API and MCP

Run certificate diagnostics and expiry monitoring from AI agents, scripts and CI. No signup, no API key.

From AI agents (MCP)

A remote MCP server over Streamable HTTP with no auth. Once connected, agents use it for questions like "when does example.com's certificate expire?".

https://certdesk.dev/mcp

claude mcp add --transport http certdesk https://certdesk.dev/mcp

// .cursor/mcp.json
{
  "mcpServers": {
    "certdesk": { "url": "https://certdesk.dev/mcp" }
  }
}

// .vscode/mcp.json
{
  "servers": {
    "certdesk": { "type": "http", "url": "https://certdesk.dev/mcp" }
  }
}

7 tools

check_certificate: Verdict for one domain from the chain the server actually serves: verification, expiry, revocation, undeployed newer certificate, CA incident history.
check_expiry: Combined certificate and domain registration verdict for up to 5 domains.
check_security: Web server security grade from TLS versions, security headers, redirect and key strength.
check_dns: Nameservers and provider, IP owner (ASN), CAA, SPF/DMARC, DNSSEC, registrar.
check_dns_propagation: Compares one record across authoritative nameservers, Korean ISPs and public resolvers. Use it for TXT/CNAME domain validation.
explain_tls_error: Causes and fixes for error messages from browsers, curl, Java, Python, Node, Go and .NET.
watch_expiry: Free daily expiry monitoring by email. Starts only after the confirmation link is clicked.

From scripts and CI (REST API v1)

Returns JSON. Full specification: /openapi.json (OpenAPI 3.1)

GET/api/v1/certificate?domain=Verdict and evidence for one domain (same result as /check)

curl "https://certdesk.dev/api/v1/certificate?domain=example.com"

GET/api/v1/expiry?domains=a,bVerdict summary for up to 5 domains, for CI gates and inventory checks

curl "https://certdesk.dev/api/v1/expiry?domains=example.com,example.org"

GET/api/v1/security?domain=Security grade and per-item results

curl "https://certdesk.dev/api/v1/security?domain=example.com"

GET/api/v1/dns-info?domain=DNS and hosting facts

curl "https://certdesk.dev/api/v1/dns-info?domain=example.com"

GET/api/v1/dns?name=&type=DNS propagation (authoritative NS, KT, SKB, LG U+, Cloudflare, Google, Quad9, OpenDNS)

curl "https://certdesk.dev/api/v1/dns?name=_acme-challenge.example.com&type=TXT"

GET/api/v1/explain?error=Error message explanation

curl "https://certdesk.dev/api/v1/explain?error=PKIX%20path%20building%20failed"

POST/api/v1/watchRequest expiry monitoring. Sends a confirmation email and returns 202

curl -X POST https://certdesk.dev/api/v1/watch \
  -H "content-type: application/json" \
  -d '{"email":"you@example.com","domains":["example.com","mail.example.com:587"],"webhook":"https://hooks.slack.com/services/…"}'

Gate a CI job

# GitHub Actions: fail the job unless the verdict is OK (WARN, CRITICAL or UNKNOWN fail)
- name: Check certificate
  run: |
    res=$(curl -sS --fail-with-body --retry 3 --retry-all-errors \
      "https://certdesk.dev/api/v1/expiry?domains=example.com&warnDays=30&critDays=15&client=gha")
    echo "$res" | jq -r '.results[0] | "\(.status): \(.headline)"'
    test "$(echo "$res" | jq -r '.results[0].status')" = "OK"

Verdict values

OKOKVerified, expiry not close
WARNWarningExpires within 30 days, measurement points disagree, etc.
CRITICALCriticalExpired, verification failed, revoked, 15 days or less
UNKNOWNUnknownThe server could not be measured. Not OK

Change the thresholds with warnDays and critDays (1-365, default 30 and 15). The applied values are in thresholds.

The defaults shrink for short-lived certificates. On UNKNOWN, daysLeft is null and CT-log data is given only as an estimate.

Limits and terms

30/min: Requests per IP. Announced in the RateLimit-Policy header
10/min: Uncached measurements per IP
10 min: Result cache per domain. Security grade: 30 min
1/min: Re-measure with ?fresh=1, per domain
5: Domains per expiry call
Free: No signup, no key. Best-effort, no warranty

Ports: Set with domain=host:port or &port=. Other ports return 400.
TLS 443, 8443, 4443, 9443, 6443, 636, 465, 993, 995, 853, 5061, 3269, 8883. STARTTLS on SMTP 25 and 587, IMAP 143, POP3 110, LDAP 389. The public measurement network is used on 443 only. Internationalized names are converted to punycode. IP addresses and private names are rejected.
Measurement: Measured from Korean point A (full chain and revocation) plus point B (KT, Seoul) and Tokyo on the Globalping public network. Per-point results are in measuredFrom.
If A is down, the verdict falls back to the public network. The public network switches to anonymous limits on quota or outage. Status: /status/.
Storage: Queried domains are kept only in result caches (up to 6 hours) and operational logs (3 days).
Usage is counted only per surface, endpoint, client name and country. Add ?client=your-app to tell us which tool is calling (optional).
Monitoring: Starts only after the recipient clicks the link in the confirmation email. Use your own address.

Badges, calendar, RSS

README badge

Shows the verdict as a color: OK green, WARN yellow with days left, CRITICAL red, UNKNOWN grey. Cached up to 6 hours. Below is the live badge for certdesk.dev.

[![SSL](https://certdesk.dev/badge/example.com.svg)](https://certdesk.dev/check/?domain=example.com)

Expiry calendar

Subscribe to it in your calendar app. Events land at WARN (30 days before), CRITICAL (15 days before), 7, 3 and 1 days before, and on the expiry day. Change with ?warnDays= and critDays=.

https://certdesk.dev/calendar/example.com.ics

RSS

/rss.xml Articles (Korean)
/en/news/rss.xml CA news
/en/cve/rss.xml CVEs