MCP.so
Sign In

ctlogs.dev - Certificate Transparency Search MCP ServerVerifiedFeatured

@ctlogs.dev

Basic information

Transport

Streamable HTTP

Authentication

OAuth

Last updated

Category

Search

Author

ctlogs.dev

Submitted by

Anton

About ctlogs.dev - Certificate Transparency Search MCP Server

Search Certificate Transparency logs: find a domain's subdomains, its TLS certificates, and certificates issued to an organization.

Connection details

https://mcp.ctlogs.dev/mcp

Setup

claude mcp add ctlogs --transport http https://mcp.ctlogs.dev/mcp

ctlogs.dev - Certificate Transparency Search MCP Server tools

5

List the hostnames found under a domain in TLS certificates: one row per hostname with the number of certificates and first/last seen dates. Covers certificates valid now or expired within the last 90 days; set history to true for every hostname certified since 2013 (needs an API key on the Pro Lite or Pro plan). Use this to enumerate subdomains; use search_certificates for the certificates themselves.

Return one issuing CA certificate by its SHA-256 fingerprint (the issuer_ca field of get_certificate): subject, issuer, validity, parent and cross-signed certificates, the number of certificates it issued and a page of them.

Return the full record of one certificate: subject, issuer, serial number, validity, DNS names, key and signature details, the CT log entries that recorded it and download URLs for the certificate body. id is the id field of a search result or the certificate's SHA-256 fingerprint (64 hex characters).

List TLS certificates issued for a domain name: id, matching names, issuer, serial number and validity dates. By default matches the exact name; set include_subdomains to true to also match every name under it. Covers certificates valid now or expired within the last 90 days unless archive is set to "full" or a year from 2013 (needs an API key on the Pro plan). Pass a row's id to get_certificate for the full record. To list hostnames rather than certificates, use find_subdomains.

List TLS certificates whose subject organization matches a name, e.g. "PayPal, Inc.": id, subject common name, domains, issuer and validity dates. Covers certificates valid now or expired within the last 90 days unless archive is set to "full" or a year from 2013 (needs an API key on the Pro plan). One call counts as 10 requests against the rate limit.

Overview

What is ctlogs.dev?

ctlogs.dev searches the public Certificate Transparency logs, where every publicly trusted TLS certificate is recorded. Connected to it, an assistant can answer questions such as "which subdomains does example.com have", "who issued the certificates for this name" or "which domains does this company hold certificates for".

It is a remote server: there is nothing to install, and it works at once without a key or an account.

Tools

  • find_subdomains — the hostnames found under a domain in TLS certificates, with the number of certificates and first/last seen dates.
  • search_certificates — the certificates issued for a domain name, with issuer, serial number and validity dates.
  • search_organization — the certificates whose subject organization matches a name.
  • get_certificate — the full record of one certificate, including its DNS names and the CT log entries that recorded it.
  • get_ca — one issuing CA certificate and the certificates it issued.

All tools are read-only. Results cover certificates that are valid now or expired within the last 90 days.

Connect

Add the server by URL: https://mcp.ctlogs.dev/mcp (Streamable HTTP).

Claude Code:

claude mcp add --transport http ctlogs https://mcp.ctlogs.dev/mcp

Setup for Claude, ChatGPT, Cursor and VS Code: https://ctlogs.dev/mcp

Limits and sign-in

The server works without an account up to the anonymous limits. Past them an assistant that supports sign-in asks you to sign in with GitHub, Google or an e-mail link; a new account gets a free API key with 10,000 credits a month for testing and non-commercial use. Clients where you set request headers yourself can send a key instead.

Frequently asked questions

1

What is the ctlogs.dev - Certificate Transparency Search remote MCP server?

The ctlogs.dev - Certificate Transparency Search remote MCP server is a hosted Model Context Protocol endpoint at https://mcp.ctlogs.dev/mcp, so AI assistants can connect to it without installing or running anything locally.

2

How do I connect to the ctlogs.dev - Certificate Transparency Search MCP server?

Add the endpoint https://mcp.ctlogs.dev/mcp to any MCP-compatible client such as Claude Code, Cursor, or VS Code. The setup snippets on this page configure each client in one step.

3

Does the ctlogs.dev - Certificate Transparency Search MCP server require authentication?

Yes. ctlogs.dev - Certificate Transparency Search uses OAuth: the first time you connect, your MCP client opens a browser window to sign in and authorize access, then reuses the credentials for future sessions.

4

Which transport does the ctlogs.dev - Certificate Transparency Search MCP server use?

ctlogs.dev - Certificate Transparency Search exposes a Streamable HTTP endpoint, the transport used by remote MCP servers and supported by all major MCP clients.

Comments