tool can remove these without rewriting the text, and none can certify a result against a vendor's private key.
• Pixel-domain image watermarks are out of scope. Stripping C2PA metadata does not clear a watermark encoded in the pixels.
• PDF strips are complete only where qpdf and exiftool are present. They are installed in this image — call capabilities to confirm.

Pricing

Free to use. You pay only your own Apify platform usage, which for this Actor is small — it runs in 256 MB and shuts down when idle.

A paid tier may be added later for high-volume use. If that happens, a free tier for normal use will remain, and existing users will be notified before anything changes.

Intended use

Privacy and file hygiene on content you own or are authorised to process: scrubbing metadata before publishing, catching invisible characters before they reach a repository, and removing author and location data from outbound documents. Users are responsible for complying with applicable law and platform terms.