CertGuard

dev.workers.mike-tusa.certguardPublished by certguard.mike-tusa.workers.devOfficial publisherv0.3.0Updated Nov 1, 2026

Free SSL/TLS certificate checker: expiry, chain trust, hostname match, TLS version, A/B/C/F grade.

VerifiedStreamable HTTPWeb executableSecurity & Monitoring

Overview

AI-generated overview

CertGuard is a remote MCP server that lets an assistant run a live TLS handshake against a host and audit its SSL/TLS certificate with an A/B/C/F grade.

What you can do
  • Check a host's TLS certificate: run a live handshake against a hostname and port (443 by default, plus 8443, 465, 993, 995) and get an A/B/C/F grade with findings.
  • Inspect certificate details: expiry in days remaining, hostname match, chain completeness and trust against Mozilla's root store, negotiated TLS version and cipher suite, and key type and size.
When to use it
Useful when you want an assistant to quickly verify whether a site's certificate is valid, trusted, correctly matched to its hostname, and not close to expiry, without leaving the conversation.
Requirements
A remote streamable HTTP endpoint; no local install. Works anonymously, but an optional free cg_ key sent as an Authorization Bearer token or X-API-Key header raises rate limits.
Before you install
Anonymous use is limited to roughly 10 checks per minute and 200 per day per IP. Revocation (OCSP/CRL) is never checked, hosts on Cloudflare's own network cannot be checked live, and results are cached for up to 10 minutes. The optional API key is a credential and should be kept private.

Installation

In SourceWeft

  1. Open CertGuard in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/dev.workers.mike-tusa.certguard%2Fcertguard/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "certguard": {
      "type": "http",
      "url": "https://certguard.mike-tusa.workers.dev/mcp"
    }
  }
}

Tools

1

check_certificate

Check a server's SSL/TLS certificate (expiry, chain, hostname, TLS version)

Run a live TLS handshake against host:port and audit the certificate the server presents. Returns an A/B/C/F grade and summary, expiry (days remaining), hostname match, chain completeness and trust against Mozilla's root store, negotiated TLS version and cipher suite, key type/size, findings, and a link to the full report. Revocation (OCSP/CRL) is NOT checked. Hosts on Cloudflare's own network cannot be checked live (result: isError with code live_check_unavailable, no grade); a failed handshake returns check_failed with no grade. Read-only: it only opens a TLS connection to the public host. Same engine, cache and limits as the CertGuard JSON API (GET /api/v1/check).

Parametershostrequiredportinclude_raw

Version history

2
  1. v0.3.0LatestNov 1, 2026
  2. v0.2.0Oct 9, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.