Check a site's TLS certificate and its domain registration expiry. Read-only, no sign-in.
Scored across 2 tools
check_certificate targets TLS certificates on port 443 while check_domain_expiry targets RDAP registration records at the registry; these are different data sources and failure modes. The descriptions reinforce the split, so an agent can pick the right one without hesitation.
Both tools use the same check_<noun> snake_case convention, with check_domain_expiry adding a qualifier rather than changing style. Predictable and readable.
Two tools is thin, sitting right at the borderline for a server framed as a general 'utils expiry watch'. However, the scope is genuinely narrow (two expiry sources), so there is no obvious padding or bloat.
The two main expiry vectors an operator watches — TLS certificates and domain registrations — are both covered with rich detail (chain, AIA renewal windows, RDAP statuses). Gaps are minor: no batch/multi-domain checking and no way to persist or schedule watches, but agents can work around these by looping calls.
Connects to a domain on port 443 and reports its TLS certificate: whether it is trusted and matches the name, the issuer, the expiry date and days left, the lifetime, the chain and the TLS version, what each of its server addresses serves (up to 4 IPv4 and 4 IPv6), and, for certificates from Let’s Encrypt, Google Trust Services, ZeroSSL or Sectigo, the renewal window the CA suggests (ACME Renewal Information).
Inputs: domain (required).
Looks up a domain registration over RDAP at the registry for its TLD: when it expires, the registrar, the statuses (flagging a hold, redemption, pending delete or pending transfer) and the nameservers. Subdomains are looked up by their registered domain (www.example.co.uk becomes example.co.uk).
Inputs: domain (required).
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Check SSL certificate and domain expiry for any site, see plans, and get a monitoring sign-up link.
Free anonymous website, DNS, email and TLS checks, plus monitor read and opt-in write access.
Inspects live IPv4/IPv6 DNS resolution, TLS certificate issuer/expiry, and HTTP security grade.
Inspects live IPv4/IPv6 DNS resolution, TLS certificate issuer/expiry, and HTTP security grade.
Add one secure layer between your agents and this server.
