# AI Content Credentials & Disclosure Auditor (C2PA) (`prevailing_glow/ai-content-credentials-auditor`) Actor

Audit delivered images for C2PA Content Credentials, IPTC AI markers and visible AI labels. Catch stripped credentials (EU AI Act Art. 50, California SB 942).

- **URL**: https://apify.com/prevailing_glow/ai-content-credentials-auditor.md
- **Developed by:** [Dave West](https://apify.com/prevailing_glow) (community)
- **Categories:** AI, SEO tools, Developer tools
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $4.00 / 1,000 page auditeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## AI Content Credentials & Disclosure Auditor (C2PA, IPTC, EU AI Act Art. 50)

**Check whether the images your website actually delivers still carry Content Credentials (C2PA) and AI markers, and
whether AI images are visibly labelled.** Give it page URLs, a sitemap or image URLs. For every delivered image it
reports whether the file **as served** carries a **C2PA manifest**, whether that manifest **validates** against the
official trust lists, **which organisation signed it**, **which tool made it** (Adobe Firefly, ChatGPT/DALL·E, Google,
Microsoft Designer, a camera, your CMS…), whether it is **marked as AI-generated** (C2PA `digitalSourceType` or the
IPTC/XMP `DigitalSourceType` field), and whether the page shows a **visible AI label** near the image.

The most common real-world result: **your originals are signed, but the resized versions your CMS or CDN delivers are
not.** Image optimizers, thumbnails and WebP/AVIF conversion silently strip provenance metadata. This Actor finds that,
site-wide and on a schedule, instead of one file at a time.

- **Site-wide**: crawl a sitemap (or sitemap index, `.xml.gz`, or just the homepage) up to `maxPages`, or a list of pages.
  Every `<img>`, `srcset`, `<picture>` source and `og:image` is checked; optionally also linked image files.
- **Real C2PA validation** with the official Content Authenticity Initiative library (`@contentauth/c2pa-node`) and the
  **C2PA conformance trust list + CAI trust list**: `valid` (intact and trusted signer), `untrusted` (intact, signer not
  on the trust lists) or `invalid` (tampered, re-encoded after signing, expired or unreadable).
- **AI marking**: C2PA actions with `trainedAlgorithmicMedia` / `compositeWithTrainedAlgorithmicMedia` (also in
  ingredients), AI generators named in the credentials, and the IPTC `DigitalSourceType` in XMP (JPEG, PNG, WebP, AVIF,
  HEIC, GIF, TIFF), even without C2PA.
- **Visible disclosure check** in English, Dutch, German, French and Spanish ("AI-generated", "made with AI", "gemaakt
  met AI", "KI-generiert", "généré par IA", "generado por IA", "Illustration: Midjourney"…) in alt text, figcaptions,
  captions, credits, nearby text and the page.
- **Findings** you can act on: AI image without a visible label, visible label without machine-readable marking,
  invalid credentials, and **credentials stripped from a rendition**.
- **Monitoring**: scheduled runs remember every image and finding, mark images `new`/`changed`, count resolved findings,
  and with `onlyChanges` output (and charge) only new findings.
- **Privacy-friendly**: only organisation names from signing certificates; if a certificate looks personal it is shown
  as `individual certificate`. No cookies, no logins, public pages only.
- **Lightweight**: HTTP only, no browser, 512 MB memory.

### Why now: EU AI Act Art. 50 and California SB 942

- **EU AI Act, Article 50** (transparency obligations) applies from **2 August 2026**. Providers of generative AI must
  mark AI-generated images, audio, video and text in a **machine-readable** way (C2PA Content Credentials and IPTC
  metadata are the practical standards named in the EU Code of Practice on AI-generated content), and deployers must
  disclose deepfakes. Generative AI systems already on the market before that date have until **2 December 2026** to
  apply the marking.
- **California AI Transparency Act (SB 942)** took effect on **2 August 2026**: covered AI providers must embed latent
  provenance disclosures in generated images, video and audio and offer a free detection tool.
- Marks only help if they survive. A widely documented problem is that **CMS image pipelines and CDNs strip C2PA and
  XMP metadata** when they resize, compress or convert images. If you publish AI images (or signed photos), you need
  evidence that the files your visitors receive still carry the marking.

