Provenance Lens

Developers

Install the open-source Provenance Lens CLI, run local scans, integrate JSON reports into CI, and read the report schema. No account, no upload.

Updated: 2026-08-11 Published by Provenance Lens

For developers

Install the local scanner. It runs offline, reads the same signals as the hosted version, and emits the same JSON report schema.

Evidence, not guessing

Provenance Lens reports only what can be checked: a cryptographically signed manifest, a metadata field, a specific codepoint, a documented provider mechanism. When a signal cannot be checked, it says so. It never converts silence into a verdict.

What a report cannot prove

A valid signature proves who signed a manifest, not that the manifest's claims are true.
Metadata is trivially editable. Treat generator fields as an indication, never as proof.
Hidden Unicode characters have many innocent causes, including ordinary copy-paste.

Install and run your first scan

pip install provenance-lens
provenance-lens scan ./image.jpg --json

Stable JSON output

{
  "schemaVersion": "1.0.0",
  "summary": {
    "overallStatus": "VALID",
    "signalsFound": 2
  }
}

Apache-2.0
Runs offline
No file transfer
Versioned reports