CTlogs.io MCP server

CTlogs.io MCP server

Certificate Transparency, inside the conversation you are already having.

CTlogs.io runs a hosted Model Context Protocol server. Connect it to Claude, Cursor, or any client that speaks MCP, and your assistant can query the certificate index itself: which certificates have been issued for a hostname, by which certificate authority, and when they expire; or which certificate sits behind a fingerprint. You ask; it looks it up; you work with what comes back.

https://mcp.ctlogs.io/mcp

It is the same index and the same account you use on ctlogs.io. What changes is who does the typing.

Connect

You need a CTlogs account with an active plan. Plans and allowances are on the pricing page.

Every client wants the same two things: the server address above, added as a remote or HTTP connector, and a sign-in. The client opens CTlogs in your browser, you sign in and approve the connection once. There is no key to copy and nothing to keep in a configuration file.

Claude Code

claude mcp add --transport http ctlogs https://mcp.ctlogs.io/mcp

Then run /mcp inside Claude Code to complete the sign-in.

Claude (web and desktop)

Settings, then Connectors, then Add custom connector. Name it CTlogs, paste the server address, and follow the sign-in prompt.

Cursor

Add the server to your MCP settings (.cursor/mcp.json in a project, or the global file):

{
  "mcpServers": {
    "ctlogs": {
      "url": "https://mcp.ctlogs.io/mcp"
    }
  }
}

Cursor offers the sign-in when it first connects to the server.

Other clients

Any client that supports MCP over Streamable HTTP with OAuth sign-in works the same way.

What your assistant can do

Listing the subdomains of a domain and searching hostnames for a keyword are DomainKits tools, from the same team; this server answers one question, which certificates exist for a name.

Every tool is read-only. Nothing the assistant can call changes anything.

The tools describe their own parameters to the client, so your assistant already knows how to call them. Current allowances and limits are on the pricing page and in the API documentation; they are not repeated here because they will change as the service settles in.

Things to ask

• "Which certificates have been issued for api.example.com, from which certificate authority, and when does the latest one expire?"
• "Has anyone other than our usual certificate authority issued for www.example.com?"
• "Look up the certificate with this fingerprint, and tell me which names it covers."
• "How much of my allowance is left?"

Good to know

Shortened. The full README is on GitHub.