*This Actor is a technical audit tool and not legal advice; see the FAQ.*

### What are Content Credentials, C2PA and IPTC DigitalSourceType?

- **C2PA / Content Credentials** is an open standard (Adobe, Microsoft, Google, OpenAI, BBC, camera makers…) that
  embeds a cryptographically signed "nutrition label" in a file: who created it, with which tool, and which edits were
  made, including whether AI generated it. If the file is changed after signing, validation fails.
- **IPTC DigitalSourceType** is a simple metadata field (stored in XMP) that says how an image was made, e.g.
  `trainedAlgorithmicMedia` (AI-generated) or `compositeWithTrainedAlgorithmicMedia` (AI-edited composite). Many AI
  tools write it; it is not signed, so it is easy to add and easy to lose.
- **Visible labels** ("AI-generated", "Made with AI") are what readers see. Machine-readable marks are what platforms,
  search engines and regulators' tools read. You usually want both.

### Use cases

- **Publishers and newsrooms that sign images** (C2PA adopters): prove your credentials survive your CMS, image CDN
  (Cloudflare, Akamai, Fastly, imgix, Cloudinary, WordPress/Jetpack) and social previews (`og:image`).
- **Brands and agencies using AI imagery**: check that AI visuals on campaign pages and blogs are marked and labelled,
  and find AI images that slipped through without a label.
- **E-commerce and marketplaces**: audit product and listing pages, including third-party sellers' images, for AI
  markers and missing disclosures.
- **Compliance and legal teams, consultants**: repeatable, dated evidence of the provenance status of delivered images
  (dataset export as JSON, CSV or Excel), ahead of the 2 December 2026 deadline.
- **Developers and DevOps**: run it after a CDN, theme or image-optimizer change to catch regressions; compare originals
  (direct `imageUrls` from your DAM) with what the site delivers.

### How it works

1. Collects pages from `startUrls` and/or the sitemap (up to `maxPages`).
2. Fetches each page with plain HTTP and parses the HTML: `og:image`, `<img>` (`src`, or the `srcset` candidate a
   desktop browser would load: the largest up to 2048 px wide or 2x; common lazy-load attributes such as `data-src`),
   `<picture>` sources and, optionally, linked image files.
3. Downloads each image once per run like a browser does (sending `Accept: image/avif,image/webp,…`, so CDNs that
   convert formats deliver the same file your visitors get; size cap `maxImageMegabytes`, files below `minImageBytes` are skipped for free),
   detects the real format from the bytes, reads EXIF/XMP/IPTC and any embedded C2PA manifest, and validates the
   manifest with the C2PA SDK against the C2PA conformance trust list and the CAI trust list.
4. Classifies each image and looks for visible AI labels around it.
5. Computes findings per page, compares with the previous run (named key-value store) and writes the dataset.

#### Classification

| `classification` | Meaning |
|---|---|
| `ai-marked` | Marked as AI-generated or AI-edited: C2PA AI action/generator and/or IPTC `DigitalSourceType` = `trainedAlgorithmicMedia` / `compositeWithTrainedAlgorithmicMedia` |
| `c2pa-signed (not AI)` | Carries Content Credentials, no AI marker (e.g. a signed camera photo or CMS-signed image) |
| `metadata-only` | Has EXIF/XMP/IPTC metadata but no Content Credentials and no AI marker |
| `no-provenance` | No Content Credentials, no AI marker; `metadataStripped: true` when it has no metadata at all |

