SSL Doctor — live TLS/SSL certificate health check (MCP + x402)

Give it a hostname; it opens a real TLS connection and tells you whether the certificate is healthy before you trust the endpoint:

• Expiry — exact days left, and a warning while there's still time to renew.
• Hostname match — does the cert's CN/SAN actually cover this host?
• Trust — is the chain trusted, or self-signed / missing an intermediate?
• Verdict — HEALTHY / WARN / CRITICAL + a risk score.

An AI agent can't do a live TLS handshake from a chat. This MCP can — that's the moat.

Two tiers

Tier	What you get	How
Free	Expiry, issuer, hostname match, trust verdict, score	runs locally / GET /run?target=
Deep (paid)	Negotiated protocol + cipher strength (catches TLS 1.0/1.1, weak ciphers), full chain-trust walk, per-finding fixes	GET /pro/run?target=

The deep tier runs server-side only behind payment — it never ships in the installed package, so it can't be used for free.

Pay (dual lane)

• x402 (USDC on Base) — AI agents pay per call automatically. No signup, no key.
• Stripe — humans buy a prepaid API key at /pro/checkout, then set SSL_DOCTOR_KEY in the MCP env (or send Authorization: Bearer <key>).

Either lane unlocks the same deep result.

Use as an MCP

{
  "mcpServers": {
    "ssl-doctor": {
      "command": "npx",
      "args": ["-y", "ssl-doctor-mcp"],
      "env": { "SSL_DOCTOR_KEY": "ssl_optional-for-deep" }
    }
  }
}

Tool: check_ssl — { target: "example.com", deep?: true }. The free verdict needs no key; deep=true is the premium tier.

HTTP API

• GET /run?target=example.com — free verdict (rate-limited 30/h/IP).
• GET /pro/run?target=example.com — deep tier (x402 USDC or prepaid key).
• POST /mcp — MCP-over-HTTP.
• GET /health, GET /openapi.json, GET /.well-known/x402.

Honesty

A live, point-in-time check via Node's TLS stack. Not a full cipher-enumeration audit; it flags the failure modes that actually break client trust or cause an outage (expiry, mismatch, untrusted chain, weak protocol). Read-only.

MIT (c) Baneado98