Do I need an account to use TLS Radar?
No. Public tools like scan and certificate issuance work without any account. For monitoring, connect once via `/mcp` using built-in OAuth.
T
Tls Radar MCP Server
@TLS-Radar
Basic information
About Tls Radar MCP Server
Run SSL/TLS scans, issue free Let's Encrypt certificates (private key stays local), and monitor certificate expiry from inside Claude Code or Cowork - through a single MCP server, no account needed for scans and issuance.
Tls Radar MCP Server config
Add this server to your MCP-compatible client using the configuration below.
{
"mcpServers": {
"tls-radar": {
"type": "http",
"url": "https://tlsradar.com/api/v1/mcp"
}
}
}Tls Radar MCP Server tools
17Run a free, anonymous SSL/TLS scan against a hostname and return certificate details. No account required.
Start issuing a FREE 90-day Let's Encrypt certificate for a domain (no account required). Step 1 of 3. Pick a validation method with `challenge`: "dns-01" (default; publish a TXT record; covers apex + www) or "http-01" (serve a file over HTTP on port 80; issues the exact domain only). dns-01 with a DNS-provider API token is the most automatable; http-01 suits a server you control on port 80. Returns an order_id plus either dns_records (dns-01) or http_files (http-01) to put in place. Next: poll `check_certificate_propagation` until all_found, then call `finalize_certificate`. Strongly prefer the CSR path at finalize (the private key never leaves the user's machine). Issuing automatically offers the user ongoing monitoring by email once it completes - don't add a monitor manually afterward.
Check whether the DNS TXT records for a certificate order have propagated (Cloudflare/Google/Quad9). Step 2 of issuance - poll until all_found is true, then call finalize_certificate. Returns per-record resolver results.
Finalize and issue a certificate order in one call: validates the DNS challenges, waits for Let's Encrypt, and returns the issued cert. Step 3 of issuance - call after check_certificate_propagation reports all_found. STRONGLY PREFER passing csr_pem (generate the key + CSR locally with openssl so the private key never leaves the machine). Returns leaf_pem/chain_pem/fullchain_pem. If you must, pass a passphrase instead to get a PKCS#12 bundle - but a CSR is safer. If it replies "still validating", DNS hasn't fully propagated: re-check check_certificate_propagation and call again. Needs a locally-generated CSR (csr_pem) - requires a local shell with openssl. On a surface without one (e.g. a Claude.ai custom connector) this can't complete; it returns guidance to finish in Claude Code/Cowork or the web form. Scanning and monitoring work everywhere. On success the structuredContent carries a `handoff` object - relay `handoff.message` to the user and do NOT separately call add_monitor; the cert→monitoring handoff is automatic and server-side.
Return the current state of a certificate order (dns_pending, validating, ready, completed, failed) and per-authorization Let's Encrypt statuses. Use it to resume an interrupted issuance.
Renew a certificate by cloning a recent order (requires the original order_id; Beacon purges orders after ~24h). Returns a new order_id and fresh DNS TXT records - then poll check_certificate_propagation and call finalize_certificate. If you don't have an order_id (the usual case at 90-day renewal time), call create_certificate for the domain instead; that IS the renewal.
OBSOLETE - do not call. The cert→monitoring handoff is server-side now (issue via create_certificate, which records the order itself). This tool is kept only so old plugin versions that still call it don't error; it remains idempotent and harmless.
Return the current user's plan, limits, and usage so the client can render upgrade nudges proactively.
List all certificates currently being monitored across the user's teams. If the response's structuredContent includes a `nudge` object, the user is at their monitor cap - surface it casually ONCE (lead with `nudge.recommended_upgrade`, mention `nudge.also_available` in one closing line); don't force it if it doesn't fit the conversation.
Add a domain to ongoing certificate monitoring with expiry alerts. Requires authentication (the user runs /mcp once). If the plan's monitor limit is reached, the response's structuredContent carries a limit-reached payload - when relaying it, LEAD with `recommended_upgrade` (typically Starter, $9.99/mo), mention `also_available` tiers in a single closing line, and offer removing an existing monitor as the free alternative. Don't dump a full tier comparison; that's choice paralysis at the moment of action.
Add multiple domains to monitoring in one call. Returns a per-domain status so the caller can show partial-success outcomes. Honors the same plan-limit checks as add_monitor.
