SSL Toolkit MCP / SSL 工具站 MCP 接入说明 SECURITY WARNING: Do not send production private keys, keystores (PFX/P12 or JKS), or their passwords to this hosted service, including through MCP clients. Use test credentials only. Generate and process production keys locally or in an environment you control. Clients and AI providers may retain inputs and outputs. 安全警告：请勿提交生产环境私钥、PFX/P12/JKS 密钥库及密码，包括通过 MCP 客户端提交。仅使用测试材料。生产密钥应在本地或你控制的可信环境中生成和处理。 English setup and client configuration: https://github.com/Mintreetech/ssl-toolkit-mcp#connect-a-client Transport: standard Streamable HTTP, stateless JSON responses; no custom adapter required for clients supporting this transport. Endpoint: POST /api/v1/mcp. Supported protocol versions: 2025-06-18 and 2025-11-25. Initialize, send notifications/initialized (HTTP 202, empty body), then tools/list and tools/call. Send Content-Type: application/json and Accept: application/json, text/event-stream. After initialization send the negotiated MCP-Protocol-Version header. No session ID; GET/DELETE return 405. No standalone SSE, legacy HTTP+SSE, or stdio. No API key required. Shared IP rate limits apply (HTTP 429). Allow at least 120 seconds for HTTPS/DCV calls. First safe call: dcv.list_cas with empty arguments. The generated tool schemas below are authoritative. 运行版本: v1.6.2 协议版本: 2025-11-25 端点: 同源 POST /api/v1/mcp Content-Type: application/json Accept: application/json, text/event-stream 后续请求头: MCP-Protocol-Version 使用初始化协商版本。 传输: 标准 Streamable HTTP，无状态 JSON 响应模式。支持 2025-06-18、2025-11-25。 不签发 MCP-Session-Id；GET 和 DELETE 返回 405，不提供独立 SSE、旧式 HTTP+SSE 或 stdio。 浏览器 Origin 必须匹配配置中的明确允许来源；非浏览器客户端可不发送 Origin。 当前接口无需 API Key，与 REST 共用 IP 限流；超限返回 HTTP 429。 HTTPS/DCV 工具同步等待并返回完整事件数组，客户端建议超时至少 120 秒。 工具执行错误在 result.isError 中；未知工具/非法参数为 JSON-RPC error，content[].text 包含结果 JSON 或错误描述。 私钥生成/转换响应可能含私钥，请勿将响应发布或记录在公共日志中。 初始化请求: {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"example","version":"1.0"}}} 初始化通知（无 JSON 响应，返回 HTTP 202）: {"jsonrpc":"2.0","method":"notifications/initialized"} 工具列表: {"jsonrpc":"2.0","id":2,"method":"tools/list"} 工具调用: {"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"dcv.list_cas","arguments":{}}} 当前行为: CSR CN/SAN 支持中文域名，自动 IDNA/Punycode 转换。 HTTPS 检测支持常规 TLS 与 TLCP、SM2/SM3/SM4；TLS 1.3 仅列实际协商套件。 证书查看与 HTTPS 使用相同 CCADB 合并根库，仅校验根信任。 HTTPS 中 SM2 不校验根信任；证书查看器目前不支持解析 SM2 证书或 CSR，会返回解析错误。 有效期、域名和吊销状态单独检查；常规 TLS 评级参考 SSL Labs 规则，由本站计算。 吊销检查包含中间/交叉证书的 OCSP 与 CRL；自签名根不列吊销状态。未知或失败不代表未吊销。 PFX 默认别名 server，JKS 默认别名 tomcat。修改加密容器密码需要已知原密码。 PEM 输出的 RSA/EC 私钥为传统格式，没有可选 PKCS#8 输出。 证书解析关闭 check_revocation 仅停止 OCSP/CRL，AIA 仍可能联网。 格式转换结果的 download_id 在 5 分钟内可用于 GET /api/v1/convert/download/{id}。 证书自动化管理 /expiry 是 CertMesh 方案介绍，没有证书管理或到期提醒配置接口。 下列列表是当前启用工具的完整目录；未列出的工具不可调用。 工具定义（JSON，直接来自运行中的注册表）: [ { "name": "cert.decode", "description": "解析证书(PEM / base64-DER / 裸 DER):全字段展开 + 整链吊销检查(OCSP / CRL，含交叉证书)+ 上传链时验证匹配关系并识别根证书。", "inputSchema": { "type": "object", "required": [ "cert" ], "properties": { "cert": { "type": "string", "description": "证书内容:PEM(可为多证书 bundle)/ base64-DER / 裸 DER" }, "chain": { "type": "string", "description": "可选;补充证书链(leaf 与链分文件时)。PEM / base64-DER / 裸 DER" }, "check_revocation": { "type": "boolean", "description": "是否执行整链吊销检查(OCSP / CRL，含交叉证书),默认 true" } } } }, { "name": "cert.match", "description": "证书 / 私钥 / CSR 匹配验证(SubjectPublicKeyInfo SHA-256 指纹比对)。安全警告：请勿提交生产私钥及密码，仅使用测试材料。 SECURITY WARNING: Do not send production private keys or passwords to this hosted service. Use test credentials only.", "inputSchema": { "type": "object", "required": [ "mode" ], "properties": { "mode": { "type": "string", "enum": [ "cert-key", "cert-csr", "key-csr" ] }, "cert": { "type": "string", "description": "证书 PEM" }, "key": { "type": "string", "description": "私钥 PEM" }, "csr": { "type": "string", "description": "CSR PEM" }, "password": { "type": "string", "description": "加密私钥的密码(可选)" } } } }, { "name": "convert.run", "description": "证书 / 密钥格式转换:PEM / P12 / JKS 任意方向(已知原密码时可修改密码)。