API and MCP

Developers

Check AI Free has a header endpoint the website and the MCP adapter call, a pixel endpoint restricted to this site and its extension, and a URL fetcher used by the website’s link box. There is no API key and no separate public API product. This page describes those routes as they are in the repository.

17 October 2026 · Check AI Free

POST /api/v1/detect

This is the source and header route. It accepts multipart form data with an image field, plus optional original_size and original_mime. The MIME must be image/jpeg, image/png or image/webp, taken from original_mime when that field is present and otherwise from the uploaded part. The size check uses original_size when it is present, otherwise the uploaded part’s size, and rejects anything over 10 MB with 400_PAYLOAD_TOO_LARGE. A missing file is 400_MISSING_IMAGE. An unsupported type is 400_INVALID_FORMAT.

The route runs the same header reader as the website’s edge fallback. Text clues are taken from the first 64 KB of the bytes you send. The website sends that slice on purpose: the browser has already looked at the first 64 KB locally, and only if that pass finds nothing decisive does it post the slice, the original filename, the original size and the original MIME. The MCP adapter does not slice. It uploads the selected file, up to 10 MB. Dimensions for a JPEG can be read from a SOF marker in the bytes received. The response JSON includes an id, a timestamp, a status of completed or uncertain, result.verdict, result.confidence, result.ai_probability, a signals array, classifier_available, and meta for width, height, size, mime and processing time.

A minimal call, which uploads the whole file the way the MCP adapter does:

curl -s \
  -F "[email protected]" \
  -F "original_mime=image/jpeg" \
  https://checkaifree.com/api/v1/detect

The website’s own call is smaller. It appends a Blob of file.slice(0, 65536), the original size, and the original MIME. If you are reproducing the website, send that slice. If you are reproducing the MCP adapter, send the file. Do not send images you are not willing to have processed on the edge. The route reads the bytes in memory and does not save them as an image file. See the privacy page for hosting and logs.

POST /api/v1/classify

This is the pixel route. The website calls it only after the header pass is uncertain and classifier_available is true. The browser first draws a JPEG whose longest edge is at most 1,536 pixels at quality 0.92, which drops embedded EXIF from that copy, and posts it as the image field. The route accepts JPEG, PNG or WebP under 4 MB. Anything else is 400_INVALID_IMAGE.

It is not a general third-party endpoint. The handler allows the request only when the host is checkaifree.com or www.checkaifree.com, or localhost for development, and the Origin is absent, one of those https hosts, or the published extension origin chrome-extension://npdobikplogncfhnlppnbhpbjnhcbikm. Other callers get 403_FORBIDDEN. When no provider is configured, or the provider call fails, the route returns an inconclusive body rather than a score. The error text for a provider failure mentions a daily limit or a provider error; the repository does not publish a numeric quota. A successful body includes result.verdict, result.ai_probability, confidence, and a signal whose code is pixel_classifier. Scores for a given reduced image may be cached at the edge for up to 30 days, keyed by a hash of that copy. The cache does not store the original file. The provider in use is whichever of Hive or Sightengine the deployment has configured, or neither.

GET /api/v1/fetch-url

The website uses this route when someone pastes a direct image URL. It is not a supported integration API and it is not a general proxy. The query parameter is url. The target must be http or https, without a username or password. Localhost, .local, .internal, link-local, loopback, private IPv4 and literal IPv6 are rejected. Redirects are checked one by one, up to three, and a redirect to a private host is rejected. The fetch times out after 10 seconds. The response must be image/jpeg, image/png or image/webp and at most 10 MB, or the route returns an error. A success response is the image bytes with Cache-Control: no-store. Building on this URL as an open fetcher is out of scope for this page.

checkaifree-mcp 1.0.1

The package checkaifree-mcp is the Model Context Protocol adapter. Version 1.0.1 is the release in this repository and on npm. It speaks stdio. No service API key is required. Install it by adding a local MCP server that runs npx -y checkaifree-mcp. The source in this repo is mcp-server/. The public repository is hyai-dev/checkaifree-mcp. The registry entry is checkaifree-mcp on npm.

{
  "mcpServers": {
    "checkaifree": {
      "command": "npx",
      "args": ["-y", "checkaifree-mcp"]
    }
  }
}

Two tools are registered. detect_ai_image takes one of image_url, file_path or image_base64. inspect_c2pa_provenance takes image_url or file_path. The second name is historical. Both tools upload the selected bytes to https://checkaifree.com/api/v1/detect and format the header response. A supplied URL is fetched by the Node process first, then uploaded. Private and loopback hosts are blocked on that fetch. Local paths must be a real file ending in .jpg, .jpeg, .png or .webp, and hidden or sensitive names are refused. The 10 MB cap applies to the URL download, the file and the base64 payload. JPEG, PNG and WebP only.

The formatted reading tells you when the result is source text, when it is a camera-metadata observation, and when it is inconclusive. It prints a model percentage only for a completed pixel_classifier score. This adapter does not produce that score, because it never calls the classify route. A C2PA line from the second tool means a source marker was observed, or that none was observed in the inspected bytes. It does not mean a signature was verified. Do not send a sensitive image through the adapter without reading the privacy page. The method page is the description of what a reading means.

The in-browser tools under /tools are a different surface. The EXIF viewer, the C2PA checker, the metadata remover and the PNG readers process the file locally and do not call these endpoints. Use them when you want the field itself. Use the API or the MCP adapter when you want the same header reading the website falls back to, and you accept the upload.