claudemark

ClaudeMark is a local-first, zero-egress forensics toolkit for examining and sanitizing AI watermarks and provenance data in text and files you own. It is implemented in Python (3.10+, using the standard library), runs offline, and its core operations make no outbound network calls. It is distributed under the MIT license. Detection and sanitization are organized in layers. Layer A is deterministic text work: it scans for invisible Unicode carriers such as zero-width space, ZWNJ, ZWJ, word joiner, BOM, Mongolian vowel separator, Unicode tags, variation selectors, bidirectional overrides, exotic spaces and homoglyphs, and can render hidden markers as readable tags (for example ZWSP, BOM, RLO) for inspection. Layer B is statistical: the README describes detectors for a Claude research heuristic, Kirchenbauer-class red/green list bias, a SynthID-style detector and a generic detector, plus a best-effort rewrite or disruption pass with before/after evaluation and a side-by-side HTML diff report. For files and containers, it inspects and strips C2PA/JUMBF manifests, EXIF, XMP, IPTC, document XML metadata and generator signatures. Documented format coverage includes PNG, JPEG, WebP, SVG, AVIF, HEIC, PDF, DOCX, ODT, HTML and Markdown, with MP4/MOV/M4A and MP3 tag handling also listed in the format table. Cleaning writes output atomically. Optional host tools — c2patool for C2PA verification, exiftool for secondary metadata inspection, and qpdf for structural PDF object rebuilding — are used when present. A defensive security scanner is included, covering decompression bombs (a 100x compression-ratio cap and a 100 MB uncompressed ceiling), malicious PDF actions such as /JavaScript, /JS, /Launch, /EmbeddedFiles and /SubmitForm, embedded VBA macro projects, and path traversal plus Windows reserved device-name guards. Text-oriented commands verify file signatures and control-byte distributions to refuse binary input rather than corrupting files. The toolkit exposes several interfaces. The CLI offers analyze, unicode inspect/visualize/clean, rewrite, evaluate, diff, inspect, clean, audit, evidence, schema, c2pa inspect, security scan, agent list/exec, serve, doctor and benchmark subcommands, including a dry-run mode for directory cleaning. A standard-library HTTP service serves a web dashboard and a documented REST API (health, capabilities, OpenAPI spec, inspect, clean, analyze, unicode analyze/visualize, rewrite, evaluate, diff, security scan, agent tools/exec), with optional bearer-token auth via an environment variable. An MCP stdio server (claudemark-mcp) exposes the same local tools over initialize, tools/list and tools/call. Skill and rule files can be installed for Claude, Cursor, Antigravity, Grok and Codex through an installer script. Automation integrations include generating OASIS SARIF 2.1.0 output for GitHub code scanning (with a --fail-on option), official pre-commit hooks for Unicode cleaning and repository audit, and Docker Compose packaging that runs with a read-only root filesystem and non-root user. Evidence bundles are ZIP files containing a canonical JSON report and a SHA-256 manifest; including the original file is opt-in, and a verify mode checks the report hash and, when present, the embedded original hash. The documentation notes that a bundle proves integrity of its contents but is not a cryptographic signature or a claim of authorship. Scope limits are stated explicitly. Statistical signals do not prove AI authorship; the project claims no access to proprietary model weights, private vendor watermark keys or undocumented vendor detection APIs; statistical disruption is best-effort and a lower score does not guarantee erasure or different classification elsewhere; and the absence of metadata does not prove content is human-created or provenance-free. Pixel-domain watermark adapters (SynthID-Image, CtrlRegen, MarkDiffusion, Tree-Ring, Stable Signature, StegaStamp) are research interfaces rather than bundled models, and report themselves unavailable until checkpoints are configured. Integration points for the MarkLLM evaluation harness are also described for controlled experiments.