pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte leaving MCP server

by Nizoka·io.github.Nizoka/pkinative-mcp·v1.0.0

No reviews yet

PKI MCP server: inspect, verify, issue, sign X.509, CSR, CRL, OCSP, CMS, TSP, PKCS#12. 34 tools

B83/100grade B

Write a review Install

What users say

No reviews yet

Be the first

Safety scan

B83/100

full report

Adoption

Growing

0 stars62 downloads/wk

Reviews

Write one

Nobody has reviewed pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte leaving yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte leaving tools

No tool declarations could be read from the package source. They show once the server is installed.

Public scan report

scanner v0.1.10 · 2026-10-28 · same rubric, same numbers if you re-run it

no findings

Code scan161 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitystatic API keys via environment variables6/15
Maintenancelast push 3 days ago15/15
Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Overall 83/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

How pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte leaving compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 83/100; higher than 65% of 48,255 servers
Downloads a week: 62; more than 50% of 12,191 servers with a package

Install pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte leaving in Claude Code, Cursor or VS Code

Runs npx -y pkinative-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add pkinative-mcp -- npx -y pkinative-mcp

Add to Cursor

What the publisher says

From the pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte leaving repository's README, as published. We do not edit it. Read it on GitHub

pkinative-mcp

MCP server for PKI — inspect and verify X.509 certificates, CSRs, CRLs, OCSP responses, CMS SignedData and RFC 3161 time-stamps; build and validate certificate chains (RFC 5280 path validation, name and purpose checks, offline CRL and OCSP revocation); create certificates, CSRs, CMS signatures, OCSP and time-stamp requests; open PKCS#8 and PKCS#12 without ever returning a key byte; decode ASN.1, PEM and OIDs — 34 tools and 7 prompts on the pkinative engine (zero-dependency, pure TypeScript, Web Crypto for every signature; OpenSSL 3 interoperability validated in CI), for Claude Desktop, Cursor, ChatGPT and any Model Context Protocol client. No network, ever.

✨ Features

pkinative-mcp exposes 34 tools to any MCP host, in six groups. The kind says how the result is shaped: a read tool returns facts (structuredContent, projectable with verbosity / fields); a verdict tool returns valid + reasons[] and is never isError for a negative verdict; an artefact tool delivers DER or PEM once, inline or into the sandbox. The last column names the refusal codes an agent branches on (the full table is in docs/AGENT_CONTRACT.md).

Encodings

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte leaving: common questions

Is pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte leaving MCP server safe?: Mostly: it is graded B (83/100). Read the pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte leaving safety report
How do I install pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte leaving?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte leaving need an API key?: Yes. The registry entry asks for PKINATIVE_MCP_HTTP_TOKEN, PKINATIVE_MCP_PASSWORD.
Is pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte leaving maintained?: The last commit was 9 days ago (2026-10-26). The latest release is v1.0.0.
How does pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte leaving compare with other MCP servers?: safety score 83/100 (higher than 65% of 48,255 servers); downloads a week 62 (more than 50% of 12,191 servers with a package). Full comparison.

Run it through the gateway

Local package. It runs on your machine, not through the gateway.

Rating: —
Safety grade: B · 83/100
Stars: 0
Downloads/wk: 62
Price: Free
Licence: MIT
Transport: Local · npm
Version: 1.0.0
Category: Everything else
Last release: 2026-10-26

Credentials it needs

PKINATIVE_MCP_OUTPUT_DIRAbsolute path of the one sandbox directory: path inputs are read from it and outputMode='file' outputs are written under it (never overwritten; the real path of every file read and of every parent written must stay inside — a planted symlink or junction is SECURITY_VIOLATION). Key-bearing files (.key .p8 .p12 .pfx) are read by the key tools only, never written, never served as resources. Unset: every tool works on inline PEM / base64 only.
PKINATIVE_MCP_CACHE_DIROpt-in content-addressed response cache directory (SHA-256 keyed, 1h TTL, 256 MiB LRU, plaintext at rest). Never caches path inputs, file output, a call carrying a password or a signer, a clock-dependent instant, a random serial or nonce, describe_engine or draft_governance_issue.
PKINATIVE_MCP_PORTServe Streamable HTTP on this loopback port (POST /mcp) instead of stdio (MCP 2026-07-28, stateless, legacy fallback). Unauthenticated unless PKINATIVE_MCP_HTTP_TOKEN is set.
PKINATIVE_MCP_HTTP_TOKENsecretOpt-in bearer token for the HTTP transport (>= 16 chars, no whitespace; a weaker value refuses to start). When set, /mcp requires 'Authorization: Bearer <token>' or answers 401. Compared constant-time, never logged.
PKINATIVE_MCP_PASSWORDsecretOperator-side password of the encrypted PKCS#8 key or PKCS#12 file the tools open (keeps the secret out of the model transcript). Exclusive with the per-call password input (both at once is VALIDATION_ERROR). Never logged; only its presence is reported at startup.
PKINATIVE_MCP_ATPinned instant (ISO 8601 or epoch milliseconds) every omitted at / notBefore / signingTime falls back to, for reproducible verdicts and artefacts. Unset: the wall clock (a clock-dependent result is never cached). An invalid value refuses to start.
PKINATIVE_MCP_MAX_INPUT_BYTESOperator ceiling for limits.maxInputBytes and the decoded size of one PKI object (default 67108864 = 64 MiB, the engine default). Integer >= 1024, read once at startup; an invalid value refuses to start. A per-call value above it is refused with LIMIT_CEILING_EXCEEDED.
PKINATIVE_MCP_MAX_KDF_ITERATIONSOperator ceiling for limits.maxKdfIterations and limits.maxPkcs12KdfIterations (default 10000000, the engine default): the CPU bound of a hostile PBES2 key or PKCS#12 file. Integer >= 1, read once at startup; an invalid value refuses to start.
PKINATIVE_MCP_MAX_PATHS_EXPLOREDOperator ceiling for limits.maxPathsExplored (default 1000, the engine default): the RFC 5280 section 6 path-building work bound. Integer >= 1, read once at startup; an invalid value refuses to start.

Own this server?

Claim it to keep the listing current and reply to reviews. Claiming never changes the grade or hides a review.

Claim listing

Badge for your README

Shows the safety grade and links back to this page. It updates itself after every scan and review.

[![mcp.market](https://mcp.market/badge/nizoka-pkinative-mcp.svg)](https://mcp.market/server/nizoka-pkinative-mcp)

How the badge works