Certindex Mcp

io.github.certindex由 GitHub 帳號 certindex 發布v0.2.0更新於 Oct 24, 2026

Certificate Transparency search for AI agents: certs, subdomains, issuance history, expiry.

已驗證STDIO僅桌面網頁搜尋與抓取安全與監控

概覽

AI 產生的概覽

本機 MCP 伺服器，讓助理透過 CertIndex API 查詢憑證透明度資料：憑證、子網域、簽發歷史與到期情形。

可以做什麼
  • 搜尋與讀取憑證：依網域、CN、簽發者、SAN、有效期限或萬用字元狀態檢索 CT 索引，依 SHA-256 指紋取得單一憑證，並取得某網域最新的有效憑證。
  • 探索網域：列出某個精確網域下已索引的憑證，列舉 CT 中出現的唯一子網域，並找出在指定天數內到期的憑證。
  • 執行批次掃描：提交針對整個索引的非同步 CN/SAN 子字串掃描（不限網域），並輪詢或分頁取得結果。
  • 查看帳戶與歷史：讀取呼叫方的方案、用量、剩餘配額與權益，並查詢或啟動某網域的付費深度歷史回填。
適用情境
適合助理需要調查某網域或組織的 TLS 憑證時使用：列舉子網域、查看簽發歷史或簽發者、找出即將到期的憑證，或依指紋查找特定憑證。
執行需求
以本機 Python 套件形式執行（Python 3.11+），可用 pip 安裝或透過 uvx 執行；需在 CERTINDEX_API_KEY 環境變數中提供 CertIndex API 金鑰，可從免費方案註冊取得。可選設定 CERTINDEX_BASE_URL 與 CERTINDEX_TIMEOUT。需要透過網路以 HTTPS 存取 CertIndex REST API。
安裝前請注意
需要 CertIndex API 金鑰，透過環境變數傳入，應妥善保密。呼叫會轉送到託管的 CertIndex API，因此所查詢的網域與指紋會離開本機。部分功能受方案限制或需付費：include_signals 需要付費方案，深度歷史回填為付費選項。歷史回填尚未完成，較早的憑證結果可能缺漏。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Certindex Mcp，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

certindex-mcp

[CI] [PyPI] [License: MIT]

An MCP (Model Context Protocol) server that exposes CertIndex's Certificate Transparency search tools to any MCP-compatible client (Claude Desktop, the MCP Inspector, Continue, etc.).

CertIndex ingests certificates directly from public Certificate Transparency logs and serves them from its own index. Historical backfill is still in progress, so results, especially for older certificates, may be incomplete. This server wraps the public CertIndex REST API so an LLM can ask questions like:

  • "List the TLS certificates CertIndex has indexed for example.com."
  • "What subdomains has Let's Encrypt seen for mycompany.io?"
  • "Show me certs expiring in the next 30 days for api.mycompany.io."
  • "Pull the full PEM and CT log metadata for SHA-256 <fingerprint>."

Why this repo exists

The CertIndex monorepo bundles an MCP server (mounted at https://api.ctindex.io/mcp) that talks directly to the production Postgres index. This standalone package is a thin client-side shim: it speaks MCP to your editor / agent and forwards every tool call to the hosted CertIndex REST API over HTTPS. Two consequences:

  1. You don't need a copy of the index — sign up for a free API key at https://ctindex.io and you're done.
  2. The package has a tiny dependency footprint (mcp, httpx, pydantic) — easy to audit, easy to vendor, no DB drivers.

Install

Version 0.3.0 uses MCP Python SDK 2.x (mcp>=2,<3) and Python 3.11+. The console command, environment variables and ten tool names are unchanged. For applications that must retain SDK 1.x, use certindex-mcp==0.2.1.

bash
pip install certindex-mcp

Or with uvx for one-shot use:

bash
uvx certindex-mcp

To install the latest development version from source instead:

bash
pip install git+https://github.com/certindex/certindex-mcp

Quickstart — Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

json
{  "mcpServers": {    "certindex": {      "command": "uvx",      "args": ["certindex-mcp"],      "env": {        "CERTINDEX_API_KEY": "ctx_live_..."      }    }  }}

Restart Claude Desktop. The ten CertIndex tools appear in the tool tray.

Tools

Ten tools, matching the hosted CertIndex MCP server 1:1:

ToolWhat it doesNotable parameters
search_certificatesSearch the CT index by domain, CN, issuer, SAN, validity, or wildcard status.domain, cn, issuer, san, expired, is_wildcard, page/limit
get_certificateFetch a single cert by SHA-256 fingerprint.sha256, include_enrichment
get_domain_certificatesIndexed certs for an exact domain.valid_only, include_enrichment, include_signals (paid plans), page/limit
get_subdomainsEnumerate unique subdomains seen in CT.Offset (page/limit) or keyset cursor mode — pass cursor="" to start, then feed back each response's next_cursor
get_latest_certMost recent currently-valid cert for a domain.include_enrichment, include_signals, include_precerts (let precertificates compete for "latest")
get_expiring_certsCerts for a domain expiring within days days.days
submit_global_sweepSubmit an async, domain-less CN/SAN substring sweep of the entire index (POST /v1/sweeps).cn/san_contains (3+ chars, at least one required), issuer, is_wildcard, is_precert, expired, first_seen_*/not_after_* date bounds, strict_attribution, resume_token (continuation past the result cap)
get_sweep_resultsPoll a sweep job and paginate its results when done (GET /v1/sweeps/{id}).sweep_id, page/limit (up to 1,000)
get_usageCaller's tier, current usage, remaining quota, and entitlements.—
get_historical_backfill_statusCheck / start the paid deep-history backfill for a domain.domain

Quickstart — MCP Inspector

bash
export CERTINDEX_API_KEY=ctx_live_...npx @modelcontextprotocol/inspector uvx certindex-mcp

Configuration

Env varDefaultDescription
CERTINDEX_API_KEY(required)Your CertIndex API key. Mint one at https://ctindex.io/app/keys
CERTINDEX_BASE_URLhttps://api.ctindex.ioOverride for self-hosted deployments / staging
CERTINDEX_TIMEOUT30Per-request HTTP timeout (seconds)

Security

Input validation, rate-limit handling, and our supply-chain posture are documented in SECURITY.md. Please report vulnerabilities to [email protected] rather than filing public issues.

Development

bash
git clone https://github.com/certindex/certindex-mcpcd certindex-mcppip install -e ".[dev]"pytest

CI runs on Python 3.11 / 3.12 / 3.13 with both SDK 2.0.0 and the latest allowed 2.x release. It also installs the built wheel into a fresh environment and exercises initialization, tool enumeration and calls over real stdio. HTTP fixtures run on loopback; tests do not require production credentials.

License

MIT © CertIndex contributors.

來源：README.md，提交 e1cc176

工具

0
SourceWeft 尚未在沙箱中啟動過該軟體包，因此其工具未知。

版本歷史

1
  1. v0.2.0最新Sep 16, 2026

評分

已滿足適用檢查項的 50%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分

    請保持端點能夠回應 MCP 握手；SourceWeft 每 30 天探測一次。

  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分