Skip to main content
Glama
Sign In

CipherHUB Cryptography Toolkit

by io.github.bowenerchen
OverviewDiscussionsAdmin

cert_verify

[cert] [x509_certificate] 用 CA 证书验证终端实体证书（单级直接签发验证）。语义：颁发者 DN 与 CA 主体 DN 匹配 + 签名可由 CA 公钥验证；不做链构建、不做吊销检查。有效期不参与 verified 判定，仅以 time_status 字段（valid/expired/not_yet_valid）信息性回显。GM 证书（签名 OID 落在 1.2.156.10197 国密分支）走 GmSSL C 的 x509_cert_verify_by_ca_cert（SM2withSM3，与 gmssl certverify CLI 同一函数），sm2_id 为签名者 ID（默认 '1234567812345678'，与 GmSSL SM2_DEFAULT_ID 同源，GM/T 0009 默认值，1~64 字节）；国际证书走 cryptography 的 verify_directly_issued_by（RSA/EC/Ed25519 等）。verified=false 是成功响应（附 reason 分类：DN 不匹配 / 签名验证失败），仅输入格式非法才返回错误码 'Certificate verify failed'。

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "cert_verify"
  }
}

Input Schema

NameRequiredDescriptionDefault
sm2_idNoSM2 签名者 ID（仅 GM 证书验证使用；默认 '1234567812345678'，GM/T 0009 与 GmSSL 同源默认值，1~64 字节）1234567812345678
certificate_in_pemNo证书的 PEM 文本（含 BEGIN/END CERTIFICATE 头尾）；cert_parse 可传多张证书的整链（叶子在前，合计≤32KB），cert_verify 为单张≤10KB
ca_certificate_in_pemNoCA 证书的 PEM 文本（含 BEGIN/END CERTIFICATE 头尾，≤10KB）

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • changedInput schema / properties / certificate_in_pem / description
      Previous value: -"终端实体证书的 PEM 文本（含 BEGIN/END CERTIFICATE 头尾，≤10KB）"New value: +"证书的 PEM 文本（含 BEGIN/END CERTIFICATE 头尾）；cert_parse 可传多张证书的整链（叶子在前，合计≤32KB），cert_verify 为单张≤10KB"
  2. Added

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so well: it discloses that verified=false is a successful response with a reason category (DN mismatch vs signature failure) and that only malformed input raises the 'Certificate verify failed' error. It also reveals the dual code path (GmSSL SM2withSM3 for GM OIDs vs cryptography verify_directly_issued_by for international certs), which is behavior an agent could not infer from the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The key facts—scope, verification criteria, and the verified=false-is-success rule—are front-loaded, and nearly every clause carries information. There is mild redundancy: the sm2_id default and length constraint are repeated from the schema, and the GM/T 0009 provenance is elaborated more than needed for tool selection.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no annotations, the description must cover result semantics, and it does explain verified, reason, and time_status. It does not sketch the rest of the response payload, and it never states that both PEM inputs are effectively mandatory despite the schema declaring zero required parameters and empty-string defaults—a real risk of a mis-invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all three parameters are already documented in the schema, setting the baseline at 3. The description reinforces which parameters matter on which path (sm2_id is only meaningful for GM certificates) but largely restates what the schema already says, including the default ID and 1~64 byte range.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise verb and resource: verify an end-entity X.509 certificate against a CA certificate via single-level direct issuance. It immediately bounds scope (no chain building, no revocation) and frames the exact semantic tested (issuer DN == CA subject DN plus signature verification), which distinguishes it from siblings like cert_parse or cms_signed_verify.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear when/when-not conditions: it explicitly excludes chain construction and revocation checking, and says expiry is reported only informationally via time_status rather than affecting verified. It does not name a sibling alternative (e.g. use cert_parse to inspect an unverifiable cert), so it stops just short of full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All CipherHUB Cryptography Toolkit toolsInspect
Try in Browser
Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources