proxy_get_ca_cert

Instructions

Implementation Reference

• src/tools/lifecycle.ts:95-119 (handler)

  The tool handler for 'proxy_get_ca_cert'. It receives a 'format' parameter (pem, fingerprint, or both), retrieves the CA certificate from proxyManager.getCert(), and returns the PEM, fingerprint, or both along with installation instructions.

  server.tool(
    "proxy_get_ca_cert",
    "Get the CA certificate PEM and SPKI fingerprint for installing on the target device.",
    {
      format: z.enum(["pem", "fingerprint", "both"]).optional().default("both")
        .describe("What to return: 'pem', 'fingerprint', or 'both'"),
    },
    async ({ format }) => {
      const cert = proxyManager.getCert();
      if (!cert) {
        return { content: [{ type: "text", text: JSON.stringify({ status: "error", error: "No certificate. Start the proxy first." }) }] };
      }
  
      const result: Record<string, unknown> = { status: "success" };
      if (format === "pem" || format === "both") {
        result.certPem = cert.cert;
      }
      if (format === "fingerprint" || format === "both") {
        result.fingerprint = cert.fingerprint;
      }
      result.instructions = "Save the PEM to a .crt file, transfer to device, and install as trusted CA.";
  
      return { content: [{ type: "text", text: JSON.stringify(result) }] };
    },
  );

• src/tools/lifecycle.ts:98-100 (schema)

  Input schema for proxy_get_ca_cert: accepts an optional 'format' parameter (z.enum(['pem', 'fingerprint', 'both']) with default 'both').

  {
    format: z.enum(["pem", "fingerprint", "both"]).optional().default("both")
      .describe("What to return: 'pem', 'fingerprint', or 'both'"),

• src/tools/lifecycle.ts:95-119 (registration)

  Tool registered via server.tool() call inside registerLifecycleTools(). The tool is named 'proxy_get_ca_cert' and registered as part of the lifecycle tools module.

  server.tool(
    "proxy_get_ca_cert",
    "Get the CA certificate PEM and SPKI fingerprint for installing on the target device.",
    {
      format: z.enum(["pem", "fingerprint", "both"]).optional().default("both")
        .describe("What to return: 'pem', 'fingerprint', or 'both'"),
    },
    async ({ format }) => {
      const cert = proxyManager.getCert();
      if (!cert) {
        return { content: [{ type: "text", text: JSON.stringify({ status: "error", error: "No certificate. Start the proxy first." }) }] };
      }
  
      const result: Record<string, unknown> = { status: "success" };
      if (format === "pem" || format === "both") {
        result.certPem = cert.cert;
      }
      if (format === "fingerprint" || format === "both") {
        result.fingerprint = cert.fingerprint;
      }
      result.instructions = "Save the PEM to a .crt file, transfer to device, and install as trusted CA.";
  
      return { content: [{ type: "text", text: JSON.stringify(result) }] };
    },
  );

• src/state.ts:495-497 (helper)

  Helper method proxyManager.getCert() returns the CertificateInfo (key, cert PEM, fingerprint) that the tool handler calls to retrieve the CA certificate data. The cert is generated in ProxyManager.start() using mockttp.generateCACertificate().

  getCert(): CertificateInfo | null {
    return this.cert;
  }

• src/state.ts:386-392 (helper)

  CA certificate generation and storage in ProxyManager.start(). Uses mockttp to generate a 2048-bit CA cert and SPKI fingerprint, stored in this.cert.

  // Generate CA cert (once, reused across rebuilds)
  if (!this.cert) {
    const mockttp = await getMockttp();
    const ca = await mockttp.generateCACertificate({ bits: 2048 });
    const fingerprint = mockttp.generateSPKIFingerprint(ca.cert);
    this.cert = { key: ca.key, cert: ca.cert, fingerprint };
  }