SS
SecurityData Analytics

Sslmon MCP Server: SSL Certificate and Domain Monitoring

Monitor domain registration, expiration and SSL certificate validity with the Sslmon MCP server—query domain and HTTPS info instantly.

View on GitHub
Quick Install
npx -y @firesh/sslmon-mcp

Overview

Sslmon MCP Server is a lightweight Model Context Protocol (MCP) service that provides instant domain and HTTPS/SSL certificate information. It collects WHOIS data, domain registration and expiration dates, and TLS certificate details (chain, issuer, SANs, validity windows) and exposes them via an MCP-compatible API so agents and developer tools can query domain context on demand.

This is useful for automation, security tooling and LLM agents that need real-time domain health and certificate context for decision-making. Instead of running ad-hoc scans or parsing remote resources per request, Sslmon centralizes checks and returns structured, machine-friendly results suitable for monitoring, alerting, and embedding into larger workflows.

Features

  • Domain WHOIS lookup: registrar, creation/expiration dates, registrant hints
  • SSL/TLS certificate scan: chain, issuer, subject, SANs, notBefore / notAfter
  • Live HTTPS checks: supported protocols, cipher details, redirect behavior, HSTS detection
  • Expiry calculations: days until domain/SSL expiration
  • Caching and TTL to avoid redundant network requests
  • Simple HTTP/JSON MCP-compatible interface for programmatic consumption
  • Docker-friendly and suitable for embedding with LLM/MCP agents

Installation / Configuration

Clone the repository and run with Docker or from source.

Clone repository:

git clone https://github.com/firesh/sslmon-mcp.git
cd sslmon-mcp

Run with Docker (recommended):

docker pull firesh/sslmon-mcp:latest
docker run -p 8080:8080 \
  -e PORT=8080 \
  -e CACHE_TTL=3600 \
  --name sslmon-mcp \
  firesh/sslmon-mcp:latest

Run from source (Go-based example):

# ensure Go is installed
go build -o sslmon ./cmd/server
./sslmon --port 8080 --cache-ttl 3600

Example environment variables / CLI flags:

  • PORT (default 8080) — HTTP listen port
  • CACHE_TTL (seconds) — cache duration for lookups
  • LOG_LEVEL — debug/info/warn/error
  • BIND_ADDRESS — address to bind (default 0.0.0.0)

Configuration file (optional, JSON/YAML):

{
  "port": 8080,
  "cache_ttl": 3600,
  "log_level": "info",
  "timeout_seconds": 15
}

Available Resources

Sslmon exposes a small set of queryable tools/resources intended for MCP agents and programmatic clients. Typical resources include:

  • /api/domain (POST) — fetch WHOIS and registration info for a domain
  • /api/ssl (POST) — scan TLS/HTTPS endpoint and return certificate + protocol info
  • /api/summary (POST) — aggregated domain + SSL summary (convenience endpoint)

Example JSON request/response patterns:

Request (domain):

POST /api/domain
{
  "domain": "example.com"
}

Response (domain):

{
  "domain": "example.com",
  "registrar": "Example Registrar, Inc.",
  "creation_date": "1995-08-13T00:00:00Z",
  "expiration_date": "2026-08-12T23:59:59Z",
  "days_until_expiry": 124,
  "whois_raw": "..."
}

Request (ssl):

POST /api/ssl
{
  "host": "example.com",
  "port": 443,
  "skip_verify": false
}

Response (ssl):

{
  "host": "example.com",
  "port": 443,
  "cert_chain": [
    {
      "subject": "CN=www.example.com",
      "issuer": "CN=Example CA",
      "not_before": "2024-03-10T00:00:00Z",
      "not_after": "2025-03-10T23:59:59Z",
      "san": ["example.com","www.example.com"]
    }
  ],
  "protocols": ["TLS1.2", "TLS1.3"],
  "hsts": true,
  "redirects": ["http://example.com -> https://example.com"]
}

Note: exact endpoint paths and JSON fields are intentionally stable but may vary with releases—consult the repository README or API docs for the current schema.

Use Cases

  • Certificate expiry alerting: poll /api/ssl or /api/summary for a fleet of domains and generate alerts when days_until_expiry < threshold
Tags:data-analyticssecurity