TLS Radar — Claude Code MCP server: SSL scans, certs
Runs SSL/TLS scans, issues free Let's Encrypt certificates and watches expiry dates from inside your coding agent.
claude mcp add --transport http tlsradar https://tlsradar.com/api/v1/mcpWhat TLS Radar does
The server hands your agent tools for scanning a domain, issuing a certificate and tracking it afterwards. Public calls need no account: /tls-scan example.com runs a check, /tls-cert mydomain.dev orders a 90-day Let's Encrypt certificate. Your private key is generated on your own machine with openssl and stays there — only the CSR travels to the backend.
Monitoring and plan lookups sit behind a login. In Claude that is the built-in OAuth flow: run /mcp, pick the tlsradar server, approve in the browser, and the client attaches the token from then on. After that /tls-monitor add api.foo.io starts tracking a domain and /tls-monitor list shows what you have. An interrupted issuance is not lost — the order state sits in ~/.config/tlsradar/orders/<domain>.json, so you can resume it later.
You pick how to prove domain control, and the choice is remembered in ~/.config/tlsradar/config.json. The Cloudflare and Route 53 modes read credentials from your environment — CLOUDFLARE_API_TOKEN or a configured aws CLI. Without those, automatic TXT records fail and you are left with manual dns-01 or http-01 on port 80, which covers the apex only.
What it helps with
- check a domain's certificate chain and expiry date
- issue a free Let's Encrypt cert without handing over the private key
- put domains on expiry monitoring
- resume a certificate order that was interrupted mid-flow
- build a
.p12bundle from an issued certificate locally
Example prompts for the agent
- Scan example.com over SSL/TLS and tell me what's wrong with the chain
- Issue a Let's Encrypt cert for mydomain.dev, keep the key on my machine
- Add api.foo.io to monitoring and list what expires soon
How to install TLS Radar
Platform CLI: remote server
claude mcp add --transport http tlsradar https://tlsradar.com/api/v1/mcpPlatform CLI: remote server
codex mcp add tls-radar --url https://tlsradar.com/api/v1/mcpConfig file
{
"mcpServers": {
"tls-radar": {
"url": "https://tlsradar.com/api/v1/mcp"
}
}
}Config file
{
"servers": {
"tls-radar": {
"type": "http",
"url": "https://tlsradar.com/api/v1/mcp"
}
}
}Platform CLI: remote server
gemini mcp add -t http tls-radar https://tlsradar.com/api/v1/mcpStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about TLS Radar
How do I install TLS Radar in Claude Code?
Add the marketplace with /plugin marketplace add TLS-Radar/tlsradar-claude-plugin, then install the plugin with /plugin install tlsradar@tlsradar. Scanning and certificate issuance work right away; run /mcp once when you want monitoring.
What does TLS Radar do?
It scans a domain's SSL/TLS setup, issues free Let's Encrypt certificates and monitors when they expire. All of it comes through one MCP server connected to your agent.
Where does the certificate private key go?
Nowhere. The key and CSR are created on your machine, only the CSR is sent out, and the returned chain is verified locally before it is shown to you.
