nginx-certbot-mcp

Overview Schema Source Related Servers Discussions Admin

issue_wildcard_cert

Issue a wildcard SSL/TLS certificate for a domain and all subdomains via Certbot DNS-01 Route 53 validation, defaulting to staging to avoid Let's Encrypt rate limits.

Instructions

Request a wildcard certificate (domain and *.domain) via certbot --dns-route53 (DNS-01 validation, required since HTTP-01 can't prove ownership of a wildcard). Requires the certbot-dns-route53 plugin installed on the box and AWS credentials in the environment (see README) - fails fast with guidance if credentials are missing. Defaults to staging; a local guard refuses production requests that would exceed Let's Encrypt's rate limits, reporting when to retry. For a single non-wildcard domain, use issue_cert instead.

Input Schema

TableJSON Schema

Name	Required	Description
`email`	No	Contact email for the Let's Encrypt account; omitted registers unsafely-without-email
`domain`	Yes	Base domain, e.g. julcap.net - issues it plus *.julcap.net
`staging`	No	True (default) uses Let's Encrypt's staging CA: untrusted certs, but no rate-limit risk

Output Schema

TableJSON Schema

Name	Required	Description
`success`	Yes
`certbot_output`	Yes
`rate_limit_note`	No	Set when the local rate-limit guard refused a production request (with when to retry), or when a Let's Encrypt production limit is close

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedv0.1.2Sep 19, 2026

addedOutput schema / properties / rate_limit_note

Added value: +{
+  "description": "Set when the local rate-limit guard refused a production request (with when to retry), or when a Let's Encrypt production limit is close",
+  "type": "string"
+}

Addedv0.1.1Sep 15, 2026

TDQS

A4.9/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes well beyond the annotations by explaining that DNS-01 validation is required, that it fails fast with guidance if credentials are missing, that it defaults to staging, and that a local guard blocks production requests exceeding rate limits. This gives the agent a clear behavioral model without contradicting the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Every sentence earns its place: the core action, the required validation method, prerequisites, failure behavior, staging default, and the sibling alternative are all covered without redundancy. The description is front-loaded and efficiently structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists, return-value details are unnecessary. The description covers prerequisites, failure modes, default behavior, safety guards, and sibling routing, making it fully sufficient for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the schema descriptions are already informative. The description adds extra context by explaining the default staging behavior and the local guard's role in rate-limit protection, which helps an agent reason about setting `staging` to false. This is meaningful enrichment beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Request a wildcard certificate (`domain` and `*.domain`)' via certbot with DNS-01 validation. It clearly distinguishes this tool from the sibling `issue_cert` by specifying the wildcard scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool (for wildcard certificates) and when not to: 'For a single non-wildcard domain, use issue_cert instead.' It also gives required prerequisites such as the certbot-dns-route53 plugin and AWS credentials.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.