What can you do with this server?

This server provides MCP tools to query the CertIndex Certificate Transparency (CT) log index, enabling search and retrieval of TLS/SSL certificate metadata, domain certificate history, subdomain enumeration, and expiration tracking. * search_certificates: Search the CT index by domain, Common Name (CN), SAN, issuer, validity (expired/unexpired), and wildcard status, with pagination support. * get_certificate: Fetch full details for a single certificate by its SHA-256 fingerprint, with optional enrichment data (RDAP, DNS, ASN/hosting context). * get_domain_certificates: List all certificates ever issued for an exact domain, with options to filter to valid-only certs and include enrichment data. * get_subdomains: Enumerate unique subdomains of a given domain observed in CT logs, with pagination support. * get_latest_cert: Retrieve the most recently issued certificate for a domain, with optional enrichment data. * get_expiring_certs: Find certificates for a domain expiring within a specified number of days (default: 30). These tools support use cases such as certificate issuance tracking, domain security analysis, subdomain discovery, and certificate lifecycle management.

How do I use certindex-mcp?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@certindex-mcp List all TLS certificates for example.com" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

certindex-mcp

An MCP (Model Context Protocol) server that exposes CertIndex's Certificate Transparency search tools to any MCP-compatible client (Claude Desktop, the MCP Inspector, Continue, etc.).

CertIndex ingests certificates directly from public Certificate Transparency logs and serves them from its own index. Historical backfill is still in progress, so results, especially for older certificates, may be incomplete. This server wraps the public CertIndex REST API so an LLM can ask questions like:

"List the TLS certificates CertIndex has indexed for example.com."
"What subdomains has Let's Encrypt seen for mycompany.io?"
"Show me certs expiring in the next 30 days for api.mycompany.io."
"Pull the full PEM and CT log metadata for SHA-256 <fingerprint>."

Why this repo exists

The CertIndex monorepo bundles an MCP server (mounted at https://api.ctindex.io/mcp) that talks directly to the production Postgres index. This standalone package is a thin client-side shim: it speaks MCP to your editor / agent and forwards every tool call to the hosted CertIndex REST API over HTTPS. Two consequences:

You don't need a copy of the index — sign up for a free API key at https://ctindex.io and you're done.
The package has a tiny dependency footprint (mcp, httpx, pydantic) — easy to audit, easy to vendor, no DB drivers.

Related MCP server: ctscout

Install

Version 0.3.0 uses MCP Python SDK 2.x (mcp>=2,<3) and Python 3.11+. The console command, environment variables and ten tool names are unchanged. For applications that must retain SDK 1.x, use certindex-mcp==0.2.1.

pip install certindex-mcp

Or with uvx for one-shot use:

uvx certindex-mcp

To install the latest development version from source instead:

pip install git+https://github.com/certindex/certindex-mcp

Quickstart — Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "certindex": {
      "command": "uvx",
      "args": ["certindex-mcp"],
      "env": {
        "CERTINDEX_API_KEY": "ctx_live_..."
      }
    }
  }
}

Restart Claude Desktop. The ten CertIndex tools appear in the tool tray.

Tools

Ten tools, matching the hosted CertIndex MCP server 1:1:

Tool	What it does	Notable parameters
`search_certificates`	Search the CT index by domain, CN, issuer, SAN, validity, or wildcard status.	`domain`, `cn`, `issuer`, `san`, `expired`, `is_wildcard`, `page`/`limit`
`get_certificate`	Fetch a single cert by SHA-256 fingerprint.	`sha256`, `include_enrichment`
`get_domain_certificates`	Indexed certs for an exact domain.	`valid_only`, `include_enrichment`, `include_signals` (paid plans), `page`/`limit`
`get_subdomains`	Enumerate unique subdomains seen in CT.	Offset (`page`/`limit`) or keyset cursor mode — pass `cursor=""` to start, then feed back each response's `next_cursor`
`get_latest_cert`	Most recent currently-valid cert for a domain.	`include_enrichment`, `include_signals`, `include_precerts` (let precertificates compete for "latest")
`get_expiring_certs`	Certs for a domain expiring within `days` days.	`days`
`submit_global_sweep`	Submit an async, domain-less CN/SAN substring sweep of the entire index (`POST /v1/sweeps`).	`cn`/`san_contains` (3+ chars, at least one required), `issuer`, `is_wildcard`, `is_precert`, `expired`, `first_seen_`/`not_after_` date bounds, `strict_attribution`, `resume_token` (continuation past the result cap)
`get_sweep_results`	Poll a sweep job and paginate its results when done (`GET /v1/sweeps/{id}`).	`sweep_id`, `page`/`limit` (up to 1,000)
`get_usage`	Caller's tier, current usage, remaining quota, and entitlements.	—
`get_historical_backfill_status`	Check / start the paid deep-history backfill for a domain.	`domain`

Quickstart — MCP Inspector

export CERTINDEX_API_KEY=ctx_live_...
npx @modelcontextprotocol/inspector uvx certindex-mcp

Configuration

Env var	Default	Description
`CERTINDEX_API_KEY`	(required)	Your CertIndex API key. Mint one at https://ctindex.io/app/keys
`CERTINDEX_BASE_URL`	`https://api.ctindex.io`	Override for self-hosted deployments / staging
`CERTINDEX_TIMEOUT`	`30`	Per-request HTTP timeout (seconds)

Security

Input validation, rate-limit handling, and our supply-chain posture are documented in SECURITY.md. Please report vulnerabilities to security@ctindex.io rather than filing public issues.

