Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "certdesk": {
      "type": "http",
      "url": "https://certdesk.dev/mcp"
    }
  }
}

claude mcp add --transport http certdesk https://certdesk.dev/mcp

[mcp_servers.certdesk]
url = "https://certdesk.dev/mcp"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "certdesk": {
      "type": "remote",
      "url": "https://certdesk.dev/mcp",
      "enabled": true
    }
  }
}

{
  "mcpServers": {
    "certdesk": {
      "type": "http",
      "url": "https://certdesk.dev/mcp"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=certdesk&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vY2VydGRlc2suZGV2L21jcCJ9"
}

{
  "servers": {
    "certdesk": {
      "type": "http",
      "url": "https://certdesk.dev/mcp"
    }
  }
}

{
  "mcpServers": {
    "certdesk": {
      "httpUrl": "https://certdesk.dev/mcp"
    }
  }
}

extensions:
  "certdesk":
    enabled: true
    name: "certdesk"
    type: streamable_http
    uri: "https://certdesk.dev/mcp"
    timeout: 300

Quality 72 / 100needs work

protocol75 · weight 25

warn
protocol.modernnewest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
n/a
protocol.statelessonly applies to 2026-07-28 servers
pass
protocol.transportstreamable HTTP
n/a
protocol.list_ttlonly applies to 2026-07-28 servers

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene93 · weight 30

pass
tools.descriptionsevery tool has a description
pass
tools.description_lengthdescriptions are concise
pass
tools.schemasevery tool has an object input schema
pass
tools.annotations7 of 7 tools declare readOnlyHint or destructiveHint
warn
tools.directory_hints1 of 7 tools declare all four hints; missing: check_certificate (idempotentHint); check_expiry (idempotentHint); check_security (idempotentHint); …
pass
tools.token_costabout 1,705 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stability25 · weight 15

warn
stability.changes12 tool changes in 30 days
fail
stability.rug_pull2 tools kept their name but changed most of their description in 30 days; review before trusting them

dependenciesn/a · weight 15

n/a
deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

7 tools, about 1,705 tokens to load them all · tool set f17c52424103 · tools last changed 2026-10-19 · checked 2026-10-19 21:10 UTC

Tool changes

2026-10-19watch_expirychangedinput schema
2026-10-19check_dns_propagationchangeddescription
before
Compare answers for one DNS record across resolvers — the authoritative nameservers, Korean ISPs (KT, SK Broadband, LG U+) and public resolvers (Cloudflare, Google, Quad9, OpenDNS) — measured from a Korean network. Use it to confirm a TXT/CNAME for certificate domain validation (e.g. _acme-challenge) has propagated.
after · 100% of words in common
Compare answers for one DNS record across resolvers: the authoritative nameservers, Korean ISPs (KT, SK Broadband, LG U+) and public resolvers (Cloudflare, Google, Quad9, OpenDNS), measured from a Korean network. Use it to confirm a TXT/CNAME for certificate domain validation (e.g. _acme-challenge) has propagated.
2026-10-19check_expirychangeddescription
before
Verdict for up to 5 domains at once: status OK | WARN | CRITICAL | UNKNOWN per domain combining the served certificate (verification, days left — null when the server cannot be measured) and domain registration expiry (RDAP), plus Korean alert lines. Use this for inventories, CI gates (fail unless status is OK) and periodic checks.
after · 100% of words in common
Verdict for up to 5 domains at once: status OK | WARN | CRITICAL | UNKNOWN per domain combining the served certificate (verification, days left, null when the server cannot be measured) and domain registration expiry (RDAP), plus Korean alert lines. Use this for inventories, CI gates (fail unless status is OK) and periodic checks.
2026-10-19check_certificatechangeddescription
before
Check one domain's TLS certificate and return a verdict: status OK | WARN | CRITICAL | UNKNOWN, judged from the certificate chain the server actually serves — measured from Korean point A (full chain and CRL revocation) plus Korean point B and an overseas point on the Globalping public measurement network (per-point results in measuredFrom; disagreement between points is a WARN) — verification (expired, not yet valid, hostname mismatch, self-signed, untrusted root, missing intermediate, revoked via CRL), days left, renewal point, a newer certificate issued but not deployed (CT logs), the served chain and the issuing CA's incident history. If the server cannot be measured the status is UNKNOWN and CT logs are shown only as an estimate — never as OK. Set detail=true to include the full chain in the text output.
after · 99% of words in common
Check one domain's TLS certificate and return a verdict: status OK | WARN | CRITICAL | UNKNOWN, judged from the certificate chain the server actually serves. Measured from Korean point A (full chain and CRL revocation) plus Korean point B and an overseas point on the Globalping public measurement network (per-point results in measuredFrom; disagreement between points is a WARN). Checks: verification (expired, not yet valid, hostname mismatch, self-signed, untrusted root, missing intermediate, revoked via CRL), days left, renewal point, a newer certificate issued but not deployed (CT logs), the served chain and the issuing CA's incident history. If the server cannot be measured the status is UNKNOWN and CT logs are shown only as an estimate, never as OK. Set detail=true to include the full chain in the text output.
2026-10-12watch_expirychangeddescription, input schema
before
Subscribe an email address to free daily expiry monitoring of up to 5 domains (certificate, domain registration and security grade) with email alerts. Double opt-in: a confirmation email is sent and monitoring starts only after the recipient clicks the link. Use only an address the user owns and explicitly asked to use.
after · 61% of words in common
Subscribe an email address to free daily expiry monitoring of up to 5 domains (certificate, domain registration and security grade) with email alerts, plus an optional Slack/Discord/Telegram/webhook channel. Also alerts when Certificate Transparency logs show a new certificate for a domain from a CA not seen before (possible unauthorized issuance). Double opt-in: a confirmation email is sent and monitoring starts only after the recipient clicks the link; one confirmation email per address per 24 hours. Use only an address the user owns and explicitly asked to use.
2026-10-11watch_expirychangedinput schema
2026-10-10check_certificatechangedinput schema
2026-10-04watch_expirychangedinput schema
2026-10-04check_expirychangedinput schema
2026-10-04check_certificatechangedinput schema

Showing the latest 10. Full history: list_changes · trend: quality JSON.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 82 / 100

no-repository

provenance55

liveness97

freshness100

hygiene80

+dns-namespace +website +reachable +uptime-92% +updated-8d-ago -no-repository

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://certdesk.dev/mcp` streamable-http	none	yes	92%	293 ms	2025-11-25	2026-10-19

Tools (7)

`check_certificate`read-only	Check one domain's TLS certificate and return a verdict: status OK \| WARN \| CRITICAL \| UNKNOWN, judged from the certificate chain the server actually serves. Measured from Korean point A (full chain and CRL revocation) plus Korean point B and an overseas point on the Globalping public measurement network (per-point results in measuredFrom; disagreement between points is a WARN). Checks: verification (expired, not yet valid, hostname mismatch, self-signed, untrusted root, missing intermediate, revoked via CRL), days left, renewal point, a newer certificate issued but not deployed (CT logs), the served chain and the issuing CA's incident history. If the server cannot be measured the status is UNKNOWN and CT logs are shown only as an estimate, never as OK. Set detail=true to include the full chain in the text output.
`check_dns`read-only	DNS and hosting facts for a domain: nameservers with DNS provider, A/AAAA with IP owner (ASN), CNAME, MX, CAA (which CAs may issue), SPF/DMARC, DNSSEC, registrar and domain expiry (RDAP).
`check_dns_propagation`read-only	Compare answers for one DNS record across resolvers: the authoritative nameservers, Korean ISPs (KT, SK Broadband, LG U+) and public resolvers (Cloudflare, Google, Quad9, OpenDNS), measured from a Korean network. Use it to confirm a TXT/CNAME for certificate domain validation (e.g. _acme-challenge) has propagated.
`check_expiry`read-only	Verdict for up to 5 domains at once: status OK \| WARN \| CRITICAL \| UNKNOWN per domain combining the served certificate (verification, days left, null when the server cannot be measured) and domain registration expiry (RDAP), plus Korean alert lines. Use this for inventories, CI gates (fail unless status is OK) and periodic checks.
`check_security`read-only	Security posture check of a web server (no port scanning): TLS protocol support (legacy 1.0/1.1 detection via a Korean network probe), security headers (HSTS/CSP/X-Content-Type-Options/anti-clickjacking/Referrer-Policy), HTTP→HTTPS redirect, and certificate key/signature strength. Returns per-item pass/warn/fail and an overall grade.
`explain_tls_error`read-only	Explain a TLS/SSL certificate error message from a browser, curl/OpenSSL, Java, Python, Node.js, Go or .NET: likely causes, fixes, and links to step-by-step guides (Korean). Works offline from a curated knowledge base.
`watch_expiry`	Subscribe an email address to free daily expiry monitoring of up to 5 domains (certificate, domain registration and security grade) with email alerts, plus an optional Slack/Discord/Telegram/webhook channel. Also alerts when Certificate Transparency logs show a new certificate for a domain from a CA not seen before (possible unauthorized issuance). Double opt-in: a confirmation email is sent and monitoring starts only after the recipient clicks the link; one confirmation email per address per 24 hours. Use only an address the user owns and explicitly asked to use.

Schemas: list_tools.

Similar MCP servers

Official server.json

{
  "name": "dev.certdesk/certdesk",
  "title": "certdesk",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://certdesk.dev/mcp",
      "type": "streamable-http"
    }
  ],
  "version": "0.9.0",
  "websiteUrl": "https://certdesk.dev/en/api/",
  "description": "TLS cert verdict (OK/WARN/CRITICAL/UNKNOWN) from the served chain: expiry, revocation, alerts"
}