ctlogs.dev searches the public Certificate Transparency logs, where every publicly trusted TLS certificate is recorded. Connected to it, an assistant can answer questions such as "which subdomains does example.com have", "who issued the certificates for this name" or "which domains does this company hold certificates for".
Scored across 5 tools
The five tools mostly target distinct actions and resources, and descriptions explicitly cross-reference alternatives. The only potential overlap is between get_ca and get_certificate, since both retrieve a certificate by SHA-256 fingerprint, but get_ca is clearly specialized for issuing CA details.
All tools follow a consistent snake_case verb_noun pattern: find_subdomains, get_ca, get_certificate, search_certificates, search_organization. The verbs are semantically appropriate and predictable.
Five tools is well-scoped for a certificate transparency search service, covering discovery, search by domain or organization, and detail retrieval without redundant tools.
The read-only surface covers the core workflows: enumerate subdomains, search certificates by domain or organization, fetch full certificate records, and inspect issuing CAs. Minor gaps like direct search by serial number are workable via get_certificate fingerprints or IDs.
List the hostnames found under a domain in TLS certificates: one row per hostname with the number of certificates and first/last seen dates. Covers certificates valid now or expired within the last 90 days; set history to true for every hostname certified since 2013 (needs an API key on the Pro Lite or Pro plan). Use this to enumerate subdomains; use search_certificates for the certificates themselves.
Inputs: domain (required), cursor, history. Returns: count, hosts, scope, domain, +2 more
Return one issuing CA certificate by its SHA-256 fingerprint (the issuer_ca field of get_certificate): subject, issuer, validity, parent and cross-signed certificates, the number of certificates it issued and a page of them.
Inputs: sha256 (required), limit, cursor. Returns: issued, sha256, parents, related, +11 more
Return the full record of one certificate: subject, issuer, serial number, validity, DNS names, key and signature details, the CT log entries that recorded it and download URLs for the certificate body. id is the id field of a search result or the certificate's SHA-256 fingerprint (64 hex characters).
Inputs: id (required). Returns: id, is_ca, san_dns, san_more, +17 more
List TLS certificates issued for a domain name: id, matching names, issuer, serial number and validity dates. By default matches the exact name; set include_subdomains to true to also match every name under it. Covers certificates valid now or expired within the last 90 days unless archive is set to "full" or a year from 2013 (needs an API key on the Pro plan). Pass a row's id to get_certificate for the full record. To list hostnames rather than certificates, use find_subdomains.
Inputs: domain (required), limit, cursor, archive, +1 more. Returns: rows, count, has_more, next_cursor, +2 more
List TLS certificates whose subject organization matches a name, e.g. "PayPal, Inc.": id, subject common name, domains, issuer and validity dates. Covers certificates valid now or expired within the last 90 days unless archive is set to "full" or a year from 2013 (needs an API key on the Pro plan). One call counts as 10 requests against the rate limit.
Inputs: name (required), limit, cursor, archive. Returns: rows, count, has_more, next_cursor, +2 more
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Certificate Transparency search: subdomains, certificate history and hostname keyword search.
Query crt.sh SSL/TLS Certificate Transparency logs for subdomain discovery and certificate audits.
Passive OSINT and security recon: DNS, TLS, email posture, IP reputation, CVE/KEV, CT logs.
Free, no-API-key network lookups for AI agents — IP geolocation, DNS, WHOIS, HTTP and SSL/TLS certificate checks, and full domain health reports.
Add one secure layer between your agents and this server.
