ctlogs.dev — Certificate Transparency search

Working · 46 ms Security A

dev.ctlogs/certificate-transparencyv1.1.0 Domain verified

Search Certificate Transparency logs: subdomains, TLS certificates, organizations, CAs.

Security

Watch Source Website

Registry entry

Open in the registry

{
  "_meta": {
    "io.modelcontextprotocol.registry/official": {
      "status": "active",
      "isLatest": true,
      "updatedAt": "2026-11-12T11:03:04.432936Z",
      "publishedAt": "2026-11-12T11:03:04.432936Z",
      "statusChangedAt": "2026-11-12T11:03:04.432936Z"
    }
  },
  "server": {
    "name": "dev.ctlogs/certificate-transparency",
    "icons": [
      {
        "src": "https://ctlogs.dev/favicon.svg",
        "sizes": [
          "any"
        ],
        "mimeType": "image/svg+xml"
      }
    ],
    "title": "ctlogs.dev — Certificate Transparency search",
    "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
    "remotes": [
      {
        "url": "https://mcp.ctlogs.dev/mcp",
        "type": "streamable-http"
      }
    ],
    "version": "1.1.0",
    "repository": {
      "url": "https://github.com/ctlogs/ctlogs-mcp",
      "source": "github"
    },
    "websiteUrl": "https://ctlogs.dev/",
    "description": "Search Certificate Transparency logs: subdomains, TLS certificates, organizations, CAs."
  }
}

Maintained byctlogs.dev(verified)Also a maintainer?

Try it

Call this server's tools from your browser. Nothing to install.

https://mcp.ctlogs.dev/mcp

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

find_subdomains Read-only

List the hostnames found under a domain in TLS certificates: one row per hostname with the number of certificates and first/last seen dates. Covers certificates valid now or expired within the last 90 days; set history to true for every hostname certified since 2013 (needs an API key on the Pro Lite or Pro plan). Use this to enumerate subdomains; use search_certificates for the certificates themselves.

domainstring, required

A bare DNS name such as example.com, without a scheme, path or port

cursorstring

The next_cursor of the previous call, to get the next page; omit for the first page

historyboolean

true lists every hostname certified since 2013 instead of the last 90 days; needs an API key on the Pro Lite or Pro plan

Install

Pick your client. Values in capitals, like YOUR_TOKEN, are yours to fill in.

One click: Add to Cursor Add to VS Code Add to LM Studio Add to Goose

Run in a terminal

claude mcp add --transport http certificate-transparency https://mcp.ctlogs.dev/mcp

Tools (5)

find_subdomains

read-only

Argument	Type	Description
cursor	string	The next_cursor of the previous call, to get the next page; omit for the first page
domain*	string	A bare DNS name such as example.com, without a scheme, path or port
history	boolean	true lists every hostname certified since 2013 instead of the last 90 days; needs an API key on the Pro Lite or Pro plan

Input schema (JSON)

{
  "type": "object",
  "required": [
    "domain"
  ],
  "properties": {
    "cursor": {
      "type": "string",
      "description": "The next_cursor of the previous call, to get the next page; omit for the first page"
    },
    "domain": {
      "type": "string",
      "description": "A bare DNS name such as example.com, without a scheme, path or port"
    },
    "history": {
      "type": "boolean",
      "description": "true lists every hostname certified since 2013 instead of the last 90 days; needs an API key on the Pro Lite or Pro plan"
    }
  },
  "additionalProperties": false
}

get_ca

Return one issuing CA certificate by its SHA-256 fingerprint (the issuer_ca field of get_certificate): subject, issuer, validity, parent and cross-signed certificates, the number of certificates it issued and a page of them.

read-only

Argument	Type	Description
limit	integer	Issued certificates per call, 1 to 100; default 25
cursor	string	The next_cursor of the previous call, to get the next page; omit for the first page
sha256*	string	SHA-256 fingerprint of the CA certificate, 64 hex characters

Input schema (JSON)

{
  "type": "object",
  "required": [
    "sha256"
  ],
  "properties": {
    "limit": {
      "type": "integer",
      "description": "Issued certificates per call, 1 to 100; default 25"
    },
    "cursor": {
      "type": "string",
      "description": "The next_cursor of the previous call, to get the next page; omit for the first page"
    },
    "sha256": {
      "type": "string",
      "description": "SHA-256 fingerprint of the CA certificate, 64 hex characters"
    }
  },
  "additionalProperties": false
}

get_certificate

Return the full record of one certificate: subject, issuer, serial number, validity, DNS names, key and signature details, the CT log entries that recorded it and download URLs for the certificate body. id is the id field of a search result or the certificate's SHA-256 fingerprint (64 hex characters).

