API · MCP — use certdesk without visiting the site

Run certificate diagnostics and expiry monitoring from AI agents, scripts and CI pipelines. No signup, no API key.

From AI agents (MCP)

A remote MCP server (Streamable HTTP, no auth). Once connected, agents use it for questions like "when does example.com's certificate expire?" or "what does PKIX path building failed mean?".

https://certdesk.dev/mcp

`check_certificate`	One domain in depth — expiry of the certificate the server actually serves, undeployed newer certificate, chain, revocation, SAN, CA incident history
`check_expiry`	Expiry summary for up to 5 domains — certificate and domain registration expiry, alerts
`check_security`	Web server security grade — TLS versions, security headers, redirect, key strength
`check_dns`	DNS and hosting facts — nameservers and provider, IP owner (ASN), CAA, SPF/DMARC, DNSSEC, registrar
`check_dns_propagation`	Compare one record across authoritative nameservers, Korean ISPs and public resolvers (for TXT/CNAME domain validation)
`explain_tls_error`	Explains error messages from browsers, curl, Java, Python, Node, Go and .NET — causes, fixes, guides
`watch_expiry`	Free daily expiry monitoring by email (starts only after the confirmation link is clicked)

Claude Code

claude mcp add --transport http certdesk https://certdesk.dev/mcp

Cursor

// .cursor/mcp.json
{
  "mcpServers": {
    "certdesk": { "url": "https://certdesk.dev/mcp" }
  }
}

VS Code

// .vscode/mcp.json
{
  "servers": {
    "certdesk": { "type": "http", "url": "https://certdesk.dev/mcp" }
  }
}

Apps that support remote connectors (e.g. Claude, ChatGPT) take the same URL as a custom connector.

From scripts and CI (REST API v1)

Returns JSON. Full specification: /openapi.json (OpenAPI 3.1)

`GET /api/v1/certificate?domain=`	One domain in depth (same result as /check)
`GET /api/v1/expiry?domains=a,b`	Expiry summary for up to 5 domains — for CI and inventory checks
`GET /api/v1/security?domain=`	Security grade and per-item results
`GET /api/v1/dns-info?domain=`	DNS and hosting facts (nameservers, IP owner, CAA, SPF/DMARC, DNSSEC, registrar)
`GET /api/v1/dns?name=&type=`	DNS propagation (authoritative NS, KT, SKB, LG U+, Cloudflare, Google, Quad9, OpenDNS)
`GET /api/v1/explain?error=`	Error message explanation
`POST /api/v1/watch`	Request expiry monitoring — sends a confirmation email (202)

curl "https://certdesk.dev/api/v1/certificate?domain=example.com"

curl "https://certdesk.dev/api/v1/expiry?domains=example.com,example.org"

curl "https://certdesk.dev/api/v1/security?domain=example.com"

curl "https://certdesk.dev/api/v1/explain?error=PKIX%20path%20building%20failed"

curl "https://certdesk.dev/api/v1/dns-info?domain=example.com"

curl "https://certdesk.dev/api/v1/dns?name=_acme-challenge.example.com&type=TXT"

curl -X POST https://certdesk.dev/api/v1/watch \
  -H "content-type: application/json" \
  -d '{"email":"you@example.com","domains":["example.com"]}'

CI example

# GitHub Actions — fail the job 14 days before expiry
- name: Check certificate expiry
  run: |
    days=$(curl -fsS "https://certdesk.dev/api/v1/expiry?domains=example.com&client=gha" \
      | jq '.results[0].certificate.daysLeft')
    echo "days left: $days"
    test "$days" -ge 14

Limits and terms

30 requests per minute per IP. Results per domain are cached for 10 minutes (security grade: 30 minutes).
Add ?client=your-app to tell us which tool is calling (optional).
Free and best-effort with no warranty. Results are informational; verify on your server before acting.
Queried domains are not stored beyond the cache. Usage is counted only per surface, endpoint, client name and country.
Monitoring (watch) starts only after the recipient clicks the link in the confirmation email. Use your own address.

Badges · calendar · RSS

[![SSL](https://certdesk.dev/badge/example.com.svg)](https://certdesk.dev/check/?domain=example.com)

README badge — Shows days until expiry (cached 6 hours)
Expiry calendar — https://certdesk.dev/calendar/example.com.ics — events 30/14/7 days before and on the day
RSS — /rss.xml (articles, Korean) · /en/news/rss.xml (CA news) · /en/cve/rss.xml (CVEs)