SSL/TLS Certificate Checker MCP

x402 Payment-Protected SSL Certificate Validation & Security Analysis API

Check SSL/TLS certificates, monitor expiration, verify certificate chains, and analyze security for AI agents doing website monitoring and security audits.

🚀 Features

• ✅ Certificate Validation - Check if SSL certificate is valid and trusted

• ⏰ Expiration Monitoring - Get expiration date and days remaining

• 🔗 Chain Verification - Verify certificate chain and CA issuers

• 🔐 Security Analysis - Check protocol versions, cipher suites, security grade

• 📊 Security Grading - A-F rating based on security posture

• ⚠️ Alert Warnings - Identify expired or expiring soon certificates

• 💳 x402 Micropayments - Pay $0.002 USDC per check on Base Mainnet

• 🤖 MCP Compatible - Works with Claude and other AI agents

Related MCP server: attest-mcp

📡 Live Endpoint

Base URL: https://ssl-checker-mcp.vercel.app

Check SSL Certificate

POST /api/check
Content-Type: application/json

Body:

{
  "domain": "example.com"
}

Example:

curl -X POST https://ssl-checker-mcp.vercel.app/api/check \
  -H "Content-Type: application/json" \
  -d '{"domain": "example.com"}'

Get Detailed SSL Info

POST /api/detailed
Content-Type: application/json

Body:

{
  "domain": "example.com"
}

Example:

curl -X POST https://ssl-checker-mcp.vercel.app/api/detailed \
  -H "Content-Type: application/json" \
  -d '{"domain": "github.com"}'

Response (402 Payment Required):

{
  "error": "Payment Required",
  "message": "This endpoint requires x402 payment",
  "payment": {
    "scheme": "exact",
    "network": "eip155:8453",
    "price": "$0.002",
    "currency": "USDC",
    "payTo": "0xf081ee84c0d85278a6242bc265f0b312021ebeb1"
  },
  "instructions": "Include payment proof in X-Payment-Proof header"
}

🔍 Discovery Endpoints

• Bazaar Discovery: /.well-known/x402

• MCP Metadata: /mcp/tools

• Health Check: /health

💰 Payment Details

• Network: Base Mainnet (Chain ID: eip155:8453)

• Currency: USDC

• Price: $0.002 per check

• Protocol: x402 "exact" scheme

• Payment Address: 0xf081ee84c0d85278a6242bc265f0b312021ebeb1

🤖 Use with AI Agents

This MCP server is designed to work with Claude Code and other AI agents that support the Model Context Protocol (MCP) and x402 payments.

AI agents can:

1. Discover the service on x402 Bazaar

2. Pay via CDP Facilitator

3. Check SSL certificate validity

4. Monitor certificate expiration

5. Verify certificate chains

6. Audit website security

7. Alert on security issues

📦 Response Format

Basic Check Response

{
  "success": true,
  "domain": "example.com",
  "valid": true,
  "certificate": {
    "subject": "example.com",
    "issuer": "DigiCert Inc",
    "validFrom": "2025-01-13T00:00:00.000Z",
    "validTo": "2026-02-13T23:59:59.000Z",
    "daysRemaining": 162,
    "expired": false
  },
  "security": {
    "protocol": "TLSv1.3",
    "grade": "A",
    "authorized": true,
    "error": null
  },
  "checkedAt": "2026-09-04T20:30:00.000Z",
  "payment": {
    "verified": true,
    "amount": "0.002",
    "currency": "USDC"
  }
}

Detailed Response

{
  "success": true,
  "domain": "example.com",
  "valid": true,
  "certificate": {
    "subject": {
      "commonName": "example.com",
      "organization": "Example Organization",
      "organizationalUnit": null,
      "locality": "Los Angeles",
      "state": "California",
      "country": "US"
    },
    "issuer": {
      "commonName": "DigiCert TLS RSA SHA256 2020 CA1",
      "organization": "DigiCert Inc",
      "country": "US"
    },
    "validity": {
      "validFrom": "2025-01-13T00:00:00.000Z",
      "validTo": "2026-02-13T23:59:59.000Z",
      "daysRemaining": 162,
      "expired": false,
      "expiringSoon": false
    },
    "serialNumber": "0F8B4F6F32D02F5A8F82C9E0F6A3B2D1",
    "fingerprint": "A1:B2:C3:D4:E5:F6...",
    "fingerprint256": "SHA256:A1B2C3D4E5F6...",
    "subjectAltNames": [
      "DNS:example.com",
      "DNS:www.example.com"
    ]
  },
  "security": {
    "protocol": "TLSv1.3",
    "cipher": {
      "name": "TLS_AES_128_GCM_SHA256",
      "version": "TLSv1.3"
    },
    "grade": "A",
    "authorized": true,
    "authorizationError": null
  },
  "analysis": {
    "protocolSecure": true,
    "certificateValid": true,
    "notExpired": true,
    "expirationWarning": false,
    "recommendations": []
  },
  "checkedAt": "2026-09-04T20:30:00.000Z"
}

🛠️ Local Development

# Install dependencies
npm install

# Copy environment file
cp .env.example .env

# Run locally
npm start

# Development mode with auto-reload
npm run dev

Server will start on http://localhost:3000

🚀 Deployment

Deploy to Vercel

# Install Vercel CLI
npm i -g vercel

# Deploy
vercel

# Deploy to production
vercel --prod

The vercel.json configuration is already set up for Express.