#### Findings (each one is a `finding` event)

| Finding | When |
|---|---|
| `ai-image-without-visible-label` | The image is AI-marked, but no AI disclosure was found in its alt text, caption, nearby text or anywhere on the page |
| `visible-label-without-marking` | Alt text/caption says the image is AI (or the page says its images are AI), but the delivered file carries no machine-readable AI marking: the typical sign of a pipeline that strips metadata (relevant to Art. 50) |
| `credentials-invalid` | Content Credentials are present but do not validate (reported once per image per run) |
| `credentials-stripped-rendition` | The same image (same file name, different size/format) is delivered both with and without provenance on one page: one finding per image group |

### Input

| Field | Default | Description |
|---|---|---|
| `startUrls` | – | Pages to audit. Links are not followed (use a sitemap for whole sites). A URL that is an image is checked as a direct image. |
| `sitemapUrl` | – | Sitemap, sitemap index, `.xml.gz`, or a homepage (sitemap found via robots.txt or `/sitemap.xml`). |
| `imageUrls` | – | Image files to check directly (no minimum size). Max 1000. |
| `maxPages` | 50 | Max pages per run (start URLs first, then sitemap pages). |
| `maxImagesPerPage` | 30 | Images per page, in document order with `og:image` first. |
| `minImageBytes` | 5000 | Skip smaller files (icons, tracking pixels) for free. |
| `maxImageMegabytes` | 15 | Skip larger files for free. |
| `includeLinkedImages` | false | Also check image files the page links to (e.g. "download original"). |
| `checkVisibleLabels` | true | Look for visible AI disclosures and report the two label findings. |
| `onlyChanges` | false | Output/charge only new findings and new or changed image rows (first run = baseline). |
| `stateStoreName` | `ai-content-credentials-auditor-state` | Named key-value store holding the history (one record per site host). |

**Empty input runs a demo** with public files that are known to carry Content Credentials or IPTC AI markers (Adobe
Firefly, Google, Microsoft Designer, OpenAI DALL·E, a Gemini PNG with IPTC metadata, a C2PA test file, an invalid C2PA
test file) and a Wikimedia Commons page where the original keeps its credentials but the delivered thumbnails do not.

#### Example: audit a site via its sitemap

```json
{
    "sitemapUrl": "https://www.example.com/sitemap.xml",
    "maxPages": 200,
    "maxImagesPerPage": 30
}
```

#### Example: weekly monitoring of your AI campaign pages, alerts only

```json
{
    "startUrls": [{ "url": "https://www.example.com/campaign/spring" }, { "url": "https://www.example.com/blog/ai-visuals" }],
    "onlyChanges": true,
    "stateStoreName": "example-com-provenance"
}
```

#### Example: compare your DAM originals with what the CDN delivers

```json
{
    "imageUrls": ["https://dam.example.com/originals/hero.jpg", "https://cdn.example.com/img/hero-1200w.webp"]
}
```

### Output

The dataset has three row types; use the **Images**, **Pages** and **Summary** views in the Output tab, or filter on
`type`. A JSON summary with counters, charged events and memory use is stored in the default key-value store as `SUMMARY`.

#### Image rows (`type: "image"`, one per unique image)

```json
{
    "type": "image",
    "pageUrl": "https://commons.wikimedia.org/wiki/File:Adobe_Firefly_generated_landscape_photography.jpg",
    "imageUrl": "https://upload.wikimedia.org/wikipedia/commons/a/ab/Adobe_Firefly_generated_landscape_photography.jpg",
    "foundVia": "link",
    "classification": "ai-marked",
    "aiMarked": true,
    "aiSource": "c2pa",
    "aiEvidence": ["C2PA c2pa.created: trainedAlgorithmicMedia"],
    "aiTool": "Adobe Firefly",
    "c2paPresent": true,
    "validation": "valid",
    "validationCodes": [],
    "signerOrg": "Adobe Inc.",
    "signedAt": "2024-06-14",
    "generator": "Adobe Firefly",
    "c2paActions": ["c2pa.created (trainedAlgorithmicMedia)"],
    "digitalSourceType": null,
    "metadataStripped": false,
    "visibleLabel": "Adobe Firefly generated",
    "visibleLabelWhere": "title",
    "findings": [],
    "format": "jpeg",
    "bytes": 844288,
    "changeType": "baseline"
}
```

