MCP Radar
MCP Server

TLS Radar

com.tlsradar/tlsradar
Cloud & Infrastructure Security Public & reachable MCP 2026-07-28

What this MCP does

Scans SSL/TLS certificates, issues and renews free Let's Encrypt certificates, and monitors certificate expiration and scan history.

Capabilities

Tools

16 tools
add_monitor
Add a domain to ongoing certificate monitoring with expiry alerts. Requires authentication (the user runs /mcp once). If the plan's monitor limit is reached, the response's structuredContent carries a limit-reached payload - when relaying it, LEAD with `recommended_upgrade` (typically Starter, $9.99/mo), mention `also_available` tiers in a single closing line, and offer removing an existing monitor as the free alternative. Don't dump a full tier comparison; that's choice paralysis at the moment of action.
Idempotent
Input schema 
{'type': 'object', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'description': 'Hostname to monitor (e.g. example.com). No scheme, no path.'}}}
Output schema 
{'type': 'object', 'properties': {'address': {'type': 'string'}, 'host_id': {'type': 'string'}, 'team_id': {'type': 'string'}, 'scan_group_id': {'type': 'string'}}, 'additionalProperties': True}
add_monitors
Add multiple domains to monitoring in one call. Returns a per-domain status so the caller can show partial-success outcomes. Honors the same plan-limit checks as add_monitor.
Idempotent
Input schema 
{'type': 'object', 'required': ['domains'], 'properties': {'domains': {'type': 'array', 'items': {'type': 'string'}, 'maxItems': 100, 'minItems': 1, 'description': 'List of hostnames to monitor'}}}
Output schema 
{'type': 'object', 'required': ['requested', 'added', 'results'], 'properties': {'added': {'type': 'integer'}, 'results': {'type': 'array', 'items': {'type': 'object'}, 'description': 'Per-domain add status.'}, 'team_id': {'type': 'string'}, 'requested': {'type': 'integer'}, 'scan_group_id': {'type': 'string'}}}
check_certificate_propagation
Check whether the DNS TXT records for a certificate order have propagated (Cloudflare/Google/Quad9). Step 2 of issuance - poll until all_found is true, then call finalize_certificate. Returns per-record resolver results.
Read only Open world Idempotent
Input schema 
{'type': 'object', 'required': ['order_id'], 'properties': {'order_id': {'type': 'string', 'description': 'The order_id from create_certificate.'}}}
Output schema 
{'type': 'object', 'properties': {'records': {'type': 'array', 'items': {'type': 'object'}, 'description': 'Per-record propagation status.'}, 'all_found': {'type': 'boolean', 'description': 'True when every challenge record/file is in place.'}}, 'additionalProperties': True}
create_certificate
Start issuing a FREE 90-day Let's Encrypt certificate for a domain (no account required). Step 1 of 3. Pick a validation method with `challenge`: "dns-01" (default; publish a TXT record; covers apex + www) or "http-01" (serve a file over HTTP on port 80; issues the exact domain only). dns-01 with a DNS-provider API token is the most automatable; http-01 suits a server you control on port 80. Returns an order_id plus either dns_records (dns-01) or http_files (http-01) to put in place. Next: poll `check_certificate_propagation` until all_found, then call `finalize_certificate`. Strongly prefer the CSR path at finalize (the private key never leaves the user's machine). Issuing automatically offers the user ongoing monitoring by email once it completes - don't add a monitor manually afterward.
Open world
Input schema 
{'type': 'object', 'required': ['domain', 'email'], 'properties': {'email': {'type': 'string', 'description': "Contact email for Let's Encrypt expiry notices and the monitoring handoff."}, 'domain': {'type': 'string', 'description': 'Apex domain, no scheme/www (e.g. example.com).'}, 'challenge': {'enum': ['dns-01', 'http-01'], 'type': 'string', 'description': 'Validation method: dns-01 (default) or http-01.'}, 'client_id': {'type': 'string', 'description': "Optional anonymous install id from ~/.config/tlsradar/install_id (funnel attribution). If omitted, the response's install_id is a fresh one to save there."}, 'marketing_consent': {'type': 'boolean', 'description': 'Only true if the user explicitly opts in to a free account + reminder email. Default false.'}}}
Output schema 
{'type': 'object', 'required': ['order_id', 'domain', 'challenge'], 'properties': {'domain': {'type': 'string'}, 'order_id': {'type': 'string'}, 'challenge': {'type': 'string'}, 'http_files': {'type': 'array', 'items': {'type': 'object'}, 'description': 'Files to serve for http-01.'}, 'install_id': {'type': 'string'}, 'dns_records': {'type': 'array', 'items': {'type': 'object'}, 'description': 'TXT records to publish for dns-01.'}, 'next_action': {'type': 'string'}, 'resume_token': {'type': 'string', 'description': "Signed token to finalize past the backend's order TTL."}}}
export_monitors
Dump the user's monitors as a JSON structure suitable for backup, migration, or infrastructure-as-code workflows. Tokens and PII are NEVER included - only domain configuration.
Read only Idempotent
Input schema 
{'type': 'object', 'required': [], 'properties': {}}
