ctlogs.dev - Certificate Transparency Search

npx add-mcp 'https://mcp.ctlogs.dev/mcp'

MCP server.

Certificate Transparency search for AI assistants and agents: subdomains, TLS certificates, organizations and certificate authorities, over the Model Context Protocol.

The server

The address is https://mcp.ctlogs.dev/mcp (Streamable HTTP). It is a remote server: there is nothing to install, and it works at once without a key or an account. An assistant connected to it can answer questions such as “which subdomains does example.com have” or “who else holds a certificate for this name” from the public Certificate Transparency logs.

Tool	What it does
find_subdomains	List the hostnames found under a domain in TLS certificates: one row per hostname with the number of certificates and first/last seen dates.
search_certificates	List TLS certificates issued for a domain name: id, matching names, issuer, serial number and validity dates.
search_organization	List TLS certificates whose subject organization matches a name, e.g. “PayPal, Inc.”: id, subject common name, domains, issuer and validity dates.
get_certificate	Return the full record of one certificate: subject, issuer, serial number, validity, DNS names, key and signature details, the CT log entries that recorded it and download URLs for the certificate body.
get_ca	Return one issuing CA certificate by its SHA-256 fingerprint (the issuer_ca field of get_certificate): subject, issuer, validity, parent and cross-signed certificates, the number of certificates it issued and a page of them.

Connect

Claude Code:

claude mcp add --transport http ctlogs https://mcp.ctlogs.dev/mcp

With a key:

claude mcp add --transport http ctlogs https://mcp.ctlogs.dev/mcp --header "Authorization: Bearer YOUR_KEY"

claude.ai: under Customize › Connectors, choose Add, then Add custom connector, and enter the URL; under Authentication choose Sign in when needed. On Team and Enterprise plans an Owner adds it under Organization settings › Connectors.

ChatGPT: under Plugins, choose +, then Add custom MCP server, and enter the URL.

Cursor: in ~/.cursor/mcp.json, or .cursor/mcp.json in a project:

{
  "mcpServers": {
    "ctlogs": { "url": "https://mcp.ctlogs.dev/mcp" }
  }
}

With a key:

{
  "mcpServers": {
    "ctlogs": {
      "url": "https://mcp.ctlogs.dev/mcp",
      "headers": { "Authorization": "Bearer YOUR_KEY" }
    }
  }
}

VS Code: in .vscode/mcp.json:

{
  "servers": {
    "ctlogs": { "type": "http", "url": "https://mcp.ctlogs.dev/mcp" }
  }
}

With a key:

{
  "servers": {
    "ctlogs": {
      "type": "http",
      "url": "https://mcp.ctlogs.dev/mcp",
      "headers": { "Authorization": "Bearer YOUR_KEY" }
    }
  }
}

Limits

A tool call is one API request and runs under the anonymous API’s limits, or the key’s plan (see limits); search_organization counts as 10, as /v1/org does. The key goes in the Authorization header only. Without a key or with a free key, a call that arrives while another is running waits up to 5 seconds for its turn. Certificate lists return 25 rows per call, limit up to 100; find_subdomains returns up to 100 hostnames per call. A list with more rows returns next_cursor for the next call.

A free key comes from the account page. The same searches are available as a REST API.