`aiSource` is `c2pa`, `iptc-xmp`, `c2pa+iptc-xmp` or `null`. `validation` is `valid`, `untrusted`, `invalid` or `null`
(no credentials). `changeType` is `baseline` (first run for the site), `new`, `changed` or `unchanged`. Also included:
`hasExif`, `hasXmp`, `hasIptc`, `remoteManifestUrl` (XMP `dcterms:provenance`), `otherAiHints` (non-standard AI
traces such as Stable Diffusion parameters), `finalUrl` after redirects.

#### Page rows (`type: "page"`)

```json
{
    "type": "page",
    "pageUrl": "https://commons.wikimedia.org/wiki/File:Adobe_Firefly_generated_landscape_photography.jpg",
    "status": "ok",
    "imagesFound": 15,
    "imagesChecked": 8,
    "imagesSkipped": 7,
    "skippedReasons": { "too-small": 4, "not-image": 2, "failed": 1 },
    "aiMarked": 1,
    "signed": 1,
    "metadataStripped": 7,
    "coveragePct": 12.5,
    "visibleLabelFound": true,
    "visibleLabelPhrase": "AI-generated",
    "findings": [
        {
            "type": "credentials-stripped-rendition",
            "imageUrl": "https://thumb.wikimedia.org/.../1280px-Adobe_Firefly_generated_landscape_photography.jpg",
            "detail": "6 rendition(s) of this image carry no Content Credentials or IPTC marker, while https://upload.wikimedia.org/.../Adobe_Firefly_generated_landscape_photography.jpg on the same page does. Your image resizer/CDN probably strips provenance.",
            "isNew": true
        }
    ],
    "findingCount": 2
}
```

`coveragePct` = share of checked images with machine-readable provenance (Content Credentials or any IPTC
`DigitalSourceType`). Pages that cannot be fetched get `status: "error"` with the HTTP status and are not charged.

#### Summary row (`type: "summary"`, always present, free)

Totals, coverage, credentials valid/untrusted/invalid, findings by type, resolved findings since the last run, and a
plain-English `verdict`, for example:

> None of 120 images carry Content Credentials (C2PA) or IPTC AI markers. If you publish AI-generated images, the EU AI
> Act Art. 50 (in force since 2 Aug 2026) and California SB 942 expect machine-readable marking; your CMS, image
> optimizer or CDN may strip it (see README). 87 of 120 files carry no EXIF/XMP/IPTC metadata at all, a typical sign of
> a pipeline that strips metadata.

**"Nothing signed" is the most common result today.** It is useful: if you do publish AI or signed images, it means the
marks are lost before they reach visitors. Check your image optimizer/CDN settings ("preserve metadata", "keep C2PA",
"strip EXIF"), test with `includeLinkedImages` or direct `imageUrls` pointing at your originals, and re-run.

### Pricing (pay per event)

| Event | Price | When |
|---|---|---|
| `page-audited` | $0.004 | Per HTML page fetched and analysed (failed pages are free) |
| `image-checked` | $0.001 | Per unique image downloaded and inspected (tiny, oversized, non-image and failed files are free; an image shown on many pages is charged once per run) |
| `finding` | $0.01 | Per finding delivered (with `onlyChanges`: only new findings) |

The summary row is free. Examples: 100 pages × 10 images with no findings ≈ $0.40 + $1.00 = **$1.40**; the demo run
≈ $0.05. Runs respect your **maximum total charge**: when the budget is reached, the Actor stops cleanly, marks the
summary as `partial` and never charges beyond your limit.

### Scheduling (monitoring)

Create a schedule (for example weekly) with the same input and `onlyChanges: true`. The first run is a full baseline;
later runs report new AI images, images whose credentials changed (e.g. became invalid after a CDN change), new
findings, and how many findings were resolved. Use a separate `stateStoreName` per project.