安全警告：请勿提交生产私钥、密钥库及密码，仅使用测试材料。 SECURITY WARNING: Do not send production private keys, keystores (PFX/P12 or JKS), or passwords to this hosted service. Use test credentials only.", "inputSchema": { "type": "object", "required": [ "source_kind", "target_kind" ], "properties": { "source_kind": { "type": "string", "enum": [ "pem", "p12", "jks" ] }, "target_kind": { "type": "string", "enum": [ "pem", "p12", "jks" ] }, "cert_pem": { "type": "string", "description": "PEM 源:证书" }, "key_pem": { "type": "string", "description": "PEM 源:私钥" }, "chain_pem": { "type": "string", "description": "PEM 源:链(可选)" }, "source_blob_base64": { "type": "string", "description": "P12/JKS 源 base64" }, "source_password": { "type": "string" }, "source_alias": { "type": "string", "description": "JKS 别名" }, "target_password": { "type": "string", "description": "P12/JKS 目标必填" }, "target_alias": { "type": "string", "description": "目标别名，P12/PFX 默认 server，JKS 默认 tomcat" }, "enable_aia_fill": { "type": "boolean", "description": "源不带链时尝试 AIA 拉取" } } } }, { "name": "csr.decode", "description": "解析 CSR(PEM / base64-DER / 裸 DER):Subject、公钥算法、SAN、请求扩展、SPKI 指纹、自签名完整性校验。", "inputSchema": { "type": "object", "required": [ "csr" ], "properties": { "csr": { "type": "string", "description": "CSR 内容:PEM 文本 / base64-DER / 裸 DER" } } } }, { "name": "csr.generate", "description": "生成 RSA / ECC 私钥与对应 CSR;入参为 Subject + 算法 + 哈希 + SAN。安全警告：托管服务生成的私钥仅用于测试；生产密钥请在本地生成。 SECURITY WARNING: Hosted key generation is for testing only. Generate production keys locally; client histories may retain returned private keys.", "inputSchema": { "type": "object", "required": [ "subject", "algorithm" ], "properties": { "subject": { "type": "object", "required": [ "common_name", "country" ], "properties": { "common_name": { "type": "string", "description": "CN,支持中文域名及通配符，自动转换为 IDNA/Punycode。会自动作为第一个 SAN 加入(现代 CA 要求 CN 出现在 SAN 中)" }, "organization": { "type": "string", "description": "O 组织名(可选,DV 证书通常不需要)" }, "country": { "type": "string", "description": "C 国家代码 ISO 3166-1 alpha-2,会自动转大写(必填)" }, "province": { "type": "string", "description": "ST 省/州(可选)" }, "locality": { "type": "string", "description": "L 城市(可选)" }, "san": { "type": "array", "items": { "type": "string" }, "description": "额外的 Subject Alternative Names(可选;CN 已自动包含)" } } }, "algorithm": { "type": "string", "enum": [ "RSA-2048", "RSA-3072", "RSA-4096", "EC-P256", "EC-P384", "EC-P521" ] }, "hash_alg": { "type": "string", "enum": [ "SHA-256", "SHA-384", "SHA-512" ], "description": "RSA 适用;ECC 由曲线决定" } } } }, { "name": "dcv.check", "description": "DCV 预检 — DNS(TXT/CNAME)或 HTTP 文件验证模式。返回完整事件流(同步等待)。", "inputSchema": { "type": "object", "required": [ "mode" ], "properties": { "mode": { "type": "string", "enum": [ "dns", "http" ] }, "domain": { "type": "string", "description": "DNS 模式必填:主机记录名" }, "file_url": { "type": "string", "description": "HTTP 模式必填;协议头可省略,系统自动探测 http+https" }, "record_type": { "type": "string", "enum": [ "txt", "cname" ], "description": "DNS 模式记录类型,默认 txt" }, "expected_token": { "type": "string", "description": "可选;粘贴期望值启用字节级匹配" }, "target_ca": { "type": "string", "description": "可选;letsencrypt | digicert | sectigo | godaddy | globalsign | zerossl" } } } }, { "name": "dcv.list_cas", "description": "列出已支持的 CA(用于挑战路径推导与 CAA 比对)。", "inputSchema": { "type": "object", "properties": {} } }, { "name": "inspect.run", "description": "HTTPS 体检：常规 TLS 与国密 TLCP、RSA/SM2 证书、RSA 根信任、整链 OCSP/CRL（含交叉证书）、协议套件及评级。同步等待全部完成。", "inputSchema": { "type": "object", "required": [ "host" ], "properties": { "host": { "type": "string", "description": "FQDN,可带 :port" }, "port": { "type": "integer", "description": "可选;默认从 host 解析或回退 443" }, "force": { "type": "boolean", "description": "true 跳过缓存,强制重扫" } } } } ]