# certdesk

> TLS cert verdict (OK/WARN/CRITICAL/UNKNOWN) from the served chain: expiry, revocation, alerts

- name: dev.certdesk/certdesk
- version: 0.9.0
- connection class: unknown (unknown)
- trust: 60/100 flags: no-repository
- quality: 72/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/dev.certdesk%2Fcertdesk
- tools: https://api.protogrid.dev/v1/servers/dev.certdesk%2Fcertdesk/tools

**Not classified yet.** The remote endpoints have not been probed successfully, or the listing has nothing to connect to.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "certdesk": {
      "type": "http",
      "url": "https://certdesk.dev/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 26
- freshness: 100
- provenance: 55
- drivers: +dns-namespace +website -unreachable(1 failures) +updated-8d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 72/100 (needs work)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 93 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 7 of 7 tools declare readOnlyHint or destructiveHint
- warn `tools.directory_hints`: 1 of 7 tools declare all four hints; missing: check_expiry (idempotentHint); check_dns (idempotentHint); check_certificate (idempotentHint); …
- pass `tools.token_cost`: about 1,705 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 25 (weight 15)

- warn `stability.changes`: 12 tool changes in 30 days
- fail `stability.rug_pull`: 2 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 7, about 1,705 tokens to load them all
- tool set hash: f17c524241033ba476959be07f66eceb
- tools last changed: 2026-10-19T14:53:09.280Z
- badge: [![protogrid quality](https://protogrid.dev/badge/dev.certdesk/certdesk.svg)](https://protogrid.dev/servers/dev.certdesk/certdesk)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-19 `watch_expiry` changed (inputSchema)
- 2026-10-19 `check_dns_propagation` changed (description)
  - before: Compare answers for one DNS record across resolvers — the authoritative nameservers, Korean ISPs (KT, SK Broadband, LG U+) and public resolvers (Cloudflare, Google, Quad9, OpenDNS) — measured from a Korean network. Use it to confirm a TXT/CNAME for certificate domain validation (e.g. _acme-challenge) has propagated.
  - after: Compare answers for one DNS record across resolvers: the authoritative nameservers, Korean ISPs (KT, SK Broadband, LG U+) and public resolvers (Cloudflare, Google, Quad9, OpenDNS), measured from a Korean network. Use it to confirm a TXT/CNAME for certificate domain validation (e.g. _acme-challenge) has propagated.
- 2026-10-19 `check_expiry` changed (description)
  - before: Verdict for up to 5 domains at once: status OK | WARN | CRITICAL | UNKNOWN per domain combining the served certificate (verification, days left — null when the server cannot be measured) and domain registration expiry (RDAP), plus Korean alert lines. Use this for inventories, CI gates (fail unless status is OK) and periodic checks.
  - after: Verdict for up to 5 domains at once: status OK | WARN | CRITICAL | UNKNOWN per domain combining the served certificate (verification, days left, null when the server cannot be measured) and domain registration expiry (RDAP), plus Korean alert lines. Use this for inventories, CI gates (fail unless status is OK) and periodic checks.
- 2026-10-19 `check_certificate` changed (description)
  - before: Check one domain's TLS certificate and return a verdict: status OK | WARN | CRITICAL | UNKNOWN, judged from the certificate chain the server actually serves — measured from Korean point A (full chain and CRL revocation) plus Korean point B and an overseas point on the Globalping public measurement network (per-point results in measuredFrom; disagreement between points is a WARN) — verification (expired, not yet valid, hostname mismatch, self-signed, untrusted root, missing intermediate, revoked via CRL), days left, renewal point, a newer certificate issued but not deployed (CT logs), the served chain and the issuing CA's incident history. If the server cannot be measured the status is UNKNOWN and CT logs are shown only as an estimate — never as OK. Set detail=true to include the full chain in the text output.
  - after: Check one domain's TLS certificate and return a verdict: status OK | WARN | CRITICAL | UNKNOWN, judged from the certificate chain the server actually serves. Measured from Korean point A (full chain and CRL revocation) plus Korean point B and an overseas point on the Globalping public measurement network (per-point results in measuredFrom; disagreement between points is a WARN). Checks: verification (expired, not yet valid, hostname mismatch, self-signed, untrusted root, missing intermediate, revoked via CRL), days left, renewal point, a newer certificate issued but not deployed (CT logs), the served chain and the issuing CA's incident history. If the server cannot be measured the status is UNKNOWN and CT logs are shown only as an estimate, never as OK. Set detail=true to include the full chain in the text output.
- 2026-10-12 `watch_expiry` changed (description, inputSchema)
  - before: Subscribe an email address to free daily expiry monitoring of up to 5 domains (certificate, domain registration and security grade) with email alerts. Double opt-in: a confirmation email is sent and monitoring starts only after the recipient clicks the link. Use only an address the user owns and explicitly asked to use.
  - after: Subscribe an email address to free daily expiry monitoring of up to 5 domains (certificate, domain registration and security grade) with email alerts, plus an optional Slack/Discord/Telegram/webhook channel. Also alerts when Certificate Transparency logs show a new certificate for a domain from a CA not seen before (possible unauthorized issuance). Double opt-in: a confirmation email is sent and monitoring starts only after the recipient clicks the link; one confirmation email per address per 24 hours. Use only an address the user owns and explicitly asked to use.
- 2026-10-11 `watch_expiry` changed (inputSchema)
- 2026-10-10 `check_certificate` changed (inputSchema)
- 2026-10-04 `watch_expiry` changed (inputSchema)
- 2026-10-04 `check_expiry` changed (inputSchema)
- 2026-10-04 `check_certificate` changed (inputSchema)