### Limitations

- **No JavaScript rendering**: images injected by JavaScript (some sliders, infinite scroll, client-side frameworks)
  are not seen. Common lazy-load attributes (`data-src`, `data-srcset`) are read; `lazyLoadedImagesNotChecked` counts
  the rest that could be detected.
- **CSS background images, video and audio** are not checked in this version.
- **Watermarks** (Google SynthID, Meta/TikTok invisible watermarks, Digimarc) are not detected: only embedded metadata
  and Content Credentials are read. A file without marks is not proof that it is human-made.
- **Remote manifests** (credentials stored in the cloud, referenced from XMP or HTTP headers) are reported via
  `remoteManifestUrl` but not fetched.
- **Visible-label detection is heuristic** (phrase patterns in five languages near the image or on the page). Icons,
  badges or labels drawn into the image itself are not recognised.
- `credentials-stripped-rendition` groups renditions by file name (e.g. `hero-1024x683.jpg` and `hero.jpg`, MediaWiki
  `960px-` thumbnails); CDNs that rename files completely are not grouped.
- "Untrusted" means the signer is not on the C2PA conformance or CAI trust lists bundled/refreshed at run time; it does
  not mean the file was tampered with.
- Some sites block or rate-limit automated requests. The Actor slows down per host on HTTP 429/503 and retries, and stops requesting a host after three requests still fail; those pages are reported with `status: "error"` and not charged.

### FAQ

**Is this legal advice?** No, this is not legal advice. It is an automated technical check of the files as they are delivered. Under the EU AI
Act Art. 50 the machine-readable marking duty falls mainly on **providers** of AI systems; deployers' visible-disclosure
duties apply mainly to deepfakes and AI-generated text on matters of public interest. Use the results as evidence and
hygiene, and ask your legal adviser how the rules apply to you.

**Why do pages from companies that promote Content Credentials show no credentials?** Because most image pipelines
re-encode images and drop metadata. That is exactly what this Actor is designed to detect.

**Which formats are supported?** JPEG, PNG, WebP, AVIF, HEIC, GIF and TIFF for C2PA; EXIF/XMP/IPTC detection for the
same formats. SVG and ICO files are skipped.

**Does it store the images?** No. Images are inspected in memory and discarded; the dataset contains only the results.

# Actor input Schema

## `startUrls` (type: `array`):

Web pages to audit. Every delivered image on each page is checked (<code>\<img></code>, <code>srcset</code>, <code>\<picture></code> sources, <code>og:image</code>). Links on the pages are not followed: use a sitemap to audit a whole site. A URL that turns out to be an image is checked as a direct image. When page URLs, sitemap and image URLs are all empty, the run uses a demo input.

## `sitemapUrl` (type: `string`):

XML sitemap or sitemap index (also <code>.xml.gz</code>), e.g. <code>https://www.example.com/sitemap.xml</code>. A homepage URL also works: the sitemap is then found via robots.txt or <code>/sitemap.xml</code>. Pages are audited up to <b>Max pages</b> (page URLs above count first).

## `imageUrls` (type: `array`):

Image files to check directly, e.g. originals from your DAM next to the delivered CDN versions. The minimum file size does not apply to these. Max 1000.

## `maxPages` (type: `integer`):

Maximum number of pages to audit (page URLs plus sitemap pages).

## `maxImagesPerPage` (type: `integer`):

Images per page in document order (<code>og:image</code> first). An image used on many pages is downloaded and charged only once per run.

## `minImageBytes` (type: `integer`):

Smaller files (icons, logos, tracking pixels) are skipped for free. Set to 0 to check everything.

## `maxImageMegabytes` (type: `integer`):

Larger files are skipped for free (reported as <code>too-large</code>).

## `includeLinkedImages` (type: `boolean`):

Also checks image files the page links to (<code>\<a href="…jpg"></code>), such as "download original" links. Useful to compare originals with the resized versions shown on the page.

