io.github.Nizoka/pkinative-mcp

pkinative-mcp

PKI MCP server: inspect, verify, issue, sign X.509, CSR, CRL, OCSP, CMS, TSP, PKCS#12. 34 tools

43/wk 7 tools GitHub npm

No known CVEs

MIT license

Actively maintained

Last commit 0d ago

Works with most clients

Transport: stdio, sse, http

7 tools · ~487 tok

Grade A · 0.2% of 200K ctx

MCPpedia last refreshed this data 6h ago

Edit this pageView history

io.github.Nizoka/pkinative-mcp is an MCP server that PKI MCP server: inspect, verify, issue, sign X.509, CSR, CRL, OCSP, CMS, TSP, PKCS#12. 34 tools. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 87/100 on MCPpedia's security, maintenance and efficiency rubric.

Other

Step 1

Install in your client

Config is the same across clients - only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "pkinative": {
      "env": {
        "PKINATIVE_MCP_OUTPUT_DIR": "/Users/you/Documents/mcp-pki"
      },
      "args": [
        "-y",
        "pkinative-mcp"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-nizoka-pkinative-mcp)](https://mcppedia.org/s/io-github-nizoka-pkinative-mcp)

Read me

What io.github.Nizoka/pkinative-mcp does

PKI MCP server: inspect, verify, issue, sign X.509, CSR, CRL, OCSP, CMS, TSP, PKCS#12. 34 tools

Test This Server

This server supports HTTP transport. Be the first to test it - help the community know if it works.

Loading README…

Scored, not listed

Why this score

Five weighted categories - click any category to see the underlying evidence.

Score breakdown

87/100across 5 weighted dimensions

How we score →

0255075100

−13

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked pkinative-mcp against OSV.dev.

Inventory

Tools (7)

Click any tool to inspect its schema.

~487 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience - it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.Nizoka/pkinative-mcp safe to use?: io.github.Nizoka/pkinative-mcp has no known CVEs as of the latest MCPpedia security scan. Authentication requirements were not detected automatically - check the project's documentation before connecting in a shared environment. Licensed under MIT.
How do I install io.github.Nizoka/pkinative-mcp?: io.github.Nizoka/pkinative-mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can io.github.Nizoka/pkinative-mcp do?: io.github.Nizoka/pkinative-mcp provides 7 tools: issuer, certificate, path, serialHex, blocking and 2 more. See the full tools list on the server page for descriptions and parameters.
What AI clients work with io.github.Nizoka/pkinative-mcp?: io.github.Nizoka/pkinative-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is io.github.Nizoka/pkinative-mcp actively maintained?: io.github.Nizoka/pkinative-mcp is actively maintained - last commit was 0 days ago.

Similar servers

Others in other

View all →

io.github.sheawinkler/contextlattice95

Private-by-default, local-first memory/context/task orchestrator for MCP apps and agents.

156 4

Headroom95

Compress tool outputs, logs, files, and RAG chunks before they reach the LLM. 60-95% fewer tokens, same answers. Library, proxy, MCP server.

77.9k 3

Dexsql Release95

SQL for Android APK and DEX files: classes, methods, strings, references and smali.

234 2

System1 Agents95

System 1 decision models (Jev, Laya, Cua-S1) as brain for agents: Browser use, computer use, games and robotics

176 8

MCP Security Weekly

Get CVE alerts and security updates for io.github.Nizoka/pkinative-mcp and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

{ "mcpServers": { "pkinative": { "env": { "PKINATIVE_MCP_OUTPUT_DIR": "/Users/you/Documents/mcp-pki" }, "args": [ "-y", "pkinative-mcp" ], "command": "npx" } } }

pkinative-mcp

MCP server for PKI — inspect and verify X.509 certificates, CSRs, CRLs, OCSP responses, CMS SignedData and RFC 3161 time-stamps; build and validate certificate chains (RFC 5280 path validation, name and purpose checks, offline CRL and OCSP revocation); create certificates, CSRs, CMS signatures, OCSP and time-stamp requests; open PKCS#8 and PKCS#12 without ever returning a key byte; decode ASN.1, PEM and OIDs — 34 tools and 7 prompts on the pkinative engine (zero-dependency, pure TypeScript, Web Crypto for every signature; OpenSSL 3 interoperability validated in CI), for Claude Desktop, Cursor, ChatGPT and any Model Context Protocol client. No network, ever.

✨ Features

pkinative-mcp exposes 34 tools to any MCP host, in six groups. The kind says how the result is shaped: a read tool returns facts (structuredContent, projectable with verbosity / fields); a verdict tool returns valid + reasons[] and is never isError for a negative verdict; an artefact tool delivers DER or PEM once, inline or into the sandbox. The last column names the refusal codes an agent branches on (the full table is in docs/AGENT_CONTRACT.md).

