🔏 Mutant Content Credentials

Mutant Content Credentials is the most interesting node in this pack, because it does something you rarely see in ComfyUI: it embeds a cryptographically signed C2PA manifest into your PNG. C2PA (Coalition for Content Provenance and Authenticity) is the open provenance standard backed by Adobe, Microsoft, Google, the BBC and a pile of camera and media companies - the same system behind Photoshop's "Content Credentials" and the labels on GPT-4o images. Native C2PA signing from a ComfyUI node, with no external service and no account, is genuinely uncommon. If you've been hand-editing XMP or praying that the workflow chunk counts as attribution, this is a step up.

What it actually does: it takes your image, builds a signed manifest recording who created it, what model made it, and when, plus a "Do Not Train" assertion, then writes a signed PNG to your output folder. Verify it by dropping the file on mutantwork.com/verify (or any C2PA verifier) and the badge appears.

How it works

The manifest carries three assertions: a c2pa.training-mining entry (set to notAllowed when do_not_train is on, allowed when off), a schema.org CreativeWork block with the author name, and a c2pa.actions record that logs a c2pa.created action with your AI model name. The whole thing is signed with an ES256 key via the c2pa-python library, timestamps against DigiCert's server, and the result is written out as a fresh PNG. It ships with bundled test certificates, so it works out of the box with zero setup - which is both the feature and the caveat.

Inputs and outputs

• image (required) - what gets signed.
• creator_name - your name or brand (default Mutantwork).
• ai_model - the model that generated it (default ComfyUI).
• do_not_train - on by default; embeds the training-mining notAllowed assertion.
• filename_prefix - output prefix (c2pa_signed).
• custom_cert_pem / custom_key_pem - optional paths to your own certificate and key. The tooltips are clear: leave blank to use the bundled test cert.

Outputs: image (pass-through) and credentials_log (STRING - save path, creator, model, cert used, and whether signing succeeded).

The honest parts

Three things to internalize. First, the bundled test cert means "verify at mutantwork.com/verify" is Mutantwork's own trust - it proves the file was signed with their bundled key, not that a real CA vouches for you. Fine for learning and for your own gallery; for anything you're shipping, generate your own certificate and pass the paths in. Second, do_not_train is an assertion, not enforcement - it's a machine-readable policy statement baked into the file, and nothing stops a scraper from ignoring it. Third, it's metadata: screenshot it, re-encode it, post it somewhere that recompresses, and the manifest is gone. The community figured this out the moment GPT-4o shipped C2PA watermarks - "sounds like just EXIF data… does it survive a screenshot?" is essentially the answer. Your original signed PNG is the only copy that carries the claim.

That framing also explains why this matters beyond the hobby: the EU AI Act's Article 50 obligations (in force 2 August 2026) require generative systems to mark outputs "in a machine-readable format and detectable as artificially generated." Tools like this are how that starts to get practical.

Install and gotchas

Part of ComfyUI-Mutantwork - Manager → search ComfyUI-Mutantwork → install → restart, or:

cd ComfyUI/custom_nodes
git clone https://github.com/brerereton-beep/ComfyUI-Mutantwork.git
pip install -r ComfyUI-Mutantwork/requirements.txt

This is the one node in the pack with a real dependency: c2pa-python (and cryptography for the signing callback). The node handles a missing install gracefully - it saves the PNG unsigned and explains in the credentials_log that you need pip install c2pa-python. One more thing: it signs only the first image in a batch, so for multi-image batches, expect a single signed output.