📊 Use Cases

Security Monitoring

• Certificate Expiry Alerts - Monitor when certificates will expire

• Security Audits - Check SSL configuration across multiple domains

• Compliance Checking - Ensure all domains have valid SSL

• Uptime Monitoring - Verify SSL as part of health checks

DevOps & SRE

• CI/CD Integration - Validate SSL in deployment pipelines

• Infrastructure Audits - Check all company domains

• Incident Response - Quick SSL validation during outages

• Migration Validation - Verify SSL after migrations

Business Applications

• Vendor Validation - Check partner/vendor SSL security

• Customer Support - Diagnose customer SSL issues

• Security Reports - Generate SSL security reports

• Automated Alerts - Alert teams before certificates expire

Research & Analysis

• Security Research - Analyze SSL adoption trends

• Competitor Analysis - Check competitor SSL configurations

• Vulnerability Assessment - Identify weak SSL configurations

• Trend Analysis - Track SSL protocol adoption

🔐 Security Grading

Grades are calculated based on:

Grade A (90-100 points)

• ✅ TLS 1.3 protocol

• ✅ Strong cipher suites

• ✅ Valid certificate (30+ days remaining)

• ✅ Properly authorized

Grade B (80-89 points)

• TLS 1.2 protocol

• Good cipher suites

• Valid certificate

Grade C (70-79 points)

• TLS 1.2 protocol

• Acceptable ciphers

• Certificate expiring soon (< 30 days)

Grade D (60-69 points)

• Old protocols (TLS 1.1)

• Weak ciphers

• Authorization issues

Grade F (< 60 points)

• Expired certificate

• Very old protocols (TLS 1.0)

• Insecure ciphers (RC4, DES)

• Invalid certificate chain

⚠️ What Gets Checked

Certificate Information

• Subject - Domain name and organization

• Issuer - Certificate Authority information

• Validity Period - Start and expiration dates

• Days Remaining - Time until expiration

• Serial Number - Certificate serial number

• Fingerprints - SHA-1 and SHA-256 fingerprints

• Subject Alt Names - Additional covered domains

Security Analysis

• Protocol Version - TLS 1.0, 1.1, 1.2, 1.3

• Cipher Suite - Encryption algorithm used

• Certificate Chain - Verification of trust chain

• Authorization - Whether cert is trusted

• Security Grade - Overall security rating (A-F)

Warnings & Alerts

• ⚠️ Expired certificates

• ⚠️ Expiring soon (< 30 days)

• ⚠️ Old protocols (TLS 1.0/1.1)

• ⚠️ Weak ciphers

• ⚠️ Invalid certificate chains

• ⚠️ Self-signed certificates

🔗 Integration Example

With Claude Code

// AI agent automatically handles x402 payment
const response = await fetch('https://ssl-checker-mcp.vercel.app/api/check', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-Payment-Proof': '<payment_proof>'
  },
  body: JSON.stringify({
    domain: 'example.com'
  })
});

const data = await response.json();
if (data.certificate.daysRemaining < 30) {
  console.log(`⚠️ Certificate expiring in ${data.certificate.daysRemaining} days!`);
}

MCP Tool Schema

{
  "name": "check_ssl_certificate",
  "description": "Check SSL/TLS certificate validity, expiration, and basic security",
  "inputSchema": {
    "type": "object",
    "properties": {
      "domain": {
        "type": "string",
        "description": "Domain name to check (without https://, e.g., example.com)"
      }
    },
    "required": ["domain"]
  }
}

📝 Important Notes

Supported Domains

• ✅ Any publicly accessible HTTPS website

• ✅ Standard ports (443)

• ✅ Valid and invalid certificates (for checking)

• ❌ Localhost or private IPs

• ❌ Non-standard ports (requires custom implementation)

Limitations

• Checks certificates even if invalid (for diagnostic purposes)

• Timeout after 10 seconds

• Port 443 only (standard HTTPS)

• No support for client certificates

Best Practices

• Check certificates regularly (weekly recommended)

• Alert when < 30 days remaining

• Monitor grade changes (downgrade = potential issue)

• Keep records of certificate changes

• Verify after certificate renewals

🔐 Security & Privacy

• No certificate data is stored

• Connections are made directly to target servers

• No logging of domains checked

• All payments via x402 protocol on Base Mainnet

• Payment verification on every request

• Rate limiting and validation built-in

📝 License

MIT

🔗 Links

• Live API: https://ssl-checker-mcp.vercel.app

• x402 Bazaar: https://x402bazaar.app

• MCP Protocol: https://modelcontextprotocol.io

• Base Network: https://base.org

• GitHub: https://github.com/acceptancestronk01-sudo/ssl-checker-mcp

Built with ❤️ for the AI agent ecosystem