# ssl.sh MCP server: certificate checks in Claude and Cursor

> Connect Claude Code, Claude Desktop, Cursor or any MCP client to https://ssl.sh/mcp to check certificates, fetch chains, search CT logs and explain SSL errors.

Source: https://ssl.sh/docs/mcp/
Last updated: 2026-11-10

Point any MCP client at `https://ssl.sh/mcp` and your AI assistant can check certificates, download complete chains, search Certificate Transparency logs and look up SSL error explanations. The server is public, read-only and needs no login.

## Connect

### Claude Code

```bash
claude mcp add --transport http ssl-sh https://ssl.sh/mcp
```

Then ask, for example: "Check the certificate on example.com and tell me when it expires."

To send an API key:

```bash
claude mcp add --transport http ssl-sh https://ssl.sh/mcp --header "Authorization: Bearer YOUR_KEY"
```

### Claude Desktop and claude.ai

Open **Settings → Connectors → Add custom connector**, enter the name `ssl.sh` and the URL `https://ssl.sh/mcp`. Clients that only support local (stdio) servers can use the `mcp-remote` bridge in `claude_desktop_config.json`:

```json
{
  "mcpServers": {
    "ssl-sh": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://ssl.sh/mcp"]
    }
  }
}
```

### Cursor

Add the server to `~/.cursor/mcp.json` (all projects) or `.cursor/mcp.json` (one project):

```json
{
  "mcpServers": {
    "ssl-sh": {
      "url": "https://ssl.sh/mcp"
    }
  }
}
```

## Tools

| Tool | Arguments | Returns |
|---|---|---|
| `check_certificate` | `host`, `port` (443), `starttls`, `full` (false) | Validity, days left, issuer, names, chain trust and completeness, TLS version, findings with fix links, grade. `full=true` adds TLS 1.0–1.3 support, HSTS, CAA and revocation. |
| `get_certificate_chain` | `host`, `port` | Chain summary plus `fullchain.pem` (leaf + intermediates, missing ones fetched via AIA). |
| `days_until_expiry` | `host`, `port` | Whole days until expiry and the exact expiry time. |
| `search_ct_logs` | `domain`, `include_subdomains` (true), `include_expired` (false), `limit` (50, max 500) | Certificates from CT logs, newest first. |
| `check_caa` | `domain` | CAA records in effect and where they were found. |
| `check_hsts` | `host`, `port` | Strict-Transport-Security header and HSTS preload list status. |
| `explain_ssl_error` | `error`, `lang` (`en` or `zh`) | Best-matching ssl.sh error pages with links and key points. |

Every result contains a short text summary for the model and the same data as `structuredContent`. Tool failures (for example `blocked_address` or a DNS error) come back as results with `isError: true`, so the assistant can explain them.

## Protocol details

- **Endpoint:** `POST https://ssl.sh/mcp`, body is one JSON-RPC 2.0 message (batches are accepted for 2025-03-26 clients).
- **Responses:** `Content-Type: application/json`. Notifications such as `notifications/initialized` get `202 Accepted` with no body. `GET /mcp` returns 405.
- **Versions:** `initialize` echoes the client's `protocolVersion` if it is one of `2025-11-25`, `2025-06-18` or `2025-03-26`, otherwise answers with `2025-11-25`. Requests with an unsupported `MCP-Protocol-Version` header get 400.
- **Methods:** `initialize`, `ping`, `tools/list`, `tools/call`.
- **Sessions:** none; the server is stateless and does not issue `Mcp-Session-Id`.
- **Limits:** each `tools/call` that triggers a new check counts toward the [API rate limit](devdoc:api).

Test it with curl:

```bash
curl -s https://ssl.sh/mcp -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"curl","version":"1"}}}'

curl -s https://ssl.sh/mcp -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"days_until_expiry","arguments":{"host":"example.com"}}}'
```