Stop monitoring a domain. Accepts the domain name or the host_id returned by list_monitors.
Return monitored certificates expiring within N days. Defaults to 30. If the response's structuredContent includes a `nudge` object, the user is watching enough soon-to-expire certs to benefit from a higher tier - mention it casually ONCE (lead with `nudge.recommended_upgrade`); skip it if it doesn't fit.
Return recent scan results for a domain the user monitors. Useful for spotting issuer changes, grade drops, or vulnerability appearances over time.
Dump the user's monitors as a JSON structure suitable for backup, migration, or infrastructure-as-code workflows. Tokens and PII are NEVER included - only domain configuration.
Create monitors from a JSON structure (typically produced by `export`). Skips domains the user is already monitoring; honors the plan's domain limit. Returns a per-domain status.
Invite a user to a team by email. Defaults to the user's current team. Honors the plan's seat limit (returns the same upgrade payload as add_monitor when the cap is hit).
Overview
What is TLS Radar?
TLS Radar is an MCP server that lets you run SSL/TLS scans, issue free Let's Encrypt certificates, and manage certificate monitoring directly from Claude Code or Claude Cowork, with no configuration required.
How to use TLS Radar?
Install via the Claude Code marketplace by running /plugin marketplace add TLS-Radar/tlsradar-claude-plugin then /plugin install tlsradar@tlsradar. Use slash commands such as /tls-scan example.com for a free scan or /tls-cert mydomain.dev to issue a certificate. Run /mcp once to connect for monitoring via OAuth.
Key features of TLS Radar
- Run free SSL/TLS scans with no account
- Issue free 90-day Let's Encrypt certificates
- Private keys generated locally, never sent
- Monitor certificate expiration with alerts
- Works in both Claude Code and Cowork
- OAuth 2.0 + PKCE for authenticated tools
Use cases of TLS Radar
- Scan any domain's TLS configuration instantly from chat
- Issue and renew a free Let's Encrypt certificate for a domain
- Add automated monitoring for one or more domains
- View expiration status and upcoming renewals in plain language
- Export/import monitor lists or invite teammates
Frequently asked questions
How are private keys handled during certificate issuance?
The plugin generates the private key and CSR locally using `openssl`. Only the CSR is sent to the server; the private key never leaves your computer.
What are the free plan limits?
The free plan includes 1 monitor, 1 alert per month (7 days before expiry), unlimited scans (rate-limited), and free Let's Encrypt issuance.
How do I connect for monitoring?
Run `/mcp` in Claude Code. This triggers an OAuth 2.0 + PKCE flow: your client fetches the authorization server metadata, registers as a public client, and opens the browser for consent. The token is managed by Claude Code automatically.
What about privacy and security?
The plugin sends no tracking headers and stores an anonymous install ID in `~/.config/tlsradar/install_id` (opt out by deleting that file). OAuth tokens expire in 2 hours; refresh tokens rotate and are capped at 90 days. Access can be revoked at `tlsradar.com/oauth/authorized_applications`.
More AI & Agents MCP servers
BlazingCDN MCP - Content Delivery for Video, Software & Static Files
BlazingCDNOfficial MCP server for BlazingCDN - AI agents (Claude, Cursor, Windsurf) manage CDN resources, purge cache, query metrics, domains, Anycast CDN, Video CDN and Media CDN
1
Gemina
Gemina Tech Ltd.Extract, search and tag any document — invoices, receipts, contracts, forms, or your own templates. 13 tools, one sign-in (OAuth 2.1) or API key, free FileTag tier, data residency in the EU, US, Israel or Asia.
Hostinger
hostingerModel Context Protocol (MCP) server for Hostinger API. If you don't want to install or run anything locally, connect directly to Hostinger's hosted MCP server: This opens a browser window to authorize via OAuth. Once app
148
Hypnothera
La-SalidaAgent skill: turn what your AI assistant knows about you into a personalized hypnosis session on hypnothera.ai
InsumerAPI
InsumerAPIWallet auth for AI agents: send a blockchain wallet and conditions, get a signed yes or no across 37 chains, never the balance. Hosted at https://api.insumermodel.com/mcp with no key (10 tools), or run locally with npx -
Comments