TLS

You have a TLS MCP Server that provides a unified interface for certificate analysis. It fetches and analyzes TLS certificates locally, supports quick or detailed analysis, real-time expiration warnings, cipher suite testing, and security grading, all without manual PEM handling. This makes it easy to quickly assess certificate health and security from a single tool.

How to use

You interact with a single tool to fetch and analyze TLS certificates for any host. Start with a quick check to verify basic certificate details, or opt for a detailed analysis that includes extensions, key information, and SANs. You can enable linting to verify compliance, choose to analyze cipher suites and TLS versions, and decide whether to use OpenSSL if it is available or fall back to Python cryptography.

How to install

Prerequisites you need before installing are Python 3.13 or newer, OpenSSL, and zlint for certificate linting.

# Prerequisites
# Ensure Python 3.13+ is installed
# Install zlint (required for linting)
# OpenSSL should be installed and available in your PATH

# Optional: Create a virtual environment and install the MCP package
python3.13 -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate
pip install -e .

Install the TLS MCP server dependencies and verify the setup

Install development dependencies (optional) and run tests to verify the installation.

pip install -e ".[dev]"
pytest tests/ -v

Run a quick local test

If you want to run the server locally after setting up the virtual environment, start from the steps above and run your tests to confirm everything is wired correctly.

Configuration

The TLS MCP Server is configured to run as a local MCP process. You will start the server using a Python interpreter inside your virtual environment and point it at the main server script. The environment must include the Python path to the project so that modules load correctly.

{
  "mcpServers": {
    "tls_mcp": {
      "type": "stdio",
      "command": "/path/to/your/tls-mcp/venv/bin/python",
      "args": [
        "/path/to/your/tls-mcp/tls_mcp_server/main.py"
      ],
      "env": {
        "PYTHONPATH": "/path/to/your/tls-mcp"
      }
    }
  }
}

Security and behavior

All certificate processing runs locally. The server uses standard SSL/TLS libraries for network operations. Temporary files created during linting or analysis are cleaned up after use, and error messages avoid leaking sensitive system information.

Troubleshooting

If you encounter issues, verify your Python path, ensure the virtual environment is activated, and confirm that OpenSSL and zlint are installed and accessible in your environment.

Notes on tools and capabilities

The TLS MCP Server exposes a single, unified fetch_certificate tool that can perform quick or detailed analysis, include PEM data when needed, lint certificates with zlint, and analyze cipher suites and TLS versions. The tool also monitors certificate expiration and provides human-friendly warnings.

Examples of usage patterns

• Quick Certificate Analysis: check the certificate for a host using the default quick analysis.

• Detailed Analysis with Linting: request a detailed analysis and enable zlint checks.

• Fetch PEM Only: retrieve the raw PEM data for a certificate without analysis.

Testing

Run the comprehensive test suite to validate unit, integration, and real-world scenarios.

Available tools

fetch_certificate

Fetches and analyzes TLS certificates with flexible options, supporting quick or detailed analysis, PEM inclusion, linting, and automatic OpenSSL/cryptography usage.