MCPKI server

MCPKI (Model Context Public Key Infrastructure) enables autonomous certificate management for Large Language Models (LLMs) and other automated systems. By leveraging the Model Context Protocol (MCP), MCPKI allows AI agents to programmatically handle the full lifecycle of digital certificates — including issuance, renewal, revocation, and validation — without manual intervention. This reduces human error, enhances security, and paves the way for AI-native PKI workflows in a more secure web ecosystem.

Table of Contents

• Introduction
• Features
• Prerequisites
  • System Requirements
• Getting Started
  • Installation
  • Configuration
• Use with automation platforms
  • Configure n8n
• Use with chat clients
  • Configure LibreChat
• Access mcpki-server-programmatically
• API Endpoints
• Testing
• Deployment
• License

Introduction

This repository contains the implementation of the MCPKI server, built using:

• Spring Boot for a robust, modern Java-based web application framework.
• EJBCA Community Edition (CE) as the underlying PKI engine for managing Certificate Authorities (CAs), certificate profiles, CRLs, and OCSP services.

The server exposes a set of MCP-compatible API tools via Server-Sent Events (SSE) at endpoints like /sse, enabling seamless integration with LLMs and other clients. It supports multiple cryptographic algorithms through dedicated CAs (e.g., ECDSA prime256v1, RSA, and post-quantum Dilithium2).

This implementation powers the public MCPKI service at https://mcpki.org:12121/sse and is intended for educational, testing, and extension purposes.

For more details on MCPKI concepts, visit the official website: https://www.mcpki.org.

Features

MCPKI server provides a rich set of capabilities designed to enable seamless, autonomous PKI operations for LLMs and automated agents.

• Model Context Protocol (MCP) Compliance Fully implements the MCP specification, exposing PKI operations as LLM-friendly tools via Server-Sent Events (SSE) at /sse. This allows AI agents to discover, invoke, and manage certificates entirely through natural-language-driven workflows.
• Automated Certificate Lifecycle Management Programmatic support for:
  • Certificate issuance (CSR submission and signed certificate delivery)
  • Automatic renewal
  • Revocation
  • Status validation (OCSP/CRL checks)
• Multi-Algorithm Certificate Authorities Dedicated EJBCA-managed CAs for a variety of cryptographic algorithms, including:
  • ECDSA (prime256v1)
  • RSA (2048/3072/4096-bit)
  • Post-Quantum: Dilithium2 (CRYSTALS-Dilithium round-3 variant)
• Flexible Certificate Profiles
  • Configurable profiles for different use cases (e.g., client authentication, server TLS, code signing) with customizable validity periods, key usage, and extensions.
• RESTful Management API (optional, for admin use) Secure endpoints for monitoring CA status, viewing issued certificates, managing end entities, and triggering CRL updates.
• Integration with EJBCA CC Leverages EJBCA CE's battle-tested PKI features:
  • Full CA hierarchy support
  • CRL and OCSP responders
  • Comprehensive audit logging
  • Extensible validation modules
• Lightweight and Deployable Built on Spring Boot for easy containerization (Docker support included). Can be deployed alongside an EJBCA instance or configured to connect to a remote one.
• Non-Production Public Instance Powers the live demo service at https://www.mcpki.org, allowing immediate experimentation with LLM agents (rate-limited and monitored).
• Extensibility Modular design

... View full README on GitHub