certdesk

dev.certdeskPublished by certdesk.devOfficial publisherv0.9.0Updated Oct 24, 2026

TLS cert verdict (OK/WARN/CRITICAL/UNKNOWN) from the served chain: expiry, revocation, alerts

VerifiedStreamable HTTPWeb executableCloud & InfrastructureSecurity & Monitoring

Overview

AI-generated overview

Checks TLS certificates, DNS, and web server security for domains and returns OK/WARN/CRITICAL verdicts, with optional email expiry monitoring.

What you can do
  • Check one domain's TLS certificate chain and get a verdict with revocation and multi-point measurements
  • Check expiry for up to 5 domains at once, combining certificate and domain registration expiry for inventories or CI gates
  • Inspect DNS and hosting facts: nameservers, A/AAAA with ASN, MX, CAA, SPF/DMARC, DNSSEC and registrar
  • Compare one DNS record across authoritative, Korean ISP and public resolvers
  • Review server security posture: legacy TLS, security headers, HTTPS redirect and key strength
  • Explain TLS error messages from browsers, curl/OpenSSL, Java, Python, Node.js, Go or .NET
When to use it
Useful when you need quick, repeatable certificate and DNS diagnostics for a domain, such as before a launch, during an outage, or as a check in a CI pipeline. Also fits teams that want low-effort expiry monitoring without running their own scanner.
Requirements
Remote streamable HTTP endpoint at certdesk.dev; no package, environment variable or header is declared. Measurements are taken from Korean network vantage points plus an overseas point. The expiry monitoring tool needs an email address and, optionally, a Slack, Discord, Telegram or webhook target.
Before you install
watch_expiry subscribes an email address to recurring alerts and can post to third-party chat or webhook channels, so confirm the recipient and channel before calling it. Checks are performed from outside against the named domains, and results depend on the Korean measurement points. Explanatory guides are in Korean.

Installation

In SourceWeft

  1. Open certdesk in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/dev.certdesk%2Fcertdesk/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "certdesk": {
      "type": "http",
      "url": "https://certdesk.dev/mcp"
    }
  }
}

Tools

7

check_certificate

Check one domain's TLS certificate and return a verdict: status OK | WARN | CRITICAL | UNKNOWN, judged from the certificate chain the server actually serves. Measured from Korean point A (full chain and CRL revocation) plus Korean point B and an overseas point on the Globalping public measurement network (per-point results in measuredFrom; disagreement between points is a WARN). Checks: verification (expired, not yet valid, hostname mismatch, self-signed, untrusted root, missing intermediate, revoked via CRL), days left, renewal point, a newer certificate issued but not deployed (CT logs), the served chain and the issuing CA's incident history. If the server cannot be measured the status is UNKNOWN and CT logs are shown only as an estimate, never as OK. Set detail=true to include the full chain in the text output.

ParametersportdetaildomainrequiredcritDayswarnDays

check_expiry

Verdict for up to 5 domains at once: status OK | WARN | CRITICAL | UNKNOWN per domain combining the served certificate (verification, days left, null when the server cannot be measured) and domain registration expiry (RDAP), plus Korean alert lines. Use this for inventories, CI gates (fail unless status is OK) and periodic checks.

ParametersdomainsrequiredcritDayswarnDays

check_security

Security posture check of a web server (no port scanning): TLS protocol support (legacy 1.0/1.1 detection via a Korean network probe), security headers (HSTS/CSP/X-Content-Type-Options/anti-clickjacking/Referrer-Policy), HTTP→HTTPS redirect, and certificate key/signature strength. Returns per-item pass/warn/fail and an overall grade.

Parametersdomainrequired

check_dns

DNS and hosting facts for a domain: nameservers with DNS provider, A/AAAA with IP owner (ASN), CNAME, MX, CAA (which CAs may issue), SPF/DMARC, DNSSEC, registrar and domain expiry (RDAP).

Parametersdomainrequired

check_dns_propagation

Compare answers for one DNS record across resolvers: the authoritative nameservers, Korean ISPs (KT, SK Broadband, LG U+) and public resolvers (Cloudflare, Google, Quad9, OpenDNS), measured from a Korean network. Use it to confirm a TXT/CNAME for certificate domain validation (e.g. _acme-challenge) has propagated.

Parametersnamerequiredtyperequired

explain_tls_error

Explain a TLS/SSL certificate error message from a browser, curl/OpenSSL, Java, Python, Node.js, Go or .NET: likely causes, fixes, and links to step-by-step guides (Korean). Works offline from a curated knowledge base.

Parameterserrorrequired

watch_expiry

Subscribe an email address to free daily expiry monitoring of up to 5 domains (certificate, domain registration and security grade) with email alerts, plus an optional Slack/Discord/Telegram/webhook channel. Also alerts when Certificate Transparency logs show a new certificate for a domain from a CA not seen before (possible unauthorized issuance). Double opt-in: a confirmation email is sent and monitoring starts only after the recipient clicks the link; one confirmation email per address per 24 hours. Use only an address the user owns and explicitly asked to use.

ParametersemailrequireddomainsrequiredwebhookcritDayswarnDaysslackWebhook

Version history

6
  1. v0.9.0LatestOct 12, 2026
  2. v0.8.0Oct 11, 2026
  3. v0.6.0Oct 10, 2026
  4. v0.5.0Oct 5, 2026
  5. v0.4.0Oct 3, 2026
  6. v0.3.0Sep 26, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.