MCP guide · SSL Inspector
@guardbee/mcp-ssl-inspector inspects TLS certificates, protocols, cipher suites, and HSTS for any domain. It uses Node’s built-in tls module — no heavy deps, no Guardbee API key.
What does it do?
Ask Claude when a cert expires, whether TLS 1.0 is still enabled, or if HSTS is present — one host or many.
Who is it for?
- SRE / DevOps and security teams
- Agencies monitoring many client domains
- Product teams doing pre-launch HTTPS hygiene
What it is not
- Full SSL Labs grading or PCI evidence packs
- Certificate purchase / ACME automation
Features
| Feature | Description |
|---|---|
| Certificate audit | Validity, days left, fingerprint, SANs, chain |
| Protocols | Warn on TLS 1.0/1.1 and SSLv2/v3 |
| Ciphers | NULL, EXPORT, RC4, DES, 3DES, anon |
| HSTS | max-age and includeSubdomains |
| Bulk scan | Parallel multi-domain |
MCP tools
| Tool | Description |
|---|---|
inspect_ssl | Full single-host audit |
inspect_ssl_bulk | Many hosts |
check_cert_expiry | Expiry monitoring |
get_cert_info | Detailed cert fields |
Install with npm
Global install (handy for Claude Desktop / Cursor):
npm install -g @guardbee/mcp-ssl-inspectoror via npx (recommended with -y in config):
npx -y @guardbee/mcp-ssl-inspectorNeeds outbound access to port 443 on the target.
Claude Desktop configuration
Config file paths:
- macOS
~/Library/Application Support/Claude/claude_desktop_config.json - Windows
%APPDATA%\Claude\claude_desktop_config.json - Linux
~/.config/Claude/claude_desktop_config.json
Merge this block, then restart Claude Desktop:
{
"mcpServers": {
"guardbee-ssl-inspector": {
"command": "npx",
"args": [
"-y",
"@guardbee/mcp-ssl-inspector"
]
}
}
}Cursor and other MCP clients
In Cursor, add the same command / args / env under Settings → MCP. stdio MCP servers use the same contract as Claude Desktop.
Example prompts in Claude
- “Is the SSL certificate for example.com valid?”
- “When do these certs expire: example.com, api.example.com”
- “Does example.com allow weak ciphers?”
Related links
See surface risk with Guardbee
MCP servers speed up security work in chat. Start a 14-day free trial for brand scans and BeeAI.
Frequently asked questions
Self-signed?
Reported as chain/validity issues.
API key?
No.
IPv6?
Depends on local resolution — verify A/AAAA if needed.