Certificate Transparency search for AI agents: certs, subdomains, issuance history, expiry.
Certificate Transparency search for AI agents: certs, subdomains, issuance history, expiry. That is what the certindex mcp server brings to an AI assistant: the same capability, reachable through the Model Context Protocol rather than a separate app or dashboard.
CertIndex indexes the full public CT corpus (~5 M certificates, growing ~100 k/day). This server wraps the public CertIndex REST API so an LLM can ask questions like:
Because this one is hosted, setup is mostly authentication — you point your client at the endpoint and approve access. Nothing runs on your machine, so there is no runtime to keep patched.
The server publishes 10 tools. What each one is for:
search_certificates — Search the CT index by domain, CN, issuer, SAN, validity, or wildcard statusget_certificate — Fetch a single cert by SHA-256 fingerprintget_domain_certificates — Every cert ever issued for an exact domainget_subdomains — Enumerate unique subdomains seen in CTget_latest_cert — Most recent currently-valid cert for a domainget_expiring_certs — Certs for a domain expiring within days dayssubmit_global_sweep — Submit an async, domain-less CN/SAN substring sweep of the entire index (POST /v1/sweeps)get_sweep_results — Poll a sweep job and paginate its results when done (GET /v1/sweeps/{id})get_usage — Caller's tier, current usage, remaining quota, and entitlementsget_historical_backfill_status — Check / start the paid deep-history backfill for a domainConfiguration is passed through the environment: CERTINDEX_API_KEY, CERTINDEX_BASE_URL. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.
Plenty of developer tooling servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. Certindex's toolset — search_certificates, get_certificate, get_domain_certificates and 7 more — is a fair guide to whether it matches your workflow. It is maintained by certindex; worth a glance at recent repository activity before you build anything load-bearing on it.
SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.
| Tool | What it does |
|---|---|
| search_certificates | Search the CT index by domain, CN, issuer, SAN, validity, or wildcard status. |
| get_certificate | Fetch a single cert by SHA-256 fingerprint. |
| get_domain_certificates | Every cert ever issued for an exact domain. |
| get_subdomains | Enumerate unique subdomains seen in CT. |
| get_latest_cert | Most recent currently-valid cert for a domain. |
| get_expiring_certs | Certs for a domain expiring within days days. |
| submit_global_sweep | Submit an async, domain-less CN/SAN substring sweep of the entire index (POST /v1/sweeps). |
| get_sweep_results | Poll a sweep job and paginate its results when done (GET /v1/sweeps/{id}). |
| get_usage | Caller's tier, current usage, remaining quota, and entitlements. |
| get_historical_backfill_status | Check / start the paid deep-history backfill for a domain. |
{
"mcpServers": {
"certindex": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/inspector"],
"env": {
"CERTINDEX_API_KEY": "your-value",
"CERTINDEX_BASE_URL": "your-value"
}
}
}
}Add to claude_desktop_config.json, then restart Claude Desktop.
| Variable | Description | Required |
|---|---|---|
| CERTINDEX_API_KEY | Credential the server authenticates with. | Yes |
| CERTINDEX_BASE_URL | Endpoint or connection string the server talks to. | Yes |
Kill hallucinated APIs — version-accurate, up-to-date library documentation injected straight into context.
Microsoft's official browser automation server — drive a real browser through the accessibility tree, no screenshots needed.
GitHub's official server — repos, issues, pull requests, Actions and code security, straight from your assistant.
Issue tracking at the speed of conversation — Linear's official hosted server with OAuth and zero install.
Local repository surgery — status, diffs, commits, branches and history for any repo on disk.
Timezone sanity for AI — current time anywhere and correct conversions, without the model doing date math.