certdesk

by certdesk.dev · remote · no sign-in to list tools · v0.9.0 · published by dev.certdesk

TLS cert verdict (OK/WARN/CRITICAL/UNKNOWN) from the served chain: expiry, revocation, alerts

Changes · 5

Compare Registry entry

7 tools: 5 change things and 2 only read.

Scanned Oct 21, 2026

Deletes or cancels0Claude Code: deny
Can't be undone0Claude Code: ask
Changes things5Claude Code: ask: see these tools
Only reads2Claude Code: allow: see these tools

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http certdesk https://certdesk.dev/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

7 tools

Changes things 5Creates or changes something that can be changed back.Claude Code: ask

check_certificateCheck one domain's TLS certificate and return a verdict: status OK | WARN | CRITICAL | UNKNOWN, judged from the certificate chain the server actually serves.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Check one domain's TLS certificate and return a verdict: status OK | WARN | CRITICAL | UNKNOWN, judged from the certificate chain the server actually serves. Measured from Korean point A (full chain and CRL revocation) plus Korean point B and an overseas point on the Globalping public measurement network (per-point results in measuredFrom; disagreement between points is a WARN). Checks: verification (expired, not yet valid, hostname mismatch, self-signed, untrusted root, missing intermediate, revoked via CRL), days left, renewal point, a newer certificate issued but not deployed (CT logs), the served chain and the issuing CA's incident history. If the server cannot be measured the status is UNKNOWN and CT logs are shown only as an estimate, never as OK. Set detail=true to include the full chain in the text output.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
check_dnsDNS and hosting facts for a domain: nameservers with DNS provider, A/AAAA with IP owner (ASN), CNAME, MX, CAA (which CAs may issue), SPF/DMARC, DNSSEC, registrar and domain expiry …No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
DNS and hosting facts for a domain: nameservers with DNS provider, A/AAAA with IP owner (ASN), CNAME, MX, CAA (which CAs may issue), SPF/DMARC, DNSSEC, registrar and domain expiry (RDAP).
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
check_expiryVerdict for up to 5 domains at once: status OK | WARN | CRITICAL | UNKNOWN per domain combining the served certificate (verification, days left, null when the server cannot be meas…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Verdict for up to 5 domains at once: status OK | WARN | CRITICAL | UNKNOWN per domain combining the served certificate (verification, days left, null when the server cannot be measured) and domain registration expiry (RDAP), plus Korean alert lines. Use this for inventories, CI gates (fail unless status is OK) and periodic checks.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
check_securitySecurity posture check of a web server (no port scanning): TLS protocol support (legacy 1.0/1.1 detection via a Korean network probe), security headers (HSTS/CSP/X-Content-Type-Opt…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Security posture check of a web server (no port scanning): TLS protocol support (legacy 1.0/1.1 detection via a Korean network probe), security headers (HSTS/CSP/X-Content-Type-Options/anti-clickjacking/Referrer-Policy), HTTP→HTTPS redirect, and certificate key/signature strength. Returns per-item pass/warn/fail and an overall grade.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
watch_expirySubscribe an email address to free daily expiry monitoring of up to 5 domains (certificate, domain registration and security grade) with email alerts, plus an optional Slack/Discor…No findings
Why it is in this group
- The description's first verb is "subscribe": a word for a change.
Description, as the server wrote it
Subscribe an email address to free daily expiry monitoring of up to 5 domains (certificate, domain registration and security grade) with email alerts, plus an optional Slack/Discord/Telegram/webhook channel. Also alerts when Certificate Transparency logs show a new certificate for a domain from a CA not seen before (possible unauthorized issuance). Double opt-in: a confirmation email is sent and monitoring starts only after the recipient clicks the link; one confirmation email per address per 24 hours. Use only an address the user owns and explicitly asked to use.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true

Only reads 2Looks things up and changes nothing.Claude Code: allow

check_dns_propagationCompare answers for one DNS record across resolvers: the authoritative nameservers, Korean ISPs (KT, SK Broadband, LG U+) and public resolvers (Cloudflare, Google, Quad9, OpenDNS),…No findings
Why it is in this group
- The description's first verb is "compare": a word for reading.
Description, as the server wrote it
Compare answers for one DNS record across resolvers: the authoritative nameservers, Korean ISPs (KT, SK Broadband, LG U+) and public resolvers (Cloudflare, Google, Quad9, OpenDNS), measured from a Korean network. Use it to confirm a TXT/CNAME for certificate domain validation (e.g. _acme-challenge) has propagated.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
explain_tls_errorExplain a TLS/SSL certificate error message from a browser, curl/OpenSSL, Java, Python, Node.js, Go or .NET: likely causes, fixes, and links to step-by-step guides (Korean).No findings
Why it is in this group
- The name "explain_tls_error" says "explain": a word for reading.
Description, as the server wrote it
Explain a TLS/SSL certificate error message from a browser, curl/OpenSSL, Java, Python, Node.js, Go or .NET: likely causes, fixes, and links to step-by-step guides (Korean). Works offline from a curated knowledge base.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.9.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http certdesk https://certdesk.dev/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__certdesk__check_dns_propagation",
      "mcp__certdesk__explain_tls_error"
    ],
    "ask": [
      "mcp__certdesk__check_certificate",
      "mcp__certdesk__check_expiry",
      "mcp__certdesk__check_security",
      "mcp__certdesk__check_dns",
      "mcp__certdesk__watch_expiry"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as certdesk. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/dev.certdesk/certdesk/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

5 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry. Synced Oct 21, 2026, 18:11 UTC.

For agents: Markdown · JSON · report this listing