Provenance Lens

Documentation

Installation, CLI usage, report schema reference, inspector documentation, exit codes and CI integration examples for Provenance Lens.

Updated: 2026-08-11 Published by Provenance Lens

For developers

Install the local scanner. It runs offline, reads the same signals as the hosted version, and emits the same JSON report schema.

Evidence, not guessing

Provenance Lens reports only what can be checked: a cryptographically signed manifest, a metadata field, a specific codepoint, a documented provider mechanism. When a signal cannot be checked, it says so. It never converts silence into a verdict.

What a report cannot prove

A valid signature proves who signed a manifest, not that the manifest's claims are true.
Metadata is trivially editable. Treat generator fields as an indication, never as proof.
Hidden Unicode characters have many innocent causes, including ordinary copy-paste.

Install and run your first scan

pip install provenance-lens
provenance-lens scan ./image.jpg --json

Stable JSON output

{
  "schemaVersion": "1.0.0",
  "summary": {
    "overallStatus": "VALID",
    "signalsFound": 2
  }
}

Apache-2.0
Runs offline
No file transfer
Versioned reports