Output schema 
{'type': 'object', 'required': ['version', 'exported_at', 'teams'], 'properties': {'teams': {'type': 'array', 'items': {'type': 'object'}}, 'version': {'type': 'string'}, 'exported_at': {'type': 'string', 'format': 'date-time'}}}
finalize_certificate
Finalize and issue a certificate order in one call: validates the DNS challenges, waits for Let's Encrypt, and returns the issued cert. Step 3 of issuance - call after check_certificate_propagation reports all_found. STRONGLY PREFER passing csr_pem (generate the key + CSR locally with openssl so the private key never leaves the machine). Returns leaf_pem/chain_pem/fullchain_pem. If you must, pass a passphrase instead to get a PKCS#12 bundle - but a CSR is safer. If it replies "still validating", DNS hasn't fully propagated: re-check check_certificate_propagation and call again. Needs a locally-generated CSR (csr_pem) - requires a local shell with openssl. On a surface without one (e.g. a Claude.ai custom connector) this can't complete; it returns guidance to finish in Claude Code/Cowork or the web form. Scanning and monitoring work everywhere. On success the structuredContent carries a `handoff` object - relay `handoff.message` to the user and do NOT separately call add_monitor; the cert→monitoring handoff is automatic and server-side.
Open world Idempotent
Input schema 
{'type': 'object', 'required': ['order_id'], 'properties': {'csr_pem': {'type': 'string', 'description': 'PEM CERTIFICATE REQUEST covering exactly {domain, www.domain}. Preferred - key stays local.'}, 'order_id': {'type': 'string', 'description': 'The order_id from create_certificate.'}, 'passphrase': {'type': 'string', 'description': 'Fallback only: ≥8 chars, protects a returned PKCS#12 bundle. Omit when using csr_pem.'}, 'resume_token': {'type': 'string', 'description': 'Optional. The resume_token from create_certificate; pass it to finalize an order whose row Beacon already purged (~24h).'}, 'max_wait_seconds': {'type': 'integer', 'description': 'How long to wait for validation server-side. Default 60, capped at 75.'}}}
Output schema 
{'type': 'object', 'properties': {'mode': {'type': 'string'}, 'state': {'type': 'string'}, 'handoff': {'type': 'object', 'description': 'Cert->monitoring handoff; relay handoff.message and do not call add_monitor.'}, 'leaf_pem': {'type': 'string'}, 'chain_pem': {'type': 'string'}, 'not_after': {'type': 'string', 'format': 'date-time'}, 'fullchain_pem': {'type': 'string', 'description': 'Full certificate chain (PEM), present on success.'}}, 'additionalProperties': True}
get_account
Return the current user's plan, limits, and usage so the client can render upgrade nudges proactively.
Read only Idempotent
Input schema 
{'type': 'object', 'required': [], 'properties': {}}
Output schema 
{'type': 'object', 'required': ['email'], 'properties': {'plan': {'type': 'object', 'description': 'Plan tier and limits.'}, 'email': {'type': 'string'}, 'usage': {'type': 'object', 'description': 'Current usage against the plan limits.'}}, 'additionalProperties': True}
get_certificate_status
Return the current state of a certificate order (dns_pending, validating, ready, completed, failed) and per-authorization Let's Encrypt statuses. Use it to resume an interrupted issuance.
Read only Open world Idempotent
Input schema 
{'type': 'object', 'required': ['order_id'], 'properties': {'order_id': {'type': 'string', 'description': 'The order_id from create_certificate.'}}}
Output schema 
{'type': 'object', 'properties': {'state': {'type': 'string'}, 'challenge': {'type': 'string'}, 'fullchain_pem': {'type': 'string', 'description': 'Present once the order is completed.'}}, 'additionalProperties': True}
get_scan_history
Return recent scan results for a domain the user monitors. Useful for spotting issuer changes, grade drops, or vulnerability appearances over time.
Read only Idempotent
Input schema 
{'type': 'object', 'required': ['domain'], 'properties': {'limit': {'type': 'integer', 'default': 10, 'maximum': 50, 'minimum': 1, 'description': 'Max results to return'}, 'domain': {'type': 'string', 'description': 'Domain name as it appears in list_monitors'}}}
Output schema 
{'type': 'object', 'required': ['domain', 'results', 'count'], 'properties': {'count': {'type': 'integer'}, 'domain': {'type': 'string'}, 'results': {'type': 'array', 'items': {'type': 'object', 'properties': {'grade': {'type': ['string', 'null']}, 'issuer': {'type': ['string', 'null']}, 'scanned_at': {'type': 'string', 'format': 'date-time'}, 'scan_status': {'type': 'string'}, 'expiration_date': {'type': ['string', 'null'], 'format': 'date-time'}}}}}}
import_monitors
Create monitors from a JSON structure (typically produced by `export`). Skips domains the user is already monitoring; honors the plan's domain limit. Returns a per-domain status.
Idempotent
Input schema 
{'type': 'object', 'required': ['payload'], 'properties': {'payload': {'type': 'object', 'description': 'Export payload, version 1.0. Use the `export` tool to generate one.'}}}
Output schema 
{'type': 'object', 'properties': {'added': {'type': 'integer'}, 'results': {'type': 'array', 'items': {'type': 'object'}, 'description': 'Per-domain import status.'}, 'requested': {'type': 'integer'}}, 'additionalProperties': True}
