Certindex Mcp

io.github.certindexPublished by GitHub account certindexv0.2.0Updated Oct 24, 2026

Certificate Transparency search for AI agents: certs, subdomains, issuance history, expiry.

VerifiedSTDIODesktop onlyWeb Search & ScrapingSecurity & Monitoring

Overview

AI-generated overview

Local MCP server that lets an assistant search Certificate Transparency data — certificates, subdomains, issuance history and expiry — via the CertIndex API.

What you can do
  • Search and read certificates: search the CT index by domain, CN, issuer, SAN, validity or wildcard status, fetch a certificate by SHA-256 fingerprint, and get the latest valid cert for a domain.
  • Explore domains: list indexed certificates for an exact domain, enumerate unique subdomains seen in CT, and find certificates expiring within a given number of days.
  • Run bulk sweeps: submit an asynchronous domain-less CN/SAN substring sweep of the whole index and poll or paginate its results.
  • Check account and history: read the caller's tier, usage, remaining quota and entitlements, and check or start the paid deep-history backfill for a domain.
When to use it
Useful when an assistant needs to investigate TLS certificates for a domain or organization: enumerating subdomains, checking issuance history or issuers, spotting certificates about to expire, or looking up a specific certificate by fingerprint.
Requirements
Runs locally as a Python package (Python 3.11+) installed with pip or run via uvx; needs a CertIndex API key in the CERTINDEX_API_KEY environment variable, obtained from a free tier signup. Optional CERTINDEX_BASE_URL and CERTINDEX_TIMEOUT settings. Network access to the CertIndex REST API over HTTPS.
Before you install
Requires a CertIndex API key, which is passed as an environment variable and should be kept secret. Calls are forwarded to the hosted CertIndex API, so queried domains and fingerprints leave your machine. Some features are plan-gated or paid: include_signals needs a paid plan, and the deep-history backfill is a paid option. Historical backfill is incomplete, so older results may be missing.

Installation

In SourceWeft

  1. Open Certindex Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

certindex-mcp

[CI] [PyPI] [License: MIT]

An MCP (Model Context Protocol) server that exposes CertIndex's Certificate Transparency search tools to any MCP-compatible client (Claude Desktop, the MCP Inspector, Continue, etc.).

CertIndex ingests certificates directly from public Certificate Transparency logs and serves them from its own index. Historical backfill is still in progress, so results, especially for older certificates, may be incomplete. This server wraps the public CertIndex REST API so an LLM can ask questions like:

  • "List the TLS certificates CertIndex has indexed for example.com."
  • "What subdomains has Let's Encrypt seen for mycompany.io?"
  • "Show me certs expiring in the next 30 days for api.mycompany.io."
  • "Pull the full PEM and CT log metadata for SHA-256 <fingerprint>."

Why this repo exists

The CertIndex monorepo bundles an MCP server (mounted at https://api.ctindex.io/mcp) that talks directly to the production Postgres index. This standalone package is a thin client-side shim: it speaks MCP to your editor / agent and forwards every tool call to the hosted CertIndex REST API over HTTPS. Two consequences:

  1. You don't need a copy of the index — sign up for a free API key at https://ctindex.io and you're done.
  2. The package has a tiny dependency footprint (mcp, httpx, pydantic) — easy to audit, easy to vendor, no DB drivers.

Install

Version 0.3.0 uses MCP Python SDK 2.x (mcp>=2,<3) and Python 3.11+. The console command, environment variables and ten tool names are unchanged. For applications that must retain SDK 1.x, use certindex-mcp==0.2.1.

bash
pip install certindex-mcp

Or with uvx for one-shot use:

bash
uvx certindex-mcp

To install the latest development version from source instead:

bash
pip install git+https://github.com/certindex/certindex-mcp

Quickstart — Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

json
{  "mcpServers": {    "certindex": {      "command": "uvx",      "args": ["certindex-mcp"],      "env": {        "CERTINDEX_API_KEY": "ctx_live_..."      }    }  }}

Restart Claude Desktop. The ten CertIndex tools appear in the tool tray.

Tools

Ten tools, matching the hosted CertIndex MCP server 1:1:

ToolWhat it doesNotable parameters
search_certificatesSearch the CT index by domain, CN, issuer, SAN, validity, or wildcard status.domain, cn, issuer, san, expired, is_wildcard, page/limit
get_certificateFetch a single cert by SHA-256 fingerprint.sha256, include_enrichment
get_domain_certificatesIndexed certs for an exact domain.valid_only, include_enrichment, include_signals (paid plans), page/limit
get_subdomainsEnumerate unique subdomains seen in CT.Offset (page/limit) or keyset cursor mode — pass cursor="" to start, then feed back each response's next_cursor
get_latest_certMost recent currently-valid cert for a domain.include_enrichment, include_signals, include_precerts (let precertificates compete for "latest")
get_expiring_certsCerts for a domain expiring within days days.days
submit_global_sweepSubmit an async, domain-less CN/SAN substring sweep of the entire index (POST /v1/sweeps).cn/san_contains (3+ chars, at least one required), issuer, is_wildcard, is_precert, expired, first_seen_*/not_after_* date bounds, strict_attribution, resume_token (continuation past the result cap)
get_sweep_resultsPoll a sweep job and paginate its results when done (GET /v1/sweeps/{id}).sweep_id, page/limit (up to 1,000)
get_usageCaller's tier, current usage, remaining quota, and entitlements.—
get_historical_backfill_statusCheck / start the paid deep-history backfill for a domain.domain

Quickstart — MCP Inspector

bash
export CERTINDEX_API_KEY=ctx_live_...npx @modelcontextprotocol/inspector uvx certindex-mcp

Configuration

Env varDefaultDescription
CERTINDEX_API_KEY(required)Your CertIndex API key. Mint one at https://ctindex.io/app/keys
CERTINDEX_BASE_URLhttps://api.ctindex.ioOverride for self-hosted deployments / staging
CERTINDEX_TIMEOUT30Per-request HTTP timeout (seconds)

Security

Input validation, rate-limit handling, and our supply-chain posture are documented in SECURITY.md. Please report vulnerabilities to [email protected] rather than filing public issues.

Development

bash
git clone https://github.com/certindex/certindex-mcpcd certindex-mcppip install -e ".[dev]"pytest

CI runs on Python 3.11 / 3.12 / 3.13 with both SDK 2.0.0 and the latest allowed 2.x release. It also installs the built wheel into a fresh environment and exercises initialization, tool enumeration and calls over real stdio. HTTP fixtures run on loopback; tests do not require production credentials.

License

MIT © CertIndex contributors.

Source: README.md at commit e1cc176

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.2.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts