Check a site's TLS certificate and its domain registration expiry. Read-only, no sign-in.
Scored across 2 tools
The two tools target clearly different expiry domains: TLS certificate status vs. domain registration expiry. An agent can easily select the right tool based on whether it needs certificate details or registry expiry data.
Both use a consistent snake_case check_<subject> pattern: check_certificate and check_domain_expiry. The naming is predictable and readable.
Two tools is thin for a server framed as an expiry watcher, though both are relevant. It is borderline but acceptable for a narrow utility focused on certificate and domain expiry checks.
The surface covers the two main expiry checks implied by the server name, including certificate trust/expiry and domain registration expiry. Minor gaps exist around batch checks, history, or monitoring workflows, but core needs are addressed.
Connects to a domain on port 443 and reports its TLS certificate: whether it is trusted and matches the name, the issuer, the expiry date and days left, the lifetime, the chain and the TLS version.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | A public domain name, like example.com. A URL also works: only its host name is used. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover readOnly, idempotent, openWorld and non-destructive, so the description's marginal contribution is the fixed port 443 connection and the specific data it surfaces (trust result, name match, issuer, expiry, chain, TLS version). This is useful scope detail, though it omits failure modes such as unreachable hosts, timeouts, or handshake errors.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One front-loaded sentence that opens with the mechanism (connect on 443) before the payload list, with no filler. The trailing colon list is dense and slightly run-on, but every listed field earns its place by documenting a return value for a tool with no output schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the return-value burden well by enumerating issuer, expiry, days left, lifetime, chain and TLS version. It is only incomplete on behavioral edge cases (unreachable domains, invalid certs, non-standard ports) and on how it relates to its sibling tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the schema already explains that a URL is accepted and only its host name is used, so the description adds essentially nothing beyond the word 'domain.' Baseline 3 is appropriate when the single parameter is fully documented in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a concrete verb ('Connects... reports') and the exact resource (a domain's TLS certificate on port 443), then enumerates the returned facts, so the agent knows precisely what the tool does. However, it never differentiates itself from the sibling check_domain_expiry, leaving the routing decision implicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied by the subject matter: a reader infers 'use this when you want to inspect a TLS certificate.' There is no statement of when to prefer this over check_domain_expiry, no prerequisite notes, and no exclusions (e.g., non-443 ports or private/internal hosts).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Looks up when a domain registration expires, over RDAP at the registry for its TLD. Subdomains are looked up by their registered domain (www.example.co.uk becomes example.co.uk).
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | A public domain name, like example.com. A URL also works: only its host name is used. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive and openWorld, so the safety profile is covered. The description adds genuinely new behavioral context beyond them: lookups go over RDAP to the TLD's registry, and subdomains are normalized to their registered domain. It does not disclose failure modes (unregistered domain, TLD without RDAP service), which keeps it short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero filler, with the core action front-loaded and the input-normalization caveat second. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read-only lookup with no output schema, the description covers what the tool does, how the input is resolved, and where the data comes from. It stops short of describing what the result contains or how lookup failures surface, but nothing essential to invoking it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema already explains that URLs are accepted with only the host used. The description adds meaning beyond that by specifying the registered-domain normalization rule (www.example.co.uk becomes example.co.uk), which tells the agent how multi-label public suffixes are handled.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('looks up when a domain registration expires') and names the resolution mechanism (RDAP at the registry for its TLD). This clearly separates it from the sibling check_certificate, which covers certificates rather than registration expiry.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The purpose makes the use case self-evident, and the subdomain rule gives some input-preparation guidance, but there is no explicit when-to-use vs. when-not-to-use guidance and no reference to check_certificate as an alternative for a different question.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
check_certificatecheck_domain_expiryFree anonymous website, DNS, email and TLS checks, plus monitor read and opt-in write access.
Inspects live IPv4/IPv6 DNS resolution, TLS certificate issuer/expiry, and HTTP security grade.
Inspects live IPv4/IPv6 DNS resolution, TLS certificate issuer/expiry, and HTTP security grade.
Score any public site's HTTPS, TLS certificate and security headers, with plain fixes. No auth.
Add one secure layer between your agents and this server.
