ATK Security Checks

Check TLS certificate

check_tls_certificate

Read-onlyIdempotent

Certificate issuer, expiry date, days left, and whether the chain verifies for the hostname from a strict client (catches missing intermediate certificates and name mismatches). Free.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "hostname": "<hostname>"
    },
    "name": "check_tls_certificate"
  }
}

Input Schema

Name	Required	Description	Default
`hostname`	Yes	Public DNS hostname, e.g. www.example.com. IP addresses and internal names are refused.

Schema Changelog

Changes observed during successful MCP inspections.

First observedOct 22, 2026

TDQS

A3.5/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare read-only, idempotent, open-world and non-destructive, so the safety profile is covered. The description adds genuinely new context: verification is done from a strict client, and the specific classes of failure it catches, plus that the call is free — useful for an agent weighing invocation cost.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence that lists return fields first and the diagnostic value second, with no filler. The sentence is a verbless fragment and the trailing 'Free.' is terse, but neither wastes space.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter read tool with rich annotations and no output schema, the description carries the return-value burden well by enumerating the fields the agent will get back. Minor gap: no mention of behavior on unreachable hosts or timeouts, which an agent might want to know when chaining calls.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the hostname parameter is already well documented in the schema, including the refusal of IPs and internal names. The description only echoes 'for the hostname' and adds no format or constraint detail beyond what the schema supplies, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the concrete outputs (issuer, expiry date, days left, chain verification result) and the failure modes it detects (missing intermediates, name mismatches), which tells an agent precisely what this tool produces. It does not, however, distinguish itself from the sibling check_post_quantum_tls, which likely overlaps in scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to reach for this versus check_post_quantum_tls or other siblings, and no prerequisites or exclusions beyond the schema's note about IPs/internal names. 'Free' hints at a cost tradeoff but is not usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All ATK Security Checks tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?