Certificate Transparency search for AI agents: certs, subdomains, issuance history, expiry.
Quick Install
Automated & IDE SetupCopy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.
Manual Client & Custom JSON ConfigExpand JSON ▾
Client Config & Setup
Choose your client or environment
Target File:
💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.
Documentation Overview
certindex-mcp
An MCP (Model Context Protocol) server that exposes CertIndex's Certificate Transparency search tools to any MCP-compatible client (Claude Desktop, the MCP Inspector, Continue, etc.).
CertIndex indexes the full public CT corpus (~5 M certificates, growing ~100 k/day). This server wraps the public CertIndex REST API so an LLM can ask questions like:
- "List every TLS certificate ever issued for
example.com." - "What subdomains has Let's Encrypt seen for
mycompany.io?" - "Show me certs expiring in the next 30 days for
api.mycompany.io." - "Pull the full PEM and CT log metadata for SHA-256
<fingerprint>."
Why this repo exists
The CertIndex monorepo bundles an MCP server (mounted at
https://api.ctindex.io/mcp) that talks directly to the production
Postgres index. This standalone package is a thin client-side
shim: it speaks MCP to your editor / agent and forwards every tool
call to the hosted CertIndex REST API over HTTPS. Two consequences:
- You don't need a copy of the index — sign up for a free API key at https://ctindex.io and you're done.
- The package has a tiny dependency footprint (
mcp,httpx,pydantic) — easy to audit, easy to vendor, no DB drivers.
Install
Or with uvx for one-shot use:
To install the latest development version from source instead:
Quickstart — Claude Desktop
Add to ~/Library/Application Support/Claude/claude_desktop_config.json
(macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
Restart Claude Desktop. The ten CertIndex tools appear in the tool tray.
Tools
Ten tools, matching the hosted CertIndex MCP server 1:1:
| Tool | What it does | Notable parameters |
|---|---|---|
search_certificates | Search the CT index by domain, CN, issuer, SAN, validity, or wildcard status. | domain, cn, issuer, san, expired, is_wildcard, page/limit |
get_certificate | Fetch a single cert by SHA-256 fingerprint. | sha256, include_enrichment |
get_domain_certificates | Every cert ever issued for an exact domain. | valid_only, include_enrichment, include_signals (paid plans), page/limit |
get_subdomains | Enumerate unique subdomains seen in CT. | Offset (page/limit) or keyset cursor mode — pass cursor="" to start, then feed back each response's next_cursor |
get_latest_cert | Most recent currently-valid cert for a domain. | include_enrichment, include_signals, include_precerts (let precertificates compete for "latest") |
get_expiring_certs | Certs for a domain expiring within days days. | days |
submit_global_sweep | Submit an async, domain-less CN/SAN substring sweep of the entire index (POST /v1/sweeps). | cn/san_contains (3+ chars, at least one required), issuer, is_wildcard, is_precert, expired, first_seen_*/not_after_* date bounds, strict_attribution, resume_token (continuation past the result cap) |
get_sweep_results | Poll a sweep job and paginate its results when done (GET /v1/sweeps/{id}). | sweep_id, page/limit (up to 1,000) |
get_usage | Caller's tier, current usage, remaining quota, and entitlements. | — |
get_historical_backfill_status | Check / start the paid deep-history backfill for a domain. | domain |
Quickstart — MCP Inspector
Configuration
| Env var | Default | Description |
|---|---|---|
CERTINDEX_API_KEY | (required) | Your CertIndex API key. Mint one at https://ctindex.io/app/keys |
CERTINDEX_BASE_URL | https://api.ctindex.io | Override for self-hosted deployments / staging |
CERTINDEX_TIMEOUT | 30 | Per-request HTTP timeout (seconds) |
Security
Input validation, rate-limit handling, and our supply-chain posture are documented in SECURITY.md. Please report vulnerabilities to security@ctindex.io rather than filing public issues.
Development
CI runs on Python 3.11 / 3.12 / 3.13.
License
MIT © CertIndex contributors.
Related MCP Servers
Reviews
No reviews yet — be the first to share how this listing worked for you.
Frequently Asked Questions about Certindex MCP
AllMCPs Directory Badge
Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.
Badge Style:
Live Dynamic SVG Preview
Markdown (GitHub README)
[](https://allmcps.com/mcp/certindex-mcp)HTML Embed
<a href="https://allmcps.com/mcp/certindex-mcp"><img src="https://allmcps.com/api/badge/certindex-mcp?style=directory" alt="Certindex MCP on AllMCPs" /></a>Technical Specs & Signals
CategoryDeveloper Tools
27Quality signal: Emerging · 27/100How this signal is calculated ▾
Server availabilityNot measured
Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.
Verified ownership8/20
Documentation & tools11/30
Adoption & activity1/15
Community engagement0/10
A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.
Own this project?
This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to unlock edit access and the Official badge — proof is checked automatically, then reviewed by our team.
Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.
Claim & get free dofollowShare & Embed
Add our SVG badge (dark/light directory styles) or embeddable widget to your site.