## `checkVisibleLabels` (type: `boolean`):

Looks for visible AI disclosures (EN/NL/DE/FR/ES, e.g. "AI-generated", "gemaakt met AI", "KI-generiert", "généré par IA", "generado por IA") in alt text, captions, nearby text and the page, and reports <code>ai-image-without-visible-label</code> and <code>visible-label-without-marking</code> findings.

## `onlyChanges` (type: `boolean`):

For scheduled runs: output (and charge) only findings that are new since the last run, plus image rows that are new or changed. Pages and images are still inspected and charged as usual. The first run for a site is a full baseline.

## `stateStoreName` (type: `string`):

Named key-value store that remembers images and findings between runs (one record per site). Use a different name per project to keep histories apart.

## Actor input object example

```json
{
  "startUrls": [
    {
      "url": "https://commons.wikimedia.org/wiki/File:Adobe_Firefly_generated_landscape_photography.jpg"
    }
  ],
  "imageUrls": [
    "https://commons.wikimedia.org/wiki/Special:FilePath/260526_Nakamura_Kazuha.png",
    "https://raw.githubusercontent.com/microsoft/c2pa-extension-validator/main/test/media/DALL-E_cloud_surfing_puppy.webp"
  ],
  "maxPages": 50,
  "maxImagesPerPage": 30,
  "minImageBytes": 5000,
  "maxImageMegabytes": 15,
  "includeLinkedImages": false,
  "checkVisibleLabels": true,
  "onlyChanges": false,
  "stateStoreName": "ai-content-credentials-auditor-state"
}
```

# Actor output Schema

## `images` (type: `string`):

One row per checked image: classification (ai-marked / c2pa-signed (not AI) / metadata-only / no-provenance), Content Credentials validation, signer organisation, claim generator, AI marker source, IPTC DigitalSourceType, stripped metadata, visible label, findings and change type.

## `pages` (type: `string`):

One row per audited page: images checked, AI-marked and signed counts, provenance coverage %, visible AI label and findings.

## `summaryRow` (type: `string`):

Free summary row with totals, coverage, finding counts and a plain-English verdict.

## `summary` (type: `string`):

Counters, charged events, HTTP usage, memory and warnings for the run.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "startUrls": [
        {
            "url": "https://commons.wikimedia.org/wiki/File:Adobe_Firefly_generated_landscape_photography.jpg"
        }
    ],
    "imageUrls": [
        "https://commons.wikimedia.org/wiki/Special:FilePath/260526_Nakamura_Kazuha.png",
        "https://raw.githubusercontent.com/microsoft/c2pa-extension-validator/main/test/media/DALL-E_cloud_surfing_puppy.webp"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("prevailing_glow/ai-content-credentials-auditor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "startUrls": [{ "url": "https://commons.wikimedia.org/wiki/File:Adobe_Firefly_generated_landscape_photography.jpg" }],
    "imageUrls": [
        "https://commons.wikimedia.org/wiki/Special:FilePath/260526_Nakamura_Kazuha.png",
        "https://raw.githubusercontent.com/microsoft/c2pa-extension-validator/main/test/media/DALL-E_cloud_surfing_puppy.webp",
    ],
}

# Run the Actor and wait for it to finish
run = client.actor("prevailing_glow/ai-content-credentials-auditor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "startUrls": [
    {
      "url": "https://commons.wikimedia.org/wiki/File:Adobe_Firefly_generated_landscape_photography.jpg"
    }
  ],
  "imageUrls": [
    "https://commons.wikimedia.org/wiki/Special:FilePath/260526_Nakamura_Kazuha.png",
    "https://raw.githubusercontent.com/microsoft/c2pa-extension-validator/main/test/media/DALL-E_cloud_surfing_puppy.webp"
  ]
}' |
apify call prevailing_glow/ai-content-credentials-auditor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,prevailing_glow/ai-content-credentials-auditor"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/f7gs7eJCr6M7RJufu/builds/3fDOM3qcVXECK5FMF/openapi.json