MCP server

Installs the MCP server, a skill telling the agent when to reach for it, and a hook that checks public-facing content the agent writes before it ships:

claude plugin marketplace add maxbeech/watermarkremoverpro
claude plugin install watermarkremoverpro@watermarkremoverpro

The server is a single committed file that runs under plain node. There is nothing to install, no build step and no checkout to keep current, which is the only version of this that survives contact with a real workflow.

Clone the repository (or copy plugins/watermarkremoverpro/dist/mcp-server.mjs out of it) and point your client at the bundled server over stdio:

{
  "mcpServers": {
    "watermarkremoverpro": {
      "command": "node",
      "args": ["/path/to/watermarkremoverpro/plugins/watermarkremoverpro/dist/mcp-server.mjs"],
      "env": { "WATERMARKREMOVERPRO_API_KEY": "mw_live_..." }
    }
  }
}

Or, for Claude Code without the plugin: claude mcp add watermarkremoverpro -- node /path/to/plugins/watermarkremoverpro/dist/mcp-server.mjs

The WATERMARKREMOVERPRO_API_KEY line is optional and only affects check_document. Leave it out and everything runs locally, which is the default. Keys still begin mw_live_, and MARKWITNESS_API_KEY is the pre-rename name of the same variable and still works, so a config written before the rename needs no edit.

After the agent writes or edits a file that looks like public web content (markdown, HTML, or anything under a content/, posts/ or blog/ path), the hook measures the prose and reports what it found: AI tells, three-item-list and “not just X, but Y” constructions, elevated AI-associated vocabulary, and any passage carrying watermark signal that survives correction.

It never edits the file. A hook that silently rewrites what an agent just wrote is a hook that makes changes nobody reviewed. It also stays completely silent on clean prose, on source code, and on anything under 120 words, because a check that fires on every write gets muted within a day.

Local (no API key). The engine runs in the MCP server process against the published open reference key. Nothing leaves the machine, nothing is recorded, nothing is billed. This is the right mode for confidential drafts.

Hosted (with an API key). Calls go to https://www.neverprompted.com/api/v1/check, which additionally applies any vendor or institution detection keys that deployment holds, which cannot be shipped to a local process without publishing them, saves the check to your history, and meters it at 2p per 1,000 words.

check_document

Takes text, and optionally language and granularity. Returns the full analysis: the keyed watermark statistic with its confidence band, the style measurement, the FDR-corrected per-passage breakdown, and the stated limits.

describe_method

Takes nothing and sends no document. Returns what is measured, which keys are available in the current mode, which languages have baselines, the limits, and the rewrite capability's own stated limits, so an agent can decide whether a check will answer its question before sending anything.

reduce_ai_evidence

Takes text, and optionally language, strength (preserve / balanced / aggressive / regenerate), tier (free / pro), and model (standard, the default rule-based engine, or advanced, a real local LLM downloaded and cached on first use). Rewrites the passages a real per-passage check flags, on-device, and returns the revised text alongside the same stated limits every surface carries: it cannot guarantee defeating an undisclosed vendor watermark, on any tier.

calibrate_text

A lighter, fully deterministic synonym-substitution pass over a document's word frequencies, returning suggested substitutions with before/after metrics rather than a finished rewrite. For the fuller pass that also targets flagged passages and removes stylistic AI tells, use reduce_ai_evidence instead.

The tool description says this and it is worth repeating: a detected mark is not proof of authorship, and an absent mark is not proof of human authorship. Because the construction is keyed and no vendor publishes a detection key, “no mark detected” always means “under the keys listed in this response”.

An agent that reports this result as a verdict on who wrote something is misreporting it. Pass the limits array through to whatever consumes the answer.

reduce_ai_evidence and calibrate_text always run in this server's own process, unlike check_document. There is no WATERMARKREMOVERPRO_API_KEY branch for either, no REST endpoint, and no parameter that sends the document anywhere: rewriting is more sensitive than measuring, and gets no exception to the on-device guarantee. See docs/REWRITE_PHILOSOPHY.md in the repository for what the rewrite tools claim and do not claim.

The full stated limits