guillaumemeyer/watermarks-remover

What it does

watermarks-remover is a Python toolkit and local HTTP service for removing AI provenance marks from files you own or are authorized to process. It targets several distinct channels at once: invisible Unicode carriers in text (zero-width characters, bidi controls, tag characters, space homoglyphs), C2PA and generator metadata in images, PDFs and Office documents, and statistical token-level watermarks in generated text.

The README describes a two-layer model. Layer A handles edit-based carriers in text and file metadata, and its removals are verifiable (Unicode counts, metadata actions). Layer B attacks sampling watermarks through heavy rewriting, and is explicitly described as best-effort. The project also ships detection entry points: /detect runs vendor detectors and stylometry on text and an optional SynthID pixel score on images, while /watermark generates marked text for round-trip testing project README.

It is aimed at people cleaning their own manuscripts, documentation, web copy, photos and documents — not at making false "human-written" claims. The README's ethics section restricts use to content you own or are authorized to process.

Quick start

The core service and scripts need only Python 3.10+ and the standard library. c2patool, exiftool and qpdf are optional system tools that are used when present; the Docker image bundles them README.

Start the local HTTP service:

make serve
# or directly:
python3 service/scripts/server.py --host 127.0.0.1 --port 8765

Then run the CLI on a file. Inspect first, then clean to a new path:

SCRIPTS=service/scripts
python3 "$SCRIPTS/inspect_file.py" draft.md
python3 "$SCRIPTS/clean_file.py" draft.md -o draft.cleaned.md

The same commands work for images and containers, for example photo.png -o photo.cleaned.png or notes.docx -o notes.cleaned.docx. Image and container metadata cleaning works out of the box; text cleaning through the HTTP /clean endpoint needs a Layer B rewrite backend configured (transformers with a RoBERTa-large MLM step and WATERMARKS_REWRITE_* LLM settings), otherwise text cleaning returns HTTP 400 configuration notes.

To use the agent skill in Claude Code, add the bundled marketplace and install the plugin:

/plugin marketplace add guillaumemeyer/watermarks-remover
/plugin install watermarks-remover@watermarks-remover

The skill itself ships no code; it calls the HTTP service, so the service must be running and reachable, with WATERMARKS_SERVICE_URL set if it is not http://127.0.0.1:8765 skill install. Other hosts (Codex, Cursor, Cowork, Grok) have separate install paths through install_skill.py.

Requirements and limits

• Text cleaning over HTTP requires Layer B configuration; without it, text requests to /clean fail rather than silently degrading.
• Text tools refuse binary input, and unrecognized formats are never auto-cleaned: clean_file.py exits 2 without writing output unless --as text or --force-text is passed README.
• A real PDF metadata strip needs qpdf for a structural rebuild, because exiftool writes PDFs incrementally and leaves the original metadata bytes in place. Even qpdf does not descend into image XObjects inside a PDF PDF handling notes.
• Pixel-domain removal (SynthID-class, StegaStamp, Tree-Ring, StableSignature) depends on external backends. CtrlRegen expects roughly 10 GB of model downloads and strongly recommends a GPU; some upstream models are gated, so HF_TOKEN must be set in the environment. The reverse-SynthID scorer is not bundled and stays under its upstream non-commercial research license CtrlRegen notes.
• Cleaning cannot certify that vendor detectors will fail; the README lists residual soft-bound and pixel marks as known risk residual risk.
• The project is MIT-licensed. The ethics section restricts it to owned or authorized content.

HotRepo's take

In the weekly Python ranking dated 2026-11-01, the project recorded 1,025 new stars, a total of 25,841 stars and 2,943 forks, and reached position 8 on that list. That is a notable showing for a tool whose text-side feature is openly framed as best-effort rather than a guaranteed eraser. The framing is the interesting part: the README separates verifiable Layer A removals from statistical Layer B rewrites, publishes a coverage matrix by vendor and channel, and documents residual risk instead of claiming detection bypass. For a project in the watermark-removal space — where overclaiming is common — that distinction is what the ranking data alone cannot show.