certdesk

dev.certdesk/certdeskVersion 0.9.0

TLS cert verdict (OK/WARN/CRITICAL/UNKNOWN) from the served chain: expiry, revocation, alerts

Status

Responds179 msNov 14, 2026, 14:25 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 14:25 UTC
Latency: 179 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 21:12 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://certdesk.dev/mcpResponds179 msNov 14, 2026, 14:25 UTC

No sign-in

Claude Code

claude mcp add --transport http certdesk https://certdesk.dev/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: certdesk
Remote MCP server URL: https://certdesk.dev/mcp

Cursor

{
  "mcpServers": {
    "certdesk": {
      "url": "https://certdesk.dev/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"certdesk","type":"http","url":"https://certdesk.dev/mcp"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

7 tools

Tools of certdesk
	Description		Read-only	Idempotent	Open world
`check_certificate`Check one domain's TLS certificate and return a verdict: status OK \| WARN \| CRITICAL \| UNKNOWN, judged from the certificate chain the server actually serves. Measured from Korean point A (full chain and CRL revocation) plus Korean point B and an overseas point on the Globalping public measurement network (per-point results in measuredFrom; disagreement between points is a WARN). Checks: verification (expired, not yet valid, hostname mismatch, self-signed, untrusted root, missing intermediate, revoked via CRL), days left, renewal point, a newer certificate issued but not deployed (CT logs), the served chain, which old platform versions trust its root or cross-signs (compat: oldest Android, iOS, macOS, Windows, Java and Firefox versions), and the issuing CA's incident history. If the server cannot be measured the status is UNKNOWN and CT logs are shown only as an estimate, never as OK. Set detail=true to include the full chain in the text output.	Check one domain's TLS certificate and return a verdict: status OK \| WARN \| CRITICAL \| UNKNOWN, judged from the certificate chain the server actually serves. Measured from Korean point A (full chain and CRL revocation) plus Korean point B and an overseas point on the Globalping public measurement network (per-point results in measuredFrom; disagreement between points is a WARN). Checks: verification (expired, not yet valid, hostname mismatch, self-signed, untrusted root, missing intermediate, revoked via CRL), days left, renewal point, a newer certificate issued but not deployed (CT logs), the served chain, which old platform versions trust its root or cross-signs (compat: oldest Android, iOS, macOS, Windows, Java and Firefox versions), and the issuing CA's incident history. If the server cannot be measured the status is UNKNOWN and CT logs are shown only as an estimate, never as OK. Set detail=true to include the full chain in the text output.	No	Yes	Not declared	Yes
`check_dns`DNS and hosting facts for a domain: nameservers with DNS provider, A/AAAA with IP owner (ASN), CNAME, MX, CAA (which CAs may issue), SPF/DMARC, DNSSEC, registrar and domain expiry (RDAP).	DNS and hosting facts for a domain: nameservers with DNS provider, A/AAAA with IP owner (ASN), CNAME, MX, CAA (which CAs may issue), SPF/DMARC, DNSSEC, registrar and domain expiry (RDAP).	No	Yes	Not declared	Yes
`check_dns_propagation`Compare answers for one DNS record across resolvers: the authoritative nameservers, Korean ISPs (KT, SK Broadband, LG U+) and public resolvers (Cloudflare, Google, Quad9, OpenDNS), measured from a Korean network. Use it to confirm a TXT/CNAME for certificate domain validation (e.g. _acme-challenge) has propagated.	Compare answers for one DNS record across resolvers: the authoritative nameservers, Korean ISPs (KT, SK Broadband, LG U+) and public resolvers (Cloudflare, Google, Quad9, OpenDNS), measured from a Korean network. Use it to confirm a TXT/CNAME for certificate domain validation (e.g. _acme-challenge) has propagated.	No	Yes	Not declared	Yes
`check_expiry`Verdict for up to 5 domains at once: status OK \| WARN \| CRITICAL \| UNKNOWN per domain combining the served certificate (verification, days left, null when the server cannot be measured) and domain registration expiry (RDAP), plus Korean alert lines. Use this for inventories, CI gates (fail unless status is OK) and periodic checks.	Verdict for up to 5 domains at once: status OK \| WARN \| CRITICAL \| UNKNOWN per domain combining the served certificate (verification, days left, null when the server cannot be measured) and domain registration expiry (RDAP), plus Korean alert lines. Use this for inventories, CI gates (fail unless status is OK) and periodic checks.	No	Yes	Not declared	Yes
`check_security`Security posture check of a web server (no port scanning): TLS protocol support (legacy 1.0/1.1 detection via a Korean network probe), security headers (HSTS/CSP/X-Content-Type-Options/anti-clickjacking/Referrer-Policy), HTTP→HTTPS redirect, and certificate key/signature strength. Returns per-item pass/warn/fail and an overall grade.	Security posture check of a web server (no port scanning): TLS protocol support (legacy 1.0/1.1 detection via a Korean network probe), security headers (HSTS/CSP/X-Content-Type-Options/anti-clickjacking/Referrer-Policy), HTTP→HTTPS redirect, and certificate key/signature strength. Returns per-item pass/warn/fail and an overall grade.	No	Yes	Not declared	Yes
`explain_tls_error`Explain a TLS/SSL certificate error message from a browser, curl/OpenSSL, Java, Python, Node.js, Go or .NET: likely causes, fixes, and links to step-by-step guides (Korean). Works offline from a curated knowledge base.	Explain a TLS/SSL certificate error message from a browser, curl/OpenSSL, Java, Python, Node.js, Go or .NET: likely causes, fixes, and links to step-by-step guides (Korean). Works offline from a curated knowledge base.	No	Yes	Not declared	No
`watch_expiry`Subscribe an email address to free daily expiry monitoring of up to 5 domains (certificate, domain registration and security grade) with email alerts, plus an optional Slack/Discord/Telegram/webhook channel. Also alerts when Certificate Transparency logs show a new certificate for a domain from a CA not seen before (possible unauthorized issuance). Double opt-in: a confirmation email is sent and monitoring starts only after the recipient clicks the link; one confirmation email per address per 24 hours. Use only an address the user owns and explicitly asked to use.	Subscribe an email address to free daily expiry monitoring of up to 5 domains (certificate, domain registration and security grade) with email alerts, plus an optional Slack/Discord/Telegram/webhook channel. Also alerts when Certificate Transparency logs show a new certificate for a domain from a CA not seen before (possible unauthorized issuance). Double opt-in: a confirmation email is sent and monitoring starts only after the recipient clicks the link; one confirmation email per address per 24 hours. Use only an address the user owns and explicitly asked to use.	No	No	No	Yes

Details

Registry status: Active
Published: Oct 12, 2026
Updated: Oct 12, 2026
Website: https://certdesk.dev/en/api/⁠ (opens in a new tab)
Repository: Not given
Categories (suggested): SecuritySuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing