Does the MCP server need an account or OAuth?

No. It is public and read-only. To get a higher rate limit, configure your client to send Authorization: Bearer with an API key from the monitoring dashboard.

Why does GET /mcp return 405?

The server is stateless and answers every POST with a single JSON response. It does not open a server-to-client SSE stream, which the MCP specification allows servers to decline with 405 Method Not Allowed.

ssl.sh MCP server: certificate checks in Claude and Cursor

Point any MCP client at https://ssl.sh/mcp and your AI assistant can check certificates, download complete chains, search Certificate Transparency logs and look up SSL error explanations. The server is public, read-only and needs no login.

Connect

Claude Code

claude mcp add --transport http ssl-sh https://ssl.sh/mcp

Then ask, for example: "Check the certificate on example.com and tell me when it expires."

To send an API key:

claude mcp add --transport http ssl-sh https://ssl.sh/mcp --header "Authorization: Bearer YOUR_KEY"

Claude Desktop and claude.ai

Open Settings → Connectors → Add custom connector, enter the name ssl.sh and the URL https://ssl.sh/mcp. Clients that only support local (stdio) servers can use the mcp-remote bridge in claude_desktop_config.json:

{
  "mcpServers": {
    "ssl-sh": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://ssl.sh/mcp"]
    }
  }
}

Cursor

Add the server to ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (one project):

{
  "mcpServers": {
    "ssl-sh": {
      "url": "https://ssl.sh/mcp"
    }
  }
}

Tools

Tool	Arguments	Returns
`check_certificate`	`host`, `port` (443), `starttls`, `full` (false)	Validity, days left, issuer, names, chain trust and completeness, TLS version, findings with fix links, grade. `full=true` adds TLS 1.0–1.3 support, HSTS, CAA and revocation.
`get_certificate_chain`	`host`, `port`	Chain summary plus `fullchain.pem` (leaf + intermediates, missing ones fetched via AIA).
`days_until_expiry`	`host`, `port`	Whole days until expiry and the exact expiry time.
`search_ct_logs`	`domain`, `include_subdomains` (true), `include_expired` (false), `limit` (50, max 500)	Certificates from CT logs, newest first.
`check_caa`	`domain`	CAA records in effect and where they were found.
`check_hsts`	`host`, `port`	Strict-Transport-Security header and HSTS preload list status.
`explain_ssl_error`	`error`, `lang` (`en` or `zh`)	Best-matching ssl.sh error pages with links and key points.

Every result contains a short text summary for the model and the same data as structuredContent. Tool failures (for example blocked_address or a DNS error) come back as results with isError: true, so the assistant can explain them.

Protocol details

Endpoint: POST https://ssl.sh/mcp, body is one JSON-RPC 2.0 message (batches are accepted for 2025-03-26 clients).
Responses: Content-Type: application/json. Notifications such as notifications/initialized get 202 Accepted with no body. GET /mcp returns 405.
Versions: initialize echoes the client's protocolVersion if it is one of 2025-11-25, 2025-06-18 or 2025-03-26, otherwise answers with 2025-11-25. Requests with an unsupported MCP-Protocol-Version header get 400.
Methods: initialize, ping, tools/list, tools/call.
Sessions: none; the server is stateless and does not issue Mcp-Session-Id.
Limits: each tools/call that triggers a new check counts toward the API rate limit.

Test it with curl:

curl -s https://ssl.sh/mcp -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"curl","version":"1"}}}'

curl -s https://ssl.sh/mcp -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"days_until_expiry","arguments":{"host":"example.com"}}}'