{"name":"io.github.Nizoka/pkinative-mcp","slug":"nizoka-pkinative-mcp","title":"pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte leaving","description":"PKI MCP server: inspect, verify, issue, sign X.509, CSR, CRL, OCSP, CMS, TSP, PKCS#12. 34 tools","url":"https://mcp.market/server/nizoka-pkinative-mcp","rating":null,"grade":"B","score":83,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":27,"stars":0,"forks":0,"downloads_week":62,"last_push_at":"2026-10-26T01:37:57.000Z","license":"MIT"},"uptime":null,"claimed":false,"transport":"npm","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/Nizoka/pkinative-mcp","website":"https://github.com/Nizoka/pkinative-mcp#readme","version":"1.0.0","remotes":[],"packages":[{"registryType":"npm","registryBaseUrl":"https://registry.npmjs.org","identifier":"pkinative-mcp","version":"1.0.0","runtimeHint":"npx","transport":{"type":"stdio"},"runtimeArguments":[{"value":"-y","type":"positional","valueHint":"skip-confirm"},{"value":"pkinative-mcp","type":"positional","valueHint":"package"}],"environmentVariables":[{"description":"Absolute path of the one sandbox directory: path inputs are read from it and outputMode='file' outputs are written under it (never overwritten; the real path of every file read and of every parent written must stay inside — a planted symlink or junction is SECURITY_VIOLATION). Key-bearing files (.key .p8 .p12 .pfx) are read by the key tools only, never written, never served as resources. Unset: every tool works on inline PEM / base64 only.","format":"filepath","name":"PKINATIVE_MCP_OUTPUT_DIR"},{"description":"Opt-in content-addressed response cache directory (SHA-256 keyed, 1h TTL, 256 MiB LRU, plaintext at rest). Never caches path inputs, file output, a call carrying a password or a signer, a clock-dependent instant, a random serial or nonce, describe_engine or draft_governance_issue.","format":"filepath","name":"PKINATIVE_MCP_CACHE_DIR"},{"description":"Serve Streamable HTTP on this loopback port (POST /mcp) instead of stdio (MCP 2026-07-28, stateless, legacy fallback). Unauthenticated unless PKINATIVE_MCP_HTTP_TOKEN is set.","format":"number","name":"PKINATIVE_MCP_PORT"},{"description":"Opt-in bearer token for the HTTP transport (>= 16 chars, no whitespace; a weaker value refuses to start). When set, /mcp requires 'Authorization: Bearer <token>' or answers 401. Compared constant-time, never logged.","isSecret":true,"name":"PKINATIVE_MCP_HTTP_TOKEN"},{"description":"Operator-side password of the encrypted PKCS#8 key or PKCS#12 file the tools open (keeps the secret out of the model transcript). Exclusive with the per-call password input (both at once is VALIDATION_ERROR). Never logged; only its presence is reported at startup.","isSecret":true,"name":"PKINATIVE_MCP_PASSWORD"},{"description":"Pinned instant (ISO 8601 or epoch milliseconds) every omitted at / notBefore / signingTime falls back to, for reproducible verdicts and artefacts. Unset: the wall clock (a clock-dependent result is never cached). An invalid value refuses to start.","name":"PKINATIVE_MCP_AT"},{"description":"Operator ceiling for limits.maxInputBytes and the decoded size of one PKI object (default 67108864 = 64 MiB, the engine default). Integer >= 1024, read once at startup; an invalid value refuses to start. A per-call value above it is refused with LIMIT_CEILING_EXCEEDED.","format":"number","name":"PKINATIVE_MCP_MAX_INPUT_BYTES"},{"description":"Operator ceiling for limits.maxKdfIterations and limits.maxPkcs12KdfIterations (default 10000000, the engine default): the CPU bound of a hostile PBES2 key or PKCS#12 file. Integer >= 1, read once at startup; an invalid value refuses to start.","format":"number","name":"PKINATIVE_MCP_MAX_KDF_ITERATIONS"},{"description":"Operator ceiling for limits.maxPathsExplored (default 1000, the engine default): the RFC 5280 section 6 path-building work bound. Integer >= 1, read once at startup; an invalid value refuses to start.","format":"number","name":"PKINATIVE_MCP_MAX_PATHS_EXPLORED"}]}],"tools":[],"scan":{"score":83,"grade":"B","scanned_at":"2026-10-28T18:35:00.076Z","report":{"scannerVersion":"0.1.10","scannedAt":"2026-10-28T18:35:00.043Z","components":{"code":{"score":25,"max":25,"notes":["161 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":6,"max":15,"notes":["static API keys via environment variables"]},"maintenance":{"score":15,"max":15,"notes":["last push 3 days ago"]},"identity":{"score":8,"max":10,"notes":["registry namespace matches repository owner","GitHub account older than a year"]}},"findings":[],"inputs":{"packages":[{"registryType":"npm","identifier":"pkinative-mcp","version":"1.0.0","found":true,"license":"MIT","hasInstallScripts":false,"dependencyCount":3,"publishedAt":"2026-10-17T11:15:37.484Z","repositoryUrl":"git+https://github.com/Nizoka/pkinative-mcp.git","weeklyDownloads":62}],"repo":{"found":true,"owner":"Nizoka","repo":"pkinative-mcp","archived":false,"pushedAt":"2026-10-26T01:37:57Z","stars":0,"forks":0,"openIssues":9,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/129803615?v=4","ownerCreatedAt":"2023-04-03T22:56:40Z","license":"MIT"},"icon":{"url":"https://avatars.githubusercontent.com/u/129803615?v=4&s=128","source":"github"},"presence":{"stars":0,"forks":0,"downloadsWeek":62,"license":"MIT","lastPushAt":"2026-10-26T01:37:57.000Z","score":27}}}},"grade_history":[],"reviews":[]}