IDigiTrust SSL Toolkit

io.github.MintreetechPublished by GitHub account Mintreetechv1.5.0Updated Oct 29, 2026

Free SSL/PKI tools: HTTPS audit incl. GM SM2/TLCP, DCV pre-check, CSR, cert decode, P12/JKS.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Free remote SSL/PKI toolkit that lets an assistant audit HTTPS, generate CSRs, pre-check DCV, decode certificates and convert key formats.

What you can do
  • Audit HTTPS endpoints: TLS/TLCP handshake, protocol and cipher ratings, RSA/SM2 certificates, full-chain OCSP/CRL revocation and root trust
  • Generate RSA/ECC private keys and CSRs, and decode CSRs for subject, SAN, SPKI fingerprint and self-signature integrity
  • Decode certificates from PEM, base64-DER or DER with all fields, chain revocation checks and root identification
  • Match certificate, private key and CSR by SPKI SHA-256 fingerprint
  • Pre-check domain control validation over DNS TXT/CNAME or HTTP file, and list supported CAs
  • Convert certificates and keys between PEM, P12 and JKS in any direction, including password resets
When to use it
Useful when you need to diagnose a site's TLS setup, prepare a certificate request, verify that a certificate, key and CSR belong together, confirm DNS or HTTP validation records before ordering a certificate, or move keys between PEM, P12 and JKS. It also covers GM/TLCP and SM2 checks that many Western TLS scanners omit.
Requirements
Remote MCP endpoint at tools.idigitrust.com; no API key or registration. The endpoint uses a custom HTTP JSON-RPC transport rather than stdio or standard Streamable HTTP, so some clients need an adapter. Shared IP rate limit of 120 requests per minute; HTTPS and DCV tools wait synchronously, so client timeouts of 120 seconds or more are advised.
Before you install
CSR generation and format conversion return private keys; the README warns not to publish or log those responses. Keys are said to be processed in memory only, but they are still sent to a third-party service. DCV checks and HTTPS audits make the server contact your domain and DNS records. Requests are rate limited per IP and may return HTTP 429.

Installation

In SourceWeft

  1. Open IDigiTrust SSL Toolkit in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.Mintreetech%2Fssl-toolkit-mcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "idigitrust-ssl-toolkit": {
      "type": "http",
      "url": "https://tools.idigitrust.com/api/v1/mcp"
    }
  }
}

README

IDigiTrust SSL Toolkit MCP Server

免费、无需注册的 SSL/PKI 在线工具集 —— 同时提供网页版和 MCP（Model Context Protocol）接口，让你的 AI 助手直接做 HTTPS 体检、生成 CSR、DCV 预检和证书格式转换。

A free SSL/PKI toolkit — web UI plus an MCP (Model Context Protocol) endpoint, so your AI assistant can run HTTPS audits, generate CSRs, pre-check DCV, and convert certificate formats.

为什么用它 / Why

特性说明
国密支持HTTPS 体检支持 TLCP / SM2 / SM3 / SM4 真实握手检测——这是 SSL Labs 等国外工具的空白
真实 DCV 预检DNS（_dnsauth 商业 CA / _acme-challenge ACME 自动切换）+ HTTP 文件双模式，字节级比对、CAA 树状回溯、以 DigiCert DCV Bot/1.1 UA 探测 WAF 拦截
整链吊销检查OCSP / CRL 含交叉证书，基于 CCADB 合并根库做根信任判定
隐私安全私钥仅在内存处理，不落盘、不写日志；API 有 SSRF 防护
AI 原生MCP 端点开箱即用，Claude / Cherry Studio / 任意 MCP 客户端可直接调用

