certdesk

check_certificate

Read-only

Check one domain's TLS certificate and return a verdict: status OK | WARN | CRITICAL | UNKNOWN, judged from the certificate chain the server actually serves. Measured from Korean point A (full chain and CRL revocation) plus Korean point B and an overseas point on the Globalping public measurement network (per-point results in measuredFrom; disagreement between points is a WARN). Checks: verification (expired, not yet valid, hostname mismatch, self-signed, untrusted root, missing intermediate, revoked via CRL), days left, renewal point, a newer certificate issued but not deployed (CT logs), the served chain, which old platform versions trust its root or cross-signs (compat: oldest Android, iOS, macOS, Windows, Java and Firefox versions), and the issuing CA's incident history. If the server cannot be measured the status is UNKNOWN and CT logs are shown only as an estimate, never as OK. Set detail=true to include the full chain in the text output.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "domain": "<domain>"
    },
    "name": "check_certificate"
  }
}

Input Schema

Name	Required	Description
`port`	No	TLS port (default 443). Implicit TLS: 8443 4443 9443 6443 636 465 993 995 853 5061 3269 8883; STARTTLS: 25 587 (SMTP), 143 (IMAP), 110 (POP3), 389 (LDAP). Or pass domain as host:port
`detail`	No	Include the full certificate chain in the text output (default false)
`domain`	Yes	Domain name, e.g. example.com
`critDays`	No	Days before expiry that count as CRITICAL "expiring soon" (default 15; must be < warnDays)
`warnDays`	No	Days before expiry that count as WARN (default 30; the default shrinks for short-lived certificates)

Output Schema

Name	Required	Description
`domain`	Yes
`status`	Yes	UNKNOWN = could not be measured (never treat as OK)
`reasons`	Yes
`headline`	Yes	One-line verdict (Korean)

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedOct 10, 2026

addedInput schema / properties / port

Added value: +{
+  "description": "TLS port (default 443). Implicit TLS: 8443 4443 9443 6443 636 465 993 995 853 5061 3269 8883; STARTTLS: 25 587 (SMTP), 143 (IMAP), 110 (POP3), 389 (LDAP). Or pass domain as host:port",
+  "type": "integer"
+}

Changed2 schema fields changedOct 4, 2026

addedInput schema / properties / critDays

Added value: +{
+  "description": "Days before expiry that count as CRITICAL \"expiring soon\" (default 15; must be < warnDays)",
+  "maximum": 365,
+  "minimum": 1,
+  "type": "integer"
+}

addedInput schema / properties / warnDays

Added value: +{
+  "description": "Days before expiry that count as WARN (default 30; the default shrinks for short-lived certificates)",
+  "maximum": 365,
+  "minimum": 1,
+  "type": "integer"
+}

Changed2 schema fields changedOct 3, 2026

addedInput schema / properties / detail

Added value: +{
+  "description": "Include the full certificate chain in the text output (default false)",
+  "type": "boolean"
+}

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "properties": {
+    "domain": {
+      "type": "string"
+    },
+    "headline": {
+      "description": "One-line verdict (Korean)",
+      "type": "string"
+    },
+    "reasons": {
+      "items": {
+        "properties": {
+          "code": {
+            "type": "string"
+          },
+          "message": {
+            "type": "string"
+          },
+          "messageEn": {
+            "type": "string"
+          },
+          "severity": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "code",
+          "severity"
+        ],
+        "type": "object"
+      },
+      "type": "array"
+    },
+    "status": {
+      "description": "UNKNOWN = could not be measured (never treat as OK)",
+      "enum": [
+        "OK",
+        "WARN",
+        "CRITICAL",
+        "UNKNOWN"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "domain",
+    "status",
+    "headline",
+    "reasons"
+  ],
+  "type": "object"
+}

First observedSep 26, 2026

TDQS

A4.2/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnly/openWorld/non-destructive; the description goes well beyond by disclosing the multi-vantage measurement method (Korean point A full chain + CRL, Korean point B, overseas point), that cross-point disagreement becomes a WARN, and that an unmeasurable server yields UNKNOWN with CT data as an estimate only, never OK. These are exactly the behavioral traits an agent needs before trusting a verdict.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose and verdict, and every clause (checks list, measurement points, UNKNOWN rule, detail flag) carries information. It is a single dense block though; the long enumerated check list and compat list would scan faster as structured fragments rather than one paragraph.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a multi-vantage network measurement tool this is complete: the verdict vocabulary, the checks performed, the point-disagreement rule, the failure mode, and the CT caveat are all stated, and an output schema exists so return structure need not be explained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so port, critDays, warnDays and detail are already documented in the schema. The description only restates the detail=true effect ("full chain in the text output") and adds nothing about threshold interaction or port inference beyond what the schema says, making 3 the correct baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Check one domain's TLS certificate") and an explicit return contract ("verdict: status OK | WARN | CRITICAL | UNKNOWN"). It is clearly separable from siblings like check_expiry (registration expiry) or check_security (broader posture) because it names the exact scope: the chain the server actually serves.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied through a detailed enumeration of what the tool covers, which lets an agent infer fit, and the UNKNOWN path is described. However, no sibling is named and there is no explicit when-to-use-this-instead-of guidance (e.g. versus check_expiry or explain_tls_error), so selection still requires inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All certdesk tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?