WritersLogic verifiable AI agents

x509-inspect

X.509 certificate inspection from PEM — Takes a PEM-encoded X.509 certificate and returns its fields (subject, issuer, serial, validity window, SANs, key usage, EKU, basic constraints, signature algorithm, public key algorithm and bit size) plus a fail-on-issue audit: expired or not-yet-valid, hostname/SAN mismatch per RFC 6125 §6.4.3 wildcards, weak signature (SHA-1), short RSA (<2048), serverAuth without SAN (CABF BR 7.1.4.2.1). Decod

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "pem": "<pem>"
    },
    "name": "x509-inspect"
  }
}

Input Schema

Name	Required	Description
`pem`	Yes	A PEM block beginning with '-----BEGIN CERTIFICATE-----'.
`nowIso`	No	Override 'now' for deterministic tests.
`hostname`	No	Optional hostname to check against the certificate's SANs.
`trustAnchors`	No	Trust anchors (PEM). When present, chain cryptographic verification runs.
`intermediates`	No	Intermediate certs (PEM) between leaf and anchor.
`maxChainDepth`	No	Chain depth cap (default 8).

Schema Changelog

Changes observed during successful MCP inspections.

First observedNov 15, 2026

TDQS

B3.3/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It discloses returned fields and audit checks such as expiry, hostname/SAN mismatch, weak signature, short RSA, and serverAuth without SAN, but it does not explicitly state read-only behavior, chain-verification behavior when trust anchors are supplied, or error reporting.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded and dense with relevant field and audit details, but it ends with a dangling 'Decod' fragment, indicating truncation. It is otherwise efficient, though the long parenthetical list could be structured more clearly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a six-parameter inspection tool with no output schema, the description lists returned certificate fields and audit checks, which is helpful. It omits chain-verification behavior tied to trustAnchors/intermediates/maxChainDepth and does not describe the output shape, and the truncation leaves it incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so all six parameters are documented in the schema. The description adds context for PEM input and hostname/SAN checking but does not explain nowIso, trustAnchors, intermediates, or maxChainDepth beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: inspect an X.509 certificate from PEM, and enumerates the returned fields plus audit checks. An agent can identify this as a certificate inspection/audit tool without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use or when-not-to-use guidance is provided, and no alternatives are named. The description implies inspection/audit usage but leaves tool selection to the agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All WritersLogic verifiable AI agents tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?