Encodings

Tool	Kind	What it does	Key refusal codes
`convert_pem`	read	`mode: 'decode'` lists every block of a PEM text (label, DER size, offset, SHA-256) and `extractIndex` delivers one as DER / PEM / hex; `mode: 'encode'` wraps exactly one DER value into one strict RFC 7468 block under `label`. A private-key block is listed, never extracted and never produced; key material anywhere in the input is refused.	`SECURITY_VIOLATION`, `NOT_FOUND`, `VALIDATION_ERROR`, `PKI_PEM_UNEXPECTED_LABEL`, `PKI_PEM_*`
`resolve_oid`	read	Object identifiers in one call: `name` (registered names, ≤ 1000 per call), `validate` (X.660 grammar, reported never thrown), `list` (the engine registry, paged 200 / 2000), `encode` (dotted → hex, content or whole TLV, RELATIVE-OID), `decode` (hex → dotted + name).	`VALIDATION_ERROR`, `PKI_OID_INVALID`, `PKI_ASN1_*`
`compute_fingerprint`	read	`fingerprint` of the exact DER (SHA-256 default; SHA-1 / 384 / 512), `key-id` (the RFC 5280 §4.2.1.2 identifier of the public key of a certificate, CSR or PUBLIC KEY), `shake256` (`outputLength` bytes, the Ed448 CMS digest). Any object may be digested; no input byte is returned.	`VALIDATION_ERROR`, `PKI_X50

Tool

Kind

What it does

Key refusal codes

convert_pem

read

mode: 'decode' lists every block of a PEM text (label, DER size, offset, SHA-256) and extractIndex delivers one as DER / PEM / hex; mode: 'encode' wraps exactly one DER value into one strict RFC 7468 block under label. A private-key block is listed, never extracted and never produced; key material anywhere in the input is refused.

SECURITY_VIOLATION, NOT_FOUND, VALIDATION_ERROR, PKI_PEM_UNEXPECTED_LABEL, PKI_PEM_*

resolve_oid

read

Object identifiers in one call: name (registered names, ≤ 1000 per call), validate (X.660 grammar, reported never thrown), list (the engine registry, paged 200 / 2000), encode (dotted → hex, content or whole TLV, RELATIVE-OID), decode (hex → dotted + name).

VALIDATION_ERROR, PKI_OID_INVALID, PKI_ASN1_*

compute_fingerprint

read

fingerprint of the exact DER (SHA-256 default; SHA-1 / 384 / 512), key-id (the RFC 5280 §4.2.1.2 identifier of the public key of a certificate, CSR or PUBLIC KEY), shake256 (outputLength bytes, the Ed448 CMS digest). Any object may be digested; no input byte is returned.

VALIDATION_ERROR, `PKI_X50

Frequently Asked Questions

Is io.github.Nizoka/pkinative-mcp safe to use?

io.github.Nizoka/pkinative-mcp has no known CVEs as of the latest MCPpedia security scan. Authentication requirements were not detected automatically - check the project's documentation before connecting in a shared environment. Licensed under MIT.

How do I install io.github.Nizoka/pkinative-mcp?

io.github.Nizoka/pkinative-mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What can io.github.Nizoka/pkinative-mcp do?

io.github.Nizoka/pkinative-mcp provides 7 tools: issuer, certificate, path, serialHex, blocking and 2 more. See the full tools list on the server page for descriptions and parameters.

What AI clients work with io.github.Nizoka/pkinative-mcp?

io.github.Nizoka/pkinative-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.

Is io.github.Nizoka/pkinative-mcp actively maintained?

io.github.Nizoka/pkinative-mcp is actively maintained - last commit was 0 days ago.

pkinative-mcp

✨ Features

Encodings

Tool	Kind	What it does	Key refusal codes
`convert_pem`	read	`mode: 'decode'` lists every block of a PEM text (label, DER size, offset, SHA-256) and `extractIndex` delivers one as DER / PEM / hex; `mode: 'encode'` wraps exactly one DER value into one strict RFC 7468 block under `label`. A private-key block is listed, never extracted and never produced; key material anywhere in the input is refused.	`SECURITY_VIOLATION`, `NOT_FOUND`, `VALIDATION_ERROR`, `PKI_PEM_UNEXPECTED_LABEL`, `PKI_PEM_*`
`resolve_oid`	read	Object identifiers in one call: `name` (registered names, ≤ 1000 per call), `validate` (X.660 grammar, reported never thrown), `list` (the engine registry, paged 200 / 2000), `encode` (dotted → hex, content or whole TLV, RELATIVE-OID), `decode` (hex → dotted + name).	`VALIDATION_ERROR`, `PKI_OID_INVALID`, `PKI_ASN1_*`
`compute_fingerprint`	read	`fingerprint` of the exact DER (SHA-256 default; SHA-1 / 384 / 512), `key-id` (the RFC 5280 §4.2.1.2 identifier of the public key of a certificate, CSR or PUBLIC KEY), `shake256` (`outputLength` bytes, the Ed448 CMS digest). Any object may be digested; no input byte is returned.	`VALIDATION_ERROR`, `PKI_X50

Tool

Kind

What it does

Key refusal codes

convert_pem

read

SECURITY_VIOLATION, NOT_FOUND, VALIDATION_ERROR, PKI_PEM_UNEXPECTED_LABEL, PKI_PEM_*

resolve_oid

read

VALIDATION_ERROR, PKI_OID_INVALID, PKI_ASN1_*

compute_fingerprint

read

VALIDATION_ERROR, `PKI_X50