{
  "markdown": "# certindex-mcp\n\n<!-- mcp-name: io.github.certindex/certindex-mcp -->\n\n[![CI](https://github.com/certindex/certindex-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/certindex/certindex-mcp/actions/workflows/ci.yml)\n[![PyPI](https://img.shields.io/pypi/v/certindex-mcp.svg)](https://pypi.org/project/certindex-mcp/)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)\n\nAn [MCP](https://modelcontextprotocol.io) (Model Context Protocol) server\nthat exposes [CertIndex](https://ctindex.io)'s Certificate\nTransparency search tools to any MCP-compatible client (Claude\nDesktop, the MCP Inspector, Continue, etc.).\n\nCertIndex indexes the full public CT corpus (~5 M certificates, growing\n~100 k/day). This server wraps the public CertIndex REST API so an LLM\ncan ask questions like:\n\n- \"List every TLS certificate ever issued for `example.com`.\"\n- \"What subdomains has Let's Encrypt seen for `mycompany.io`?\"\n- \"Show me certs expiring in the next 30 days for `api.mycompany.io`.\"\n- \"Pull the full PEM and CT log metadata for SHA-256 `<fingerprint>`.\"\n\n## Why this repo exists\n\nThe CertIndex monorepo bundles an MCP server (mounted at\n`https://api.ctindex.io/mcp`) that talks directly to the production\nPostgres index. This standalone package is a thin **client-side**\nshim: it speaks MCP to your editor / agent and forwards every tool\ncall to the hosted CertIndex REST API over HTTPS. Two consequences:\n\n1. You don't need a copy of the index — sign up for a free API key\n   at https://ctindex.io and you're done.\n2. The package has a tiny dependency footprint (`mcp`, `httpx`,\n   `pydantic`) — easy to audit, easy to vendor, no DB drivers.\n\n## Install\n\n```bash\npip install certindex-mcp\n```\n\nOr with [`uvx`](https://docs.astral.sh/uv/) for one-shot use:\n\n```bash\nuvx certindex-mcp\n```\n\nTo install the latest development version from source instead:\n\n```bash\npip install git+https://github.com/certindex/certindex-mcp\n```\n\n## Quickstart — Claude Desktop\n\nAdd to `~/Library/Application Support/Claude/claude_desktop_config.json`\n(macOS) or `%APPDATA%\\Claude\\claude_desktop_config.json` (Windows):\n\n```json\n{\n  \"mcpServers\": {\n    \"certindex\": {\n      \"command\": \"uvx\",\n      \"args\": [\"certindex-mcp\"],\n      \"env\": {\n        \"CERTINDEX_API_KEY\": \"ctx_live_...\"\n      }\n    }\n  }\n}\n```\n\nRestart Claude Desktop. The ten CertIndex tools appear in the tool tray.\n\n## Tools\n\nTen tools, matching the hosted CertIndex MCP server 1:1:\n\n| Tool | What it does | Notable parameters |\n| --- | --- | --- |\n| `search_certificates` | Search the CT index by domain, CN, issuer, SAN, validity, or wildcard status. | `domain`, `cn`, `issuer`, `san`, `expired`, `is_wildcard`, `page`/`limit` |\n| `get_certificate` | Fetch a single cert by SHA-256 fingerprint. | `sha256`, `include_enrichment` |\n| `get_domain_certificates` | Every cert ever issued for an exact domain. | `valid_only`, `include_enrichment`, `include_signals` (paid plans), `page`/`limit` |\n| `get_subdomains` | Enumerate unique subdomains seen in CT. | Offset (`page`/`limit`) **or** keyset cursor mode — pass `cursor=\"\"` to start, then feed back each response's `next_cursor` |\n| `get_latest_cert` | Most recent currently-valid cert for a domain. | `include_enrichment`, `include_signals`, `include_precerts` (let precertificates compete for \"latest\") |\n| `get_expiring_certs` | Certs for a domain expiring within `days` days. | `days` |\n| `submit_global_sweep` | Submit an async, domain-less CN/SAN substring sweep of the entire index (`POST /v1/sweeps`). | `cn`/`san_contains` (3+ chars, at least one required), `issuer`, `is_wildcard`, `is_precert`, `expired`, `first_seen_*`/`not_after_*` date bounds, `strict_attribution`, `resume_token` (continuation past the result cap) |\n| `get_sweep_results` | Poll a sweep job and paginate its results when done (`GET /v1/sweeps/{id}`). | `sweep_id`, `page`/`limit` (up to 1,000) |\n| `get_usage` | Caller's tier, current usage, remaining quota, and entitlements. | — |\n| `get_historical_backfill_status` | Check / start the paid deep-history backfill for a domain. | `domain` |\n\n## Quickstart — MCP Inspector\n\n```bash\nexport CERTINDEX_API_KEY=ctx_live_...\nnpx @modelcontextprotocol/inspector uvx certindex-mcp\n```\n\n## Configuration\n\n| Env var | Default | Description |\n| --- | --- | --- |\n| `CERTINDEX_API_KEY` | *(required)* | Your CertIndex API key. Mint one at https://ctindex.io/app/keys |\n| `CERTINDEX_BASE_URL` | `https://api.ctindex.io` | Override for self-hosted deployments / staging |\n| `CERTINDEX_TIMEOUT` | `30` | Per-request HTTP timeout (seconds) |\n\n## Security\n\nInput validation, rate-limit handling, and our supply-chain posture are\ndocumented in [SECURITY.md](SECURITY.md). Please report vulnerabilities\nto security@ctindex.io rather than filing public issues.\n\n## Development\n\n```bash\ngit clone https://github.com/certindex/certindex-mcp\ncd certindex-mcp\npip install -e \".[dev]\"\npytest\n```\n\nCI runs on Python 3.11 / 3.12 / 3.13.\n\n## License\n\n[MIT](LICENSE) © CertIndex contributors.\n",
  "bytes": 5025,
  "sha": "8f61e6ecdfb2dd75b8759717fb675848e5f70bbfffa472f6b9ca3281ca233d0e",
  "repo_slug": "certindex/certindex-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_certindex_certindex_mcp_abf247b4/readme"
}