CertGuru

CertGuru as an MCP server

Everything on this site is also available to an AI agent over the Model Context Protocol, at https://certguru.io/mcp. It is free, needs no account, and the certificate tools parse your material at the edge rather than reading it into a model.

Adding it

The server speaks the Streamable HTTP transport, so any MCP client that supports remote servers can use it. For Claude Code: 

claude mcp add --transport http certguru https://certguru.io/mcp

For clients configured by file, the endpoint is https://certguru.io/mcp with transport type http. There is no authentication and no session to establish.

Why call a tool instead of asking the model

Two reasons, and they are different for the two halves of the server.

The reference tools return commands that were executed against OpenSSL 3.5.7 on the build that published them. A model answering from memory reproduces whatever was most common in its training data, which for OpenSSL is a decade of blog posts written against 1.0.2 — the exact failure this site exists to fix. How commands are tested explains the mechanism.

The certificate tools matter for a different reason: they let an agent inspect real certificate material without that material entering a model's context window. Parsing happens in the Cloudflare Worker, and only the decoded summary comes back.

The tools

Reference

  • search_reference — search by command, task, or the verbatim text of an error. Returns each page's standalone answer, so one call often settles the question.
  • get_reference_page — the full text of one page as markdown, including its FAQ.
  • list_reference — every page, optionally within one of the six categories.

Certificate material

  • decode_certificate — subject, issuer, validity and remaining lifetime, key, SANs, extensions and both fingerprints. The equivalent of openssl x509 -noout -text.
  • decode_csr — subject, requested SANs, key and signature algorithm, and the requested extensions.
  • check_key_cert_match — whether a key and a certificate are a pair, by comparing the SubjectPublicKeyInfo each carries. This is the question behind key values mismatch.

What it does not do

The server is read-only. There are no tools that write, sign, or issue anything, nothing is stored between calls, and there is no session state — every request is answered on its own. It accepts POST only; a browser visiting the endpoint gets a 405 pointing back here.

The parsers are the same dependency-free code behind the browser tools, so a decode returns exactly what the corresponding tool page would show you.