MCP Radar
MCP Server

certdesk

dev.certdesk/certdesk
Cloud & Infrastructure Security Public & reachable MCP 2026-07-28

What this MCP does

Diagnoses TLS certificates, DNS, certificate expiry, propagation, security headers, and related web-server security issues, with optional expiry monitoring.

Capabilities

Tools

7 tools
check_certificate
Check one domain's TLS certificate in depth: expiry and days left for the certificate the server actually serves (measured from a Korean network, CT logs as fallback), whether a newer certificate exists in CT logs but is not deployed, live TLS verification from a global PoP and from Korea, certificate chain (leaf → intermediates → root), revocation, SAN list, and recent incident history of the issuing CA.
Read only Open world
Input schema 
{'type': 'object', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'description': 'Domain name, e.g. example.com'}}}
check_dns
DNS and hosting facts for a domain: nameservers with DNS provider, A/AAAA with IP owner (ASN), CNAME, MX, CAA (which CAs may issue), SPF/DMARC, DNSSEC, registrar and domain expiry (RDAP).
Read only Open world
Input schema 
{'type': 'object', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'description': 'Domain name, e.g. example.com'}}}
check_dns_propagation
Compare answers for one DNS record across resolvers — the authoritative nameservers, Korean ISPs (KT, SK Broadband, LG U+) and public resolvers (Cloudflare, Google, Quad9, OpenDNS) — measured from a Korean network. Use it to confirm a TXT/CNAME for certificate domain validation (e.g. _acme-challenge) has propagated.
Read only Open world
Input schema 
{'type': 'object', 'required': ['name', 'type'], 'properties': {'name': {'type': 'string', 'description': 'Record name, e.g. _acme-challenge.example.com'}, 'type': {'enum': ['A', 'AAAA', 'CNAME', 'TXT', 'MX', 'NS', 'CAA', 'SOA'], 'type': 'string'}}}
check_expiry
Expiry summary for up to 5 domains at once: served certificate expiry and issuer, undeployed newer certificate in CT logs, domain registration expiry (RDAP), and alert lines (Korean). Use this for inventories and periodic checks.
Read only Open world
Input schema 
{'type': 'object', 'required': ['domains'], 'properties': {'domains': {'type': 'array', 'items': {'type': 'string'}, 'maxItems': 5, 'minItems': 1, 'description': 'Domain names'}}}
check_security
Security posture check of a web server (no port scanning): TLS protocol support (legacy 1.0/1.1 detection via a Korean network probe), security headers (HSTS/CSP/X-Content-Type-Options/anti-clickjacking/Referrer-Policy), HTTP→HTTPS redirect, and certificate key/signature strength. Returns per-item pass/warn/fail and an overall grade.
Read only Open world
Input schema 
{'type': 'object', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'description': 'Domain name, e.g. example.com'}}}
explain_tls_error
Explain a TLS/SSL certificate error message from a browser, curl/OpenSSL, Java, Python, Node.js, Go or .NET: likely causes, fixes, and links to step-by-step guides (Korean). Works offline from a curated knowledge base.
Read only
Input schema 
{'type': 'object', 'required': ['error'], 'properties': {'error': {'type': 'string', 'description': 'Full error text, e.g. "PKIX path building failed" or "NET::ERR_CERT_DATE_INVALID"'}}}
watch_expiry
Subscribe an email address to free daily expiry monitoring of up to 5 domains (certificate, domain registration and security grade) with email alerts. Double opt-in: a confirmation email is sent and monitoring starts only after the recipient clicks the link. Use only an address the user owns and explicitly asked to use.
Open world
Input schema 
{'type': 'object', 'required': ['email', 'domains'], 'properties': {'email': {'type': 'string', 'description': 'Email address that will receive the alerts'}, 'domains': {'type': 'array', 'items': {'type': 'string'}, 'maxItems': 5, 'minItems': 1, 'description': 'Domain names to monitor'}}}
History

Recent tool changes

Added
watch_expiry
Sept. 27, 2026, 2:40 a.m.
Added
explain_tls_error
Sept. 27, 2026, 2:40 a.m.
Added
check_dns_propagation
Sept. 27, 2026, 2:40 a.m.
Added
check_dns
Sept. 27, 2026, 2:40 a.m.
Added
check_security
Sept. 27, 2026, 2:40 a.m.
Added
check_expiry
Sept. 27, 2026, 2:40 a.m.
Added
check_certificate
Sept. 27, 2026, 2:40 a.m.
Discover

Similar MCP servers

BorealHost

ai.borealhost/mcp

Provides web hosting and infrastructure management, including site deployment, DNS, domains, containers, compute, backups, cachin…

BlackVeil DNS & Email Security Scanner

com.blackveilsecurity/dns

Audits domain, DNS, email, certificate, HTTP, brand-impersonation, and agent-discovery security controls.

Hackertarget

io.github.pipeworx-io/hackertarget

Performs passive DNS, ASN, IP geolocation, HTTP header, ping, link, and network-path reconnaissance and diagnostics.

Busymate DevTools

dev.busymate/busymate-devtools

Captures, inspects, exports, and debugs HTTPS traffic from devices and applications, with request and response inspection, proxy …

Ripe Stat

io.github.pipeworx-io/ripe-stat

Provides RIPE registry and routing data for IP addresses, prefixes, ASNs, BGP state and neighbors, network ownership, geolocation…

Cloudflare Radar

io.github.pipeworx-io/cloudflare-radar

Provides Cloudflare Radar internet observatory data on DDoS attacks, BGP leaks, domain popularity, internet quality, and traffic …

Domains

io.github.pipeworx-io/domains

Checks domain registration status and availability and searches certificate-transparency records for certificates and subdomains.

Rdap

io.github.pipeworx-io/rdap

Looks up authoritative RDAP registration records for domains, IP addresses, autonomous systems, entities, and nameservers.