Certindex Mcp

io.github.certindex由 GitHub 账号 certindex 发布v0.2.0更新于 Oct 24, 2026

Certificate Transparency search for AI agents: certs, subdomains, issuance history, expiry.

已验证STDIO仅桌面网页搜索与抓取安全与监控

概览

AI 生成的概览

本地 MCP 服务器，让助手通过 CertIndex API 查询证书透明度数据：证书、子域名、签发历史与到期情况。

可以做什么
  • 搜索与读取证书：按域名、CN、签发者、SAN、有效期或通配符状态检索 CT 索引，按 SHA-256 指纹获取单张证书，并取得某域名最新的有效证书。
  • 探索域名：列出某精确域名下已索引的证书，枚举 CT 中出现的唯一子域名，并查找在指定天数内到期的证书。
  • 执行批量扫描：提交针对整个索引的异步 CN/SAN 子串扫描（不限域名），并轮询或分页获取结果。
  • 查看账户与历史：读取调用方的套餐、用量、剩余配额与权益，并查询或启动某域名的付费深度历史回填。
适用场景
适合助手需要调查某域名或组织的 TLS 证书时使用：枚举子域名、查看签发历史或签发者、发现即将到期的证书，或按指纹查找特定证书。
运行要求
以本地 Python 包形式运行（Python 3.11+），可用 pip 安装或通过 uvx 运行；需要在 CERTINDEX_API_KEY 环境变量中提供 CertIndex API 密钥，可从免费套餐注册获取。可选设置 CERTINDEX_BASE_URL 与 CERTINDEX_TIMEOUT。需要通过网络以 HTTPS 访问 CertIndex REST API。
安装前请注意
需要 CertIndex API 密钥，通过环境变量传入，应妥善保密。调用会转发到托管的 CertIndex API，因此所查询的域名与指纹会离开本机。部分功能受套餐限制或需付费：include_signals 需要付费套餐，深度历史回填为付费选项。历史回填尚未完成，较早的证书结果可能缺失。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Certindex Mcp，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

certindex-mcp

[CI] [PyPI] [License: MIT]

An MCP (Model Context Protocol) server that exposes CertIndex's Certificate Transparency search tools to any MCP-compatible client (Claude Desktop, the MCP Inspector, Continue, etc.).

CertIndex ingests certificates directly from public Certificate Transparency logs and serves them from its own index. Historical backfill is still in progress, so results, especially for older certificates, may be incomplete. This server wraps the public CertIndex REST API so an LLM can ask questions like:

  • "List the TLS certificates CertIndex has indexed for example.com."
  • "What subdomains has Let's Encrypt seen for mycompany.io?"
  • "Show me certs expiring in the next 30 days for api.mycompany.io."
  • "Pull the full PEM and CT log metadata for SHA-256 <fingerprint>."

Why this repo exists

The CertIndex monorepo bundles an MCP server (mounted at https://api.ctindex.io/mcp) that talks directly to the production Postgres index. This standalone package is a thin client-side shim: it speaks MCP to your editor / agent and forwards every tool call to the hosted CertIndex REST API over HTTPS. Two consequences:

  1. You don't need a copy of the index — sign up for a free API key at https://ctindex.io and you're done.
  2. The package has a tiny dependency footprint (mcp, httpx, pydantic) — easy to audit, easy to vendor, no DB drivers.

Install

Version 0.3.0 uses MCP Python SDK 2.x (mcp>=2,<3) and Python 3.11+. The console command, environment variables and ten tool names are unchanged. For applications that must retain SDK 1.x, use certindex-mcp==0.2.1.

bash
pip install certindex-mcp

Or with uvx for one-shot use:

bash
uvx certindex-mcp

To install the latest development version from source instead:

bash
pip install git+https://github.com/certindex/certindex-mcp

Quickstart — Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

json
{  "mcpServers": {    "certindex": {      "command": "uvx",      "args": ["certindex-mcp"],      "env": {        "CERTINDEX_API_KEY": "ctx_live_..."      }    }  }}

Restart Claude Desktop. The ten CertIndex tools appear in the tool tray.

Tools

Ten tools, matching the hosted CertIndex MCP server 1:1:

ToolWhat it doesNotable parameters
search_certificatesSearch the CT index by domain, CN, issuer, SAN, validity, or wildcard status.domain, cn, issuer, san, expired, is_wildcard, page/limit
get_certificateFetch a single cert by SHA-256 fingerprint.sha256, include_enrichment
get_domain_certificatesIndexed certs for an exact domain.valid_only, include_enrichment, include_signals (paid plans), page/limit
get_subdomainsEnumerate unique subdomains seen in CT.Offset (page/limit) or keyset cursor mode — pass cursor="" to start, then feed back each response's next_cursor
get_latest_certMost recent currently-valid cert for a domain.include_enrichment, include_signals, include_precerts (let precertificates compete for "latest")
get_expiring_certsCerts for a domain expiring within days days.days
submit_global_sweepSubmit an async, domain-less CN/SAN substring sweep of the entire index (POST /v1/sweeps).cn/san_contains (3+ chars, at least one required), issuer, is_wildcard, is_precert, expired, first_seen_*/not_after_* date bounds, strict_attribution, resume_token (continuation past the result cap)
get_sweep_resultsPoll a sweep job and paginate its results when done (GET /v1/sweeps/{id}).sweep_id, page/limit (up to 1,000)
get_usageCaller's tier, current usage, remaining quota, and entitlements.—
get_historical_backfill_statusCheck / start the paid deep-history backfill for a domain.domain

Quickstart — MCP Inspector

bash
export CERTINDEX_API_KEY=ctx_live_...npx @modelcontextprotocol/inspector uvx certindex-mcp

Configuration

Env varDefaultDescription
CERTINDEX_API_KEY(required)Your CertIndex API key. Mint one at https://ctindex.io/app/keys
CERTINDEX_BASE_URLhttps://api.ctindex.ioOverride for self-hosted deployments / staging
CERTINDEX_TIMEOUT30Per-request HTTP timeout (seconds)

Security

Input validation, rate-limit handling, and our supply-chain posture are documented in SECURITY.md. Please report vulnerabilities to [email protected] rather than filing public issues.

Development

bash
git clone https://github.com/certindex/certindex-mcpcd certindex-mcppip install -e ".[dev]"pytest

CI runs on Python 3.11 / 3.12 / 3.13 with both SDK 2.0.0 and the latest allowed 2.x release. It also installs the built wheel into a fresh environment and exercises initialization, tool enumeration and calls over real stdio. HTTP fixtures run on loopback; tests do not require production credentials.

License

MIT © CertIndex contributors.

来源：README.md，提交 e1cc176

工具

0
SourceWeft 尚未在沙箱中启动过该软件包，因此其工具未知。

版本历史

1
  1. v0.2.0最新Sep 16, 2026

评分

已满足适用检查项的 50%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分