Full history: https://api.protogrid.dev/v1/servers/dev.certdesk%2Fcertdesk/changes

## Remotes

- https://certdesk.dev/mcp (streamable-http, auth none, reachable false, uptime30d 0.9120879)

## Packages

_none_

## Tools (7)

- `check_certificate`: Check one domain's TLS certificate and return a verdict: status OK | WARN | CRITICAL | UNKNOWN, judged from the certificate chain the server actually serves. Measured from Korean point A (full chain and CRL revocation) plus Korean point B and an overseas point on the Globalping public measurement network (per-point results in measuredFrom; disagreement between points is a WARN). Checks: verification (expired, not yet valid, hostname mismatch, self-signed, untrusted root, missing intermediate, revoked via CRL), days left, renewal point, a newer certificate issued but not deployed (CT logs), the served chain and the issuing CA's incident history. If the server cannot be measured the status is UNKNOWN and CT logs are shown only as an estimate, never as OK. Set detail=true to include the full chain in the text output.
- `check_dns`: DNS and hosting facts for a domain: nameservers with DNS provider, A/AAAA with IP owner (ASN), CNAME, MX, CAA (which CAs may issue), SPF/DMARC, DNSSEC, registrar and domain expiry (RDAP).
- `check_dns_propagation`: Compare answers for one DNS record across resolvers: the authoritative nameservers, Korean ISPs (KT, SK Broadband, LG U+) and public resolvers (Cloudflare, Google, Quad9, OpenDNS), measured from a Korean network. Use it to confirm a TXT/CNAME for certificate domain validation (e.g. _acme-challenge) has propagated.
- `check_expiry`: Verdict for up to 5 domains at once: status OK | WARN | CRITICAL | UNKNOWN per domain combining the served certificate (verification, days left, null when the server cannot be measured) and domain registration expiry (RDAP), plus Korean alert lines. Use this for inventories, CI gates (fail unless status is OK) and periodic checks.
- `check_security`: Security posture check of a web server (no port scanning): TLS protocol support (legacy 1.0/1.1 detection via a Korean network probe), security headers (HSTS/CSP/X-Content-Type-Options/anti-clickjacking/Referrer-Policy), HTTP→HTTPS redirect, and certificate key/signature strength. Returns per-item pass/warn/fail and an overall grade.
- `explain_tls_error`: Explain a TLS/SSL certificate error message from a browser, curl/OpenSSL, Java, Python, Node.js, Go or .NET: likely causes, fixes, and links to step-by-step guides (Korean). Works offline from a curated knowledge base.
- `watch_expiry`: Subscribe an email address to free daily expiry monitoring of up to 5 domains (certificate, domain registration and security grade) with email alerts, plus an optional Slack/Discord/Telegram/webhook channel. Also alerts when Certificate Transparency logs show a new certificate for a domain from a CA not seen before (possible unauthorized issuance). Double opt-in: a confirmation email is sent and monitoring starts only after the recipient clicks the link; one confirmation email per address per 24 hours. Use only an address the user owns and explicitly asked to use.