Stream MCP Server

An MCP server for Evertrust Stream — a PKI platform providing certification authorities, certificate issuance and revocation, a validation authority (OCSP), timestamping (TSA), and an OpenSSH certificate authority. It lets MCP-compatible LLM clients (Claude Desktop, Claude Code, Cursor, Codex, OpenCode) stand up and operate CAs, issue/revoke X.509 and SSH certificates, run SCQL/SEQL searches, manage keystores, OCSP/TSA signers, notification triggers, RBAC and system configuration, and decode X.509/CSR/CRL/PKCS#12/OpenSSH payloads — all through natural language. It targets PKI engineers, platform teams, and security operators who want to drive Stream without leaving their IDE or chat client.

Tools

153 tools across 13 domains, each annotated with a safety tier (read-only / idempotent / additive / destructive) and "ask before you invent a name" guidance for smaller models.

Full per-tool table with safety tiers in docs/tools-reference.md.

Related MCP server: Packet Tracer MCP

Quickstart

git clone https://github.com/evertrust/stream-mcp.git
cd stream-mcp
npm install
npm run build

Run it (normally launched by an MCP client over stdio):

STREAM_URL=https://stream.example.com \
STREAM_API_ID=my-account \
STREAM_API_KEY='********' \
node dist/index.js

See docs/installation.md for prerequisites and the npx/bunx launch form, and docs/client-setup.md for Claude Desktop / Claude Code / Cursor / Codex / MCP Inspector configurations.

Configuration

The server is configured entirely through STREAM_* environment variables. A starter template lives in .env.example; copy it to .env.local and adjust. At minimum set STREAM_URL and one credential set.

Authentication is auto-detected: a client certificate selects X.509/mTLS, otherwise STREAM_API_ID/STREAM_API_KEY select local-account auth. OIDC is not supported by the server. The binary name shipped by this package is stream-mcp (declared in package.json bin). See docs/authentication.md for the full guide.

Knowledge resources

The server embeds a knowledge base exposed at stream://knowledge/* URIs and via the search_docs / get_doc tools, covering architecture, authentication, the SCQL/SEQL query languages, CA management, lifecycle, templates, revocation, keystores, triggers, RBAC, TSA, SSH, system admin, tool selection, and server rules. See docs/knowledge-resources.md.

Documentation

Development

npm run typecheck && npm run lint && npm run test && npm run build

See docs/development.md for the full guide.

License

Copyright 2026 Evertrust. Licensed under the Apache License 2.0.