invite_team_member
Invite a user to a team by email. Defaults to the user's current team. Honors the plan's seat limit (returns the same upgrade payload as add_monitor when the cap is hit).
Input schema 
{'type': 'object', 'required': ['email'], 'properties': {'role': {'enum': ['guest', 'admin'], 'type': 'string', 'default': 'guest', 'description': 'Invitee role: guest or admin. Defaults to guest.'}, 'email': {'type': 'string', 'description': 'Email address of the person to invite'}, 'team_id': {'type': 'string', 'description': 'Team UUID; defaults to the current team'}}}
Output schema 
{'type': 'object', 'required': ['team_id', 'invited_email', 'role'], 'properties': {'role': {'type': 'string'}, 'team_id': {'type': 'string'}, 'team_name': {'type': 'string'}, 'invited_email': {'type': 'string'}}}
list_expiring_certificates
Return monitored certificates expiring within N days. Defaults to 30. If the response's structuredContent includes a `nudge` object, the user is watching enough soon-to-expire certs to benefit from a higher tier - mention it casually ONCE (lead with `nudge.recommended_upgrade`); skip it if it doesn't fit.
Read only Idempotent
Input schema 
{'type': 'object', 'required': [], 'properties': {'within': {'type': 'integer', 'default': 30, 'maximum': 365, 'minimum': 1, 'description': 'Days from now to look ahead'}}}
Output schema 
{'type': 'object', 'required': ['entries', 'within_days', 'count'], 'properties': {'count': {'type': 'integer'}, 'nudge': {'type': 'object', 'description': 'Present only when an upgrade nudge is warranted.'}, 'entries': {'type': 'array', 'items': {'type': 'object'}}, 'within_days': {'type': 'integer'}}}
list_monitors
List all certificates currently being monitored across the user's teams. If the response's structuredContent includes a `nudge` object, the user is at their monitor cap - surface it casually ONCE (lead with `nudge.recommended_upgrade`, mention `nudge.also_available` in one closing line); don't force it if it doesn't fit the conversation.
Read only Idempotent
Input schema 
{'type': 'object', 'required': [], 'properties': {}}
Output schema 
{'type': 'object', 'required': ['monitors', 'count'], 'properties': {'count': {'type': 'integer'}, 'nudge': {'type': 'object', 'description': 'Present only when an upgrade nudge is warranted.'}, 'monitors': {'type': 'array', 'items': {'type': 'object', 'properties': {'address': {'type': 'string'}, 'host_id': {'type': 'string'}, 'team_id': {'type': 'string'}, 'scan_group_id': {'type': 'string'}, 'expiration_date': {'type': ['string', 'null'], 'format': 'date-time'}, 'days_until_expiration': {'type': ['integer', 'null']}}}}}}
remove_monitor
Stop monitoring a domain. Accepts the domain name or the host_id returned by list_monitors.
Destructive Idempotent
Input schema 
{'type': 'object', 'properties': {'domain': {'type': 'string', 'description': 'Domain to stop monitoring'}, 'host_id': {'type': 'string', 'description': 'UUID of the host (alternative to domain)'}}}
Output schema 
{'type': 'object', 'required': ['removed_address'], 'properties': {'removed_address': {'type': 'string'}}}
renew_certificate
Renew a certificate by cloning a recent order (requires the original order_id; Beacon purges orders after ~24h). Returns a new order_id and fresh DNS TXT records - then poll check_certificate_propagation and call finalize_certificate. If you don't have an order_id (the usual case at 90-day renewal time), call create_certificate for the domain instead; that IS the renewal.
Open world
Input schema 
{'type': 'object', 'required': ['order_id'], 'properties': {'order_id': {'type': 'string', 'description': "The original order_id to clone. If you don't have one, use create_certificate instead."}}}
Output schema 
{'type': 'object', 'properties': {'state': {'type': 'string'}, 'order_id': {'type': 'string'}, 'challenge': {'type': 'string'}, 'http_files': {'type': 'array', 'items': {'type': 'object'}}, 'dns_records': {'type': 'array', 'items': {'type': 'object'}}}, 'additionalProperties': True}
scan_domain
Run a free, anonymous SSL/TLS scan against a hostname and return certificate details. No account required.
Read only Open world
Input schema 
{'type': 'object', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'description': 'Hostname to scan (e.g. example.com). No scheme, no path.'}, 'client_id': {'type': 'string', 'description': "Optional anonymous install id from ~/.config/tlsradar/install_id. Pass it for funnel attribution. If you omit it, the response's install_id is a fresh one to save there."}}}
Output schema 
{'type': 'object', 'required': ['domain', 'status', 'share_token', 'share_url'], 'properties': {'domain': {'type': 'string'}, 'status': {'enum': ['pending', 'completed'], 'type': 'string'}, 'share_url': {'type': 'string', 'format': 'uri'}, 'install_id': {'type': 'string', 'description': 'Anonymous install id to persist locally and reuse.'}, 'scanned_at': {'type': ['string', 'null'], 'format': 'date-time'}, 'share_token': {'type': 'string'}, 'expiration_date': {'type': ['string', 'null'], 'format': 'date-time'}}}
History

