certindex-mcp

An MCP (Model Context Protocol) server that exposes CertIndex's Certificate Transparency search tools to any MCP-compatible client (Claude Desktop, the MCP Inspector, Continue, etc.).

CertIndex indexes the full public CT corpus (~5 M certificates, growing ~100 k/day). This server wraps the public CertIndex REST API so an LLM can ask questions like:

"List every TLS certificate ever issued for example.com."
"What subdomains has Let's Encrypt seen for mycompany.io?"
"Show me certs expiring in the next 30 days for api.mycompany.io."
"Pull the full PEM and CT log metadata for SHA-256 <fingerprint>."

Why this repo exists

The CertIndex monorepo bundles an MCP server (mounted at https://api.ctindex.io/mcp) that talks directly to the production Postgres index. This standalone package is a thin client-side shim: it speaks MCP to your editor / agent and forwards every tool call to the hosted CertIndex REST API over HTTPS. Two consequences:

You don't need a copy of the index — sign up for a free API key at https://ctindex.io and you're done.
The package has a tiny dependency footprint (mcp, httpx, pydantic) — easy to audit, easy to vendor, no DB drivers.

Install

Terminal

pip install certindex-mcp

Or with uvx for one-shot use:

bash

uvx certindex-mcp

To install the latest development version from source instead:

Terminal

pip install git+https://github.com/certindex/certindex-mcp

Quickstart — Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

config.json

{
  "mcpServers": {
    "certindex": {
      "command": "uvx",
      "args": ["certindex-mcp"],
      "env": {
        "CERTINDEX_API_KEY": "ctx_live_..."
      }
    }
  }
}

Restart Claude Desktop. The ten CertIndex tools appear in the tool tray.

Tools

Ten tools, matching the hosted CertIndex MCP server 1:1:

Tool	What it does	Notable parameters
`search_certificates`	Search the CT index by domain, CN, issuer, SAN, validity, or wildcard status.	`domain`, `cn`, `issuer`, `san`, `expired`, `is_wildcard`, `page`/`limit`
`get_certificate`	Fetch a single cert by SHA-256 fingerprint.	`sha256`, `include_enrichment`
`get_domain_certificates`	Every cert ever issued for an exact domain.	`valid_only`, `include_enrichment`, `include_signals` (paid plans), `page`/`limit`
`get_subdomains`	Enumerate unique subdomains seen in CT.	Offset (`page`/`limit`) or keyset cursor mode — pass `cursor=""` to start, then feed back each response's `next_cursor`
`get_latest_cert`	Most recent currently-valid cert for a domain.	`include_enrichment`, `include_signals`, `include_precerts` (let precertificates compete for "latest")
`get_expiring_certs`	Certs for a domain expiring within `days` days.	`days`
`submit_global_sweep`	Submit an async, domain-less CN/SAN substring sweep of the entire index (`POST /v1/sweeps`).	`cn`/`san_contains` (3+ chars, at least one required), `issuer`, `is_wildcard`, `is_precert`, `expired`, `first_seen_`/`not_after_` date bounds, `strict_attribution`, `resume_token` (continuation past the result cap)
`get_sweep_results`	Poll a sweep job and paginate its results when done (`GET /v1/sweeps/{id}`).	`sweep_id`, `page`/`limit` (up to 1,000)
`get_usage`	Caller's tier, current usage, remaining quota, and entitlements.	—
`get_historical_backfill_status`	Check / start the paid deep-history backfill for a domain.	`domain`

Quickstart — MCP Inspector

server.ts

export CERTINDEX_API_KEY=ctx_live_...
npx @modelcontextprotocol/inspector uvx certindex-mcp

Configuration

Env var	Default	Description
`CERTINDEX_API_KEY`	(required)	Your CertIndex API key. Mint one at https://ctindex.io/app/keys
`CERTINDEX_BASE_URL`	`https://api.ctindex.io`	Override for self-hosted deployments / staging
`CERTINDEX_TIMEOUT`	`30`	Per-request HTTP timeout (seconds)

Security

Input validation, rate-limit handling, and our supply-chain posture are documented in SECURITY.md. Please report vulnerabilities to security@ctindex.io rather than filing public issues.

Development