8 个 MCP 工具 / Tools

工具功能
inspect.runHTTPS 体检：协议/套件评级（参考 SSL Labs 规则）、国密 TLCP/SM2、整链 OCSP/CRL 吊销检查
csr.generate生成 RSA / ECC 私钥 + CSR（CN 自动并入 SAN，中文域名自动 Punycode）
csr.decode解析 CSR：Subject、公钥算法、SAN、SPKI 指纹、自签名完整性
cert.decode解析证书（PEM/base64-DER/DER）：全字段 + 整链吊销检查 + 根信任识别
cert.matchcert↔key↔CSR 三两匹配（SPKI SHA-256 指纹比对）
dcv.checkDCV 预检（DNS TXT/CNAME 或 HTTP 文件），返回完整事件流
dcv.list_cas列出支持的 CA（Let's Encrypt / DigiCert / Sectigo / GoDaddy / GlobalSign / ZeroSSL）
convert.runPEM / P12 / JKS 任意方向互转（含 AIA 智能补链）

快速开始 / Quick Start

MCP 客户端接入

MCP 端点为 同源 POST JSON-RPC 2.0 over HTTP（协议版本 2024-11-05）。支持自定义传输的客户端（Cherry Studio 等）填入 URL 即可；标准 Streamable HTTP 客户端请参考下方 客户端兼容性。

示例 —— 调用 dcv.list_cas：

bash
curl -X POST https://tools.idigitrust.com/api/v1/mcp \  -H "Content-Type: application/json" \  -H "Accept: application/json, text/event-stream" \  -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"dcv.list_cas","arguments":{}}}'

完整协议说明（初始化、通知、错误处理、超时建议）见 https://tools.idigitrust.com/llms.txt。

网页版

七个免费模块：HTTPS 体检 · CSR 生成 · 证书匹配 · DCV 检测 · 格式转换 · 证书查看器 · 证书自动化（RoboTLS）。

客户端兼容性 / Client Compatibility

⚠️ 当前端点使用自定义 HTTP JSON-RPC 传输（一次请求一次响应），未提供 stdio / 旧式 HTTP+SSE / 标准 Streamable HTTP。支持自定义传输的客户端可直接使用；其他客户端需要适配器。详见 llms.txt 中的说明。

隐私与安全 / Privacy & Security

  • 私钥仅在内存处理，不落盘、不写入日志
  • API 层有 SSRF 防护，与网页共用 IP 限流（120 req/min）
  • 包含私钥的响应（CSR 生成/格式转换）请勿发布或写入公共日志
  • HTTPS/DCV 类工具同步等待，建议客户端超时 ≥ 120 秒

License

站点内容与文档 © IDigiTrust。MCP 接口免费开放。

Source: README.md at commit 79c5a40

Tools

8

cert.decode

解析证书(PEM / base64-DER / 裸 DER):全字段展开 + 整链吊销检查(OCSP / CRL，含交叉证书)+ 上传链时验证匹配关系并识别根证书。

Parameterscertrequiredchaincheck_revocation

cert.match

证书 / 私钥 / CSR 匹配验证(SubjectPublicKeyInfo SHA-256 指纹比对)。

Parameterscsrkeycertmoderequiredpassword

convert.run

证书 / 密钥格式转换:PEM / P12 / JKS 任意方向(含同格式重置密码)。

Parameterskey_pemcert_pemchain_pemsource_kindrequiredtarget_kindrequiredsource_aliastarget_aliasenable_aia_fillsource_passwordtarget_passwordsource_blob_base64

csr.decode

解析 CSR(PEM / base64-DER / 裸 DER):Subject、公钥算法、SAN、请求扩展、SPKI 指纹、自签名完整性校验。

Parameterscsrrequired

csr.generate

生成 RSA / ECC 私钥与对应 CSR;入参为 Subject + 算法 + 哈希 + SAN。

Parameterssubjectrequiredhash_algalgorithmrequired

dcv.check

DCV 预检 — DNS(TXT/CNAME)或 HTTP 文件验证模式。返回完整事件流(同步等待)。

Parametersmoderequireddomainfile_urltarget_carecord_typeexpected_token

dcv.list_cas

列出已支持的 CA(用于挑战路径推导与 CAA 比对)。

Takes no parameters.

inspect.run

HTTPS 体检：常规 TLS 与国密 TLCP、RSA/SM2 证书、RSA 根信任、整链 OCSP/CRL（含交叉证书）、协议套件及评级。同步等待全部完成。

Parametershostrequiredportforce

Version history

1
  1. v1.5.0LatestOct 29, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.