Recent tool changes

Added
invite_team_member
Sept. 17, 2026, 12:38 p.m.
Added
import_monitors
Sept. 17, 2026, 12:38 p.m.
Added
export_monitors
Sept. 17, 2026, 12:38 p.m.
Added
get_scan_history
Sept. 17, 2026, 12:38 p.m.
Added
list_expiring_certificates
Sept. 17, 2026, 12:38 p.m.
Added
remove_monitor
Sept. 17, 2026, 12:38 p.m.
Added
add_monitors
Sept. 17, 2026, 12:38 p.m.
Added
add_monitor
Sept. 17, 2026, 12:38 p.m.
Added
list_monitors
Sept. 17, 2026, 12:38 p.m.
Added
get_account
Sept. 17, 2026, 12:38 p.m.
Added
renew_certificate
Sept. 17, 2026, 12:38 p.m.
Added
get_certificate_status
Sept. 17, 2026, 12:38 p.m.
Added
finalize_certificate
Sept. 17, 2026, 12:38 p.m.
Added
check_certificate_propagation
Sept. 17, 2026, 12:38 p.m.
Added
create_certificate
Sept. 17, 2026, 12:38 p.m.
Added
scan_domain
Sept. 17, 2026, 12:38 p.m.
Discover

Similar MCP servers

BorealHost

ai.borealhost/mcp

Provides web hosting and infrastructure management, including site deployment, DNS, domains, containers, compute, backups, cachin…

BlackVeil DNS & Email Security Scanner

com.blackveilsecurity/dns

Audits domain, DNS, email, certificate, HTTP, brand-impersonation, and agent-discovery security controls.

Hackertarget

io.github.pipeworx-io/hackertarget

Performs passive DNS, ASN, IP geolocation, HTTP header, ping, link, and network-path reconnaissance and diagnostics.

Busymate DevTools

dev.busymate/busymate-devtools

Captures, inspects, exports, and debugs HTTPS traffic from devices and applications, with request and response inspection, proxy …

Ripe Stat

io.github.pipeworx-io/ripe-stat

Provides RIPE registry and routing data for IP addresses, prefixes, ASNs, BGP state and neighbors, network ownership, geolocation…

Cloudflare Radar

io.github.pipeworx-io/cloudflare-radar

Provides Cloudflare Radar internet observatory data on DDoS attacks, BGP leaks, domain popularity, internet quality, and traffic …

Domains

io.github.pipeworx-io/domains

Checks domain registration status and availability and searches certificate-transparency records for certificates and subdomains.

Rdap

io.github.pipeworx-io/rdap

Looks up authoritative RDAP registration records for domains, IP addresses, autonomous systems, entities, and nameservers.