SiteCheck Web Intel

HTTPS certificate chain and cipher audit for a host

security_ssl_cert_chain

Read-only

HTTPS certificate chain and cipher audit for a host (port 443) from Qualys SSL Labs' cached report: grade, number of certificates in the chain, trust store, TLS versions, weak-cipher count, Heartbleed/POODLE/BEAST flags and HSTS. Only reads reports SSL Labs already has, so a host that was never scanned returns a retry error instead of a new scan. Related tools on this server, for a different need: security_cert_revocation_crl when you need for a domain's current certificate: reads its CRL. Price: $0.002 in USDC per successful call, paid with x402 (Base, Solana or Arc); failed calls are not charged.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "host": "<host>"
    },
    "name": "security_ssl_cert_chain"
  }
}

Input Schema

Name	Required	Description	Default
`host`	Yes	Host name such as wikipedia.org (required)

Output Schema

Name	Required	Description	Default
`ip`	No
`host`	No
`hsts`	No
`chain`	No
`grade`	No
`source`	No
`checkedAt`	No
`protocols`	No
`hasWarnings`	No
`cipherSuites`	No
`forwardSecrecy`	No
`vulnerabilities`	No
`weakCipherSuites`	No

Schema Changelog

Changes observed during successful MCP inspections.

First observedOct 23, 2026

TDQS

A4.3/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond readOnlyHint/openWorldHint it discloses the key non-obvious behaviors: results come from a pre-existing cache (not a live scan), missing data manifests as a retry error, and each successful call costs $0.002 USDC via x402 across Base/Solana/Arc with failures not charged. Cache semantics and billing are exactly the traits annotations cannot express.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The audit scope is front-loaded in the first clause and the critical caching caveat follows immediately. The sibling-tool sentence is garbled and the pricing clause is tacked on, but no sentence is truly redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter, read-only lookup with an output schema, the description covers source, cache behavior, failure mode, and cost — everything an agent needs to invoke it correctly. The only shortfall is the poorly phrased sibling routing, not missing information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With a single parameter at 100% schema coverage, the schema already documents 'host'. The description adds only the implicit port-443 scope, which is marginal. Baseline 3 is appropriate since the schema carries the load.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb and resource — 'HTTPS certificate chain and cipher audit for a host (port 443)' — and pins the data source to Qualys SSL Labs' cached report. It then enumerates the returned signals (grade, chain length, trust store, TLS versions, weak ciphers, Heartbleed/POODLE/BEAST, HSTS), which leaves no ambiguity about what the tool produces.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states the selection constraint: only cached reports are read, so an unscanned host yields a retry error rather than triggering a fresh scan — that tells an agent when this tool will fail. It also names a sibling (security_cert_revocation_crl) for the adjacent revocation need, though the sentence is grammatically mangled enough that the routing signal is weaker than it should be.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All SiteCheck Web Intel tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?