ctlogs.dev — Certificate Transparency search

Search certificates by domain

search_certificates

Read-onlyIdempotent

List TLS certificates issued for a domain name: id, matching names, issuer, serial number and validity dates. By default matches the exact name; set include_subdomains to true to also match every name under it. Covers certificates valid now or expired within the last 90 days unless archive is set to "full" or a year from 2013 (needs an API key on the Pro plan). Pass a row's id to get_certificate for the full record. To list hostnames rather than certificates, use find_subdomains.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "domain": "<domain>"
    },
    "name": "search_certificates"
  }
}

Input Schema

Name	Required	Description
`limit`	No	Rows per call, 1 to 100; default 25
`cursor`	No	The next_cursor of the previous call, to get the next page; omit for the first page
`domain`	Yes	A bare DNS name such as example.com, without a scheme, path or port
`archive`	No	"full" for all certificates since 2013, or a four-digit year from 2013 for certificates valid into that year or later; needs an API key on the Pro plan. Omit for certificates valid now or expired within the last 90 days
`include_subdomains`	No	true also matches every name under the domain

Output Schema

Name	Required	Description	Default
`rows`	Yes
`count`	Yes
`has_more`	Yes
`next_cursor`	No
`history_truncated`	No
`history_window_days`	No

Schema Changelog

Changes observed during successful MCP inspections.

First observedNov 12, 2026

TDQS

A4.6/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent and non-destructive, yet the description still adds substantive context: the default result scope is certificates valid now or expired within 90 days, and archive requires an API key on the Pro plan. That auth prerequisite and implicit time filter are behavior an agent cannot derive from the annotations. It stops short of mentioning pagination limits or result ordering, but the essentials are covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the resource and return shape, then behavior, then routing to siblings — a sensible order with no filler sentences. It is dense with parentheticals and clauses, which slightly taxes scanning, but every sentence carries information an agent needs.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Five parameters with one required, an output schema present, and annotations covering the safety profile — the description fills exactly the remaining gaps: default scope, auth requirement, subdomain behavior, and where to go next. Return values are already specified by the output schema, so no explanation is owed there.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3; the description earns a bump by explaining how parameters interact rather than restating them — the default window is overridden 'unless archive is set to full or a year from 2013', and the Pro-plan caveat adds actionable context for archive. Domain format and limit/cursor semantics are left to the schema, which already handles them well.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb and resource ('List TLS certificates issued for a domain name') and enumerates the returned fields (id, matching names, issuer, serial number, validity dates). It also distinguishes itself from two siblings by naming get_certificate for the full record and find_subdomains for hostnames, so an agent can pick correctly without opening another schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states the default matching behavior (exact name), the toggle that broadens it (include_subdomains), the default validity window, and the escalation path to archive. It names alternatives with their selection conditions: 'Pass a row's id to get_certificate for the full record' and 'To list hostnames rather than certificates, use find_subdomains.' Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All ctlogs.dev — Certificate Transparency search tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.