# TLS Radar

Runs SSL/TLS scans, issues free Let's Encrypt certificates and watches expiry dates from inside your coding agent.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 3
- Author: TLS-Radar
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/TLS-Radar/tlsradar-claude-plugin
- Updated: 2026-09-13
- HTML: https://affpapa.org/en/nevibecode/mcp/tls-radar

## What it does

The server hands your agent tools for scanning a domain, issuing a certificate and tracking it afterwards. Public calls need no account: `/tls-scan example.com` runs a check, `/tls-cert mydomain.dev` orders a 90-day Let's Encrypt certificate. Your private key is generated on your own machine with `openssl` and stays there — only the CSR travels to the backend.

Monitoring and plan lookups sit behind a login. In Claude that is the built-in OAuth flow: run `/mcp`, pick the `tlsradar` server, approve in the browser, and the client attaches the token from then on. After that `/tls-monitor add api.foo.io` starts tracking a domain and `/tls-monitor list` shows what you have. An interrupted issuance is not lost — the order state sits in `~/.config/tlsradar/orders/<domain>.json`, so you can resume it later.

You pick how to prove domain control, and the choice is remembered in `~/.config/tlsradar/config.json`. The Cloudflare and Route 53 modes read credentials from your environment — `CLOUDFLARE_API_TOKEN` or a configured `aws` CLI. Without those, automatic TXT records fail and you are left with manual `dns-01` or `http-01` on port 80, which covers the apex only.

## Requirements
- Remote server: `https://tlsradar.com/api/v1/mcp`

## Install

### Claude Code (native platform)

**Platform CLI: remote server**
```bash
claude mcp add --transport http tlsradar https://tlsradar.com/api/v1/mcp
```

### Codex

**Platform CLI: remote server**
```bash
codex mcp add tls-radar --url https://tlsradar.com/api/v1/mcp
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "tls-radar": {
            "url": "https://tlsradar.com/api/v1/mcp"
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "tls-radar": {
            "type": "http",
            "url": "https://tlsradar.com/api/v1/mcp"
        }
    }
}
```

### Gemini CLI

**Platform CLI: remote server**
```bash
gemini mcp add -t http tls-radar https://tlsradar.com/api/v1/mcp
```

## When to use it
- check a domain's certificate chain and expiry date
- issue a free Let's Encrypt cert without handing over the private key
- put domains on expiry monitoring
- resume a certificate order that was interrupted mid-flow
- build a `.p12` bundle from an issued certificate locally

## Example prompts
- Scan example.com over SSL/TLS and tell me what's wrong with the chain
- Issue a Let's Encrypt cert for mydomain.dev, keep the key on my machine
- Add api.foo.io to monitoring and list what expires soon

## Similar
- [ssl-tls-management](https://affpapa.org/en/nevibecode/skills/ssl-tls-management.md) — skill · 420 installs
- [ssl-certificate-management](https://affpapa.org/en/nevibecode/skills/ssl-certificate-management.md) — skill · 500 installs
- [mtls-configuration](https://affpapa.org/en/nevibecode/skills/mtls-configuration.md) — skill · 10300 installs
- [dotnet-devcert-trust](https://affpapa.org/en/nevibecode/skills/dotnet-devcert-trust.md) — skill · 434 installs
- [sentinel](https://affpapa.org/en/nevibecode/mcp/sentinel.md) — MCP server · ★ 1
- [wendy-device-enrollment](https://affpapa.org/en/nevibecode/skills/wendy-device-enrollment.md) — skill · ★ 62

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md