fetch_certificateLABSCO SUMMARY
One question, one answer, no PEM shuffling.
A certificate check usually means fetching a blob and feeding it through three more commands. Here you name a host and the whole analysis comes back in a single call.
What it is
A certificate analysis server with a single tool. Give it a hostname and it fetches the certificate, reads it, checks expiry, and optionally probes which cipher suites and TLS versions the host accepts — all in one call.
What you get
- fetch_certificate takes a hostname and port and returns subject, issuer, validity and SANs
- Expiry is reported in human terms: time remaining, or time elapsed since it lapsed
- Detailed analysis returns extensions and key information as well as the essentials
- analyze_ciphers, with cipher_scan_type set to quick or full, reports the cipher suites and TLS versions the host supports
- Linting runs zlint compliance checks; include_pem returns the raw certificate when you want it
- use_openssl picks OpenSSL where it is present, with a Python cryptography fallback
- A security grade from A+ to F on what came back
Requirements
Python. OpenSSL is used when available and the Python cryptography library covers it when not; zlint is only needed if you turn linting on.
Setup effort
Build from source — git clone https://github.com/malaya-zemlya/tls-mcp.git
USE CASES
01
Finding out when a certificate expires
One call gives the remaining validity in plain terms, so a renewal date is settled without opening a browser.
02
Checking what a host will actually negotiate
Turning on the cipher scan reports the suites and TLS versions the host accepts, rather than what its config was supposed to say.
03
Reading who issued a certificate and what it covers
Subject, issuer and SANs come back together, which is usually the whole question when a name mismatch is suspected.
04
Grading a host before you sign off on it
The analysis ends in a grade from A+ to F, with the certificate details behind it in the same response.
1 tool
Listed in project docs. Your client may show a different list.
BEFORE YOU INSTALL
What to know first
Tools you get
1 tool named in the project's documentation.
Requires
Python 3.13+
Where it runs
The documented client runs the server on your machine.
INSTALLATION
Connect your client
You clone this one yourself.
Server setup
TERMINAL
git clone https://github.com/malaya-zemlya/tls-mcp.git
cd tls-mcp
python3.13 -m venv venv
source venv/bin/activate # On Windows: venv\Scripts\activate
pip install -e .MCP Clients
Any MCP client
ANY MCP CLIENT · JSON
{
"mcpServers": {
"tls-mcp-server": {
"command": "<YOUR_PATH_TO_TLS_MCP>/venv/bin/python",
"args": [
"<YOUR_PATH_TO_TLS_MCP>/tls_mcp_server/main.py"
],
"env": {
"PYTHONPATH": "<YOUR_PATH_TO_TLS_MCP>"
}
}
}
}