Development

git clone https://github.com/certindex/certindex-mcp
cd certindex-mcp
pip install -e ".[dev]"
pytest

CI runs on Python 3.11 / 3.12 / 3.13 with both SDK 2.0.0 and the latest allowed 2.x release. It also installs the built wheel into a fresh environment and exercises initialization, tool enumeration and calls over real stdio. HTTP fixtures run on loopback; tests do not require production credentials.

License

MIT © CertIndex contributors.

Available Tools

6 tools

get_certificateA

Fetch a single cert by its 64-char hex SHA-256 fingerprint.

Set include_enrichment=true to attach RDAP + DNS + ASN/hosting context for the cert's primary hostname under enrichment.

Inputs: sha256 (required), include_enrichment. Returns: object

get_domain_certificatesA

List certificates for an exact domain name. Cold domains return a backfill_status sentinel; retry per the hint.

Set include_enrichment=true to attach RDAP + DNS + ASN/hosting context for the domain under enrichment.

Inputs: domain (required), page, limit, valid_only, +1 more. Returns: object

get_expiring_certsB

Certificates for domain expiring within days days.

Inputs: domain (required), days. Returns: object

get_latest_certA

Most recently issued cert for a domain (or {cert: null} with a backfill sentinel on cold domains).

Set include_enrichment=true to attach RDAP + DNS + ASN/hosting context for the domain under cert.enrichment.

Inputs: domain (required), include_enrichment. Returns: object

get_subdomainsB

Enumerate unique subdomains seen in CT logs.

Inputs: domain (required), page, limit. Returns: object

search_certificatesA

Search the CT certificate index by domain, CN, issuer, SAN, validity, or wildcard status. Returns a has_more boolean for paging (no unbounded COUNT).

Inputs: cn, san, page, limit, +4 more. Returns: object

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A3.9/5.0

Scored 2026-07-11 12:15 across 6 tools

Disambiguation5/5

Each tool has a distinct purpose: fetching a single certificate by fingerprint, listing certificates for a domain, finding expiring certs, getting the latest cert, enumerating subdomains, and performing a general search. No ambiguity between them.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern in snake_case (e.g., get_certificate, get_domain_certificates). The naming is predictable and clear.

Tool Count5/5

With 6 tools covering the core operations of a certificate index (fetch, list, search, subdomain enumeration), the count is well-scoped and not excessive.

Completeness4/5

The set covers the main operations expected from a CT log index: retrieval by fingerprint, domain listing, expiry checks, latest cert, subdomain enumeration, and general search. Minor gaps like raw log entry access are not critical for the stated purpose.

Maintenance

ActivitySlowing

ResponsivenessLimited data

Resources

Related MCP Connectors

CTlogs.io
io.github.ABTdomain
Certificate Transparency search: subdomains, certificate history and hostname keyword search.
Penetration Testing Open Data
1
https://mcp.ctlogs.io/mcp
ctlogs.dev — Certificate Transparency searchA
dev.ctlogs
ctlogs.dev searches the public Certificate Transparency logs, where every publicly trusted TLS certificate is recorded. Connected to it, an assistant can answer questions such as "which subdomains does example.com have", "who issued the certificates for this name" or "which domains does this company hold certificates for".
Research & Data Search Security
51
https://mcp.ctlogs.dev/mcp
crt.sh SSL Certificate Transparency & Subdomain ReconC
io.ceadigital
Query crt.sh SSL/TLS Certificate Transparency logs for subdomain discovery and certificate audits.
Security Penetration Testing
281
https://ceadigital.io/mcp/crtsh
Subdomain Finder MCPA
io.github.theluckystrike
Passive subdomain enumeration from certificate transparency (certspotter, crt.sh) with DNS checks.
Penetration Testing Networking & Infrastructure
41
https://subdomain-finder-mcp.lipmichal.workers.dev/mcp

Related MCP Servers

Certificate Search MCP Server
Security Search Web Scraping
Randark-JMT
F
license
Not graded
quality
D
maintenance
Enables SSL/TLS certificate search and analysis using crt.sh data, supporting domain certificate discovery, subdomain enumeration, and security auditing through Cloudflare Workers deployment.
Updated a year ago (2025-10-23 14:55 UTC)
-
ctscout
Search Open Data
minghsuy
A
license
A
quality
B
maintenance
Enables named-entity attribution from Certificate Transparency logs (OV/EV only) for mapping legal-entity digital footprints and domain discovery via LLM-driven workflows.
Updated a month ago (2026-10-02 16:02 UTC)
7
35 npm
MIT
crtsh-mcp
Penetration Testing Security Search
Dthen
A
license
Not graded
quality
B
maintenance
Enables certificate transparency log search via crt.sh, allowing users to query SSL/TLS certificates, enumerate subdomains, and retrieve certificate details with no API key required.
Updated 2 months ago (2026-09-27 09:01 UTC)
1
BSD Zero Clause
ssl-checker
Security Networking & Infrastructure
Br0ski777
A
license
Not graded
quality
C
maintenance
Enables AI agents to check SSL/TLS certificate validity, expiry, issuer, chain details, and security grade for any domain via pay-per-call x402 micropayments.
Updated 2 months ago (2026-09-02 19:57 UTC)
MIT