read-only

Argument	Type	Description
id*	string	A search-result id or a 64-hex SHA-256 fingerprint

Input schema (JSON)

{
  "type": "object",
  "required": [
    "id"
  ],
  "properties": {
    "id": {
      "type": "string",
      "description": "A search-result id or a 64-hex SHA-256 fingerprint"
    }
  },
  "additionalProperties": false
}

search_certificates

List TLS certificates issued for a domain name: id, matching names, issuer, serial number and validity dates. By default matches the exact name; set include_subdomains to true to also match every name under it. Covers certificates valid now or expired within the last 90 days unless archive is set to "full" or a year from 2013 (needs an API key on the Pro plan). Pass a row's id to get_certificate for the full record. To list hostnames rather than certificates, use find_subdomains.

read-only

Argument	Type	Description
limit	integer	Rows per call, 1 to 100; default 25
cursor	string	The next_cursor of the previous call, to get the next page; omit for the first page
domain*	string	A bare DNS name such as example.com, without a scheme, path or port
archive	string	"full" for all certificates since 2013, or a four-digit year from 2013 for certificates valid into that year or later; needs an API key on the Pro plan. Omit for certificates valid now or expired within the last 90 days
include_subdomains	boolean	true also matches every name under the domain

Input schema (JSON)

{
  "type": "object",
  "required": [
    "domain"
  ],
  "properties": {
    "limit": {
      "type": "integer",
      "description": "Rows per call, 1 to 100; default 25"
    },
    "cursor": {
      "type": "string",
      "description": "The next_cursor of the previous call, to get the next page; omit for the first page"
    },
    "domain": {
      "type": "string",
      "description": "A bare DNS name such as example.com, without a scheme, path or port"
    },
    "archive": {
      "type": "string",
      "description": "\"full\" for all certificates since 2013, or a four-digit year from 2013 for certificates valid into that year or later; needs an API key on the Pro plan. Omit for certificates valid now or expired within the last 90 days"
    },
    "include_subdomains": {
      "type": "boolean",
      "description": "true also matches every name under the domain"
    }
  },
  "additionalProperties": false
}

search_organization

List TLS certificates whose subject organization matches a name, e.g. "PayPal, Inc.": id, subject common name, domains, issuer and validity dates. Covers certificates valid now or expired within the last 90 days unless archive is set to "full" or a year from 2013 (needs an API key on the Pro plan). One call counts as 10 requests against the rate limit.

read-only

Argument	Type	Description
name*	string	Organization name as it appears in the certificate subject, e.g. "PayPal, Inc."
limit	integer	Rows per call, 1 to 100; default 25
cursor	string	The next_cursor of the previous call, to get the next page; omit for the first page
archive	string	"full" for all certificates since 2013, or a four-digit year from 2013 for certificates valid into that year or later; needs an API key on the Pro plan. Omit for certificates valid now or expired within the last 90 days

Input schema (JSON)

{
  "type": "object",
  "required": [
    "name"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Organization name as it appears in the certificate subject, e.g. \"PayPal, Inc.\""
    },
    "limit": {
      "type": "integer",
      "description": "Rows per call, 1 to 100; default 25"
    },
    "cursor": {
      "type": "string",
      "description": "The next_cursor of the previous call, to get the next page; omit for the first page"
    },
    "archive": {
      "type": "string",
      "description": "\"full\" for all certificates since 2013, or a four-digit year from 2013 for certificates valid into that year or later; needs an API key on the Pro plan. Omit for certificates valid now or expired within the last 90 days"
    }
  },
  "additionalProperties": false
}

Security checkA100/100

We read every tool's name, description and inputs the way the model will, looking for instructions hidden from you. A clean result means no warning signs, not a guarantee. Scanned Nov 12, 2026.

Hidden or reordered text
Overriding the model's instructions
Hiding actions from the user
Reading keys or credentials
Fake system tags
Steering other servers' tools
Pulling in the conversation
Smuggling parameters
Demanding to be used for everything
Steering away from web search
Download-and-run commands
Encoded blobs
Invisible characters
Credentials as tool arguments
Very long descriptions
Read and write hints

How the security check works