ctlogs.dev — Certificate Transparency search

Search certificates by organization

search_organization

Read-onlyIdempotent

List TLS certificates whose subject organization matches a name, e.g. "PayPal, Inc.": id, subject common name, domains, issuer and validity dates. Covers certificates valid now or expired within the last 90 days unless archive is set to "full" or a year from 2013 (needs an API key on the Pro plan). One call counts as 10 requests against the rate limit.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "name": "<name>"
    },
    "name": "search_organization"
  }
}

Input Schema

Name	Required	Description
`name`	Yes	Organization name as it appears in the certificate subject, e.g. "PayPal, Inc."
`limit`	No	Rows per call, 1 to 100; default 25
`cursor`	No	The next_cursor of the previous call, to get the next page; omit for the first page
`archive`	No	"full" for all certificates since 2013, or a four-digit year from 2013 for certificates valid into that year or later; needs an API key on the Pro plan. Omit for certificates valid now or expired within the last 90 days

Output Schema

Name	Required	Description	Default
`rows`	Yes
`count`	Yes
`has_more`	Yes
`next_cursor`	No
`history_truncated`	No
`history_window_days`	No

Schema Changelog

Changes observed during successful MCP inspections.

First observedNov 12, 2026

TDQS

A4/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, openWorld and non-destructive, and the description adds substantive behavior on top: the default scope of certificates valid now or expired within 90 days, the archive override with its Pro-plan API key requirement, and the fact that one call consumes 10 requests against the rate limit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two dense sentences: identity and scope first, then coverage caveat and cost, so the important constraints are front-loaded. The enumeration of return fields is slightly redundant given an output schema exists, but it remains readable and wastes little space.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a four-parameter filtered search with a rich output schema, the description covers the filter semantics, default and override scope, authentication prerequisite and rate-limit cost. An agent has everything needed to call it correctly and to anticipate the response shape.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so name, limit, cursor and archive are already documented in the input schema, and the description largely restates the archive semantics. It adds the rate-limit weight per call but nothing new about limit or cursor handling.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource ('List TLS certificates whose subject organization matches a name') plus the exact returned fields, so the operation is unambiguous. It does not explicitly contrast itself with the sibling search_certificates, so an agent must infer the difference from the organization-name filter.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the organization-name filter and the default coverage window, and the archive parameter is explained with its condition. However, there is no explicit statement of when to prefer this over search_certificates or get_certificate, and no guidance on what to do when a name matches nothing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All ctlogs.dev — Certificate Transparency search tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.