pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte leaving

{
  "_meta": {
    "io.modelcontextprotocol.registry/official": {
      "status": "active",
      "isLatest": true,
      "updatedAt": "2026-10-17T11:30:00.265364Z",
      "publishedAt": "2026-10-17T11:30:00.265364Z",
      "statusChangedAt": "2026-10-17T11:30:00.265364Z"
    }
  },
  "server": {
    "name": "io.github.Nizoka/pkinative-mcp",
    "_meta": {
      "io.modelcontextprotocol.registry/publisher-provided": {
        "com.github": {
          "serverDisplayName": "pkinative MCP"
        },
        "io.github.nizoka.publisher": {
          "tool": "mcp-publisher",
          "engine": "pkinative@1.0.0",
          "license": "MIT",
          "network": "none",
          "keywords": [
            "pki",
            "x509",
            "certificate",
            "csr",
            "pkcs10",
            "crl",
            "ocsp",
            "revocation",
            "cms",
            "pkcs7",
            "rfc3161",
            "timestamp",
            "pkcs8",
            "pkcs12",
            "asn1",
            "pem",
            "der",
            "oid",
            "chain-validation",
            "tls-certificate",
            "code-signing",
            "offline",
            "secure-by-default",
            "openssl-interop",
            "ecdsa",
            "ed25519",
            "rsa-pss"
          ],
          "standards": [
            "RFC 5280",
            "RFC 6125",
            "RFC 6960",
            "RFC 5652",
            "RFC 3161",
            "RFC 2986",
            "RFC 5958",
            "RFC 8018",
            "RFC 7292",
            "RFC 9579",
            "RFC 7468"
          ],
          "toolCount": 34,
          "transports": [
            "stdio",
            "streamable-http"
          ],
          "conformance": "OpenSSL 3 interoperability validated in CI (Linux and Windows)",
          "keyHandling": "private keys never returned, never written, never served as resources",
          "mcpProtocol": "2026-07-28",
          "promptCount": 7,
          "toolVersion": "1.7.9"
        }
      }
    },
    "title": "pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte leaving",
    "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
    "version": "1.0.0",
    "packages": [
      {
        "version": "1.0.0",
        "transport": {
          "type": "stdio"
        },
        "identifier": "pkinative-mcp",
        "runtimeHint": "npx",
        "registryType": "npm",
        "registryBaseUrl": "https://registry.npmjs.org",
        "runtimeArguments": [
          {
            "type": "positional",
            "value": "-y",
            "valueHint": "skip-confirm"
          },
          {
            "type": "positional",
            "value": "pkinative-mcp",
            "valueHint": "package"
          }
        ],
        "environmentVariables": [
          {
            "name": "PKINATIVE_MCP_OUTPUT_DIR",
            "format": "filepath",
            "description": "Absolute path of the one sandbox directory: path inputs are read from it and outputMode='file' outputs are written under it (never overwritten; the real path of every file read and of every parent written must stay inside — a planted symlink or junction is SECURITY_VIOLATION). Key-bearing files (.key .p8 .p12 .pfx) are read by the key tools only, never written, never served as resources. Unset: every tool works on inline PEM / base64 only."
          },
          {
            "name": "PKINATIVE_MCP_CACHE_DIR",
            "format": "filepath",
            "description": "Opt-in content-addressed response cache directory (SHA-256 keyed, 1h TTL, 256 MiB LRU, plaintext at rest). Never caches path inputs, file output, a call carrying a password or a signer, a clock-dependent instant, a random serial or nonce, describe_engine or draft_governance_issue."
          },
          {
            "name": "PKINATIVE_MCP_PORT",
            "format": "number",
            "description": "Serve Streamable HTTP on this loopback port (POST /mcp) instead of stdio (MCP 2026-07-28, stateless, legacy fallback). Unauthenticated unless PKINATIVE_MCP_HTTP_TOKEN is set."
          },
          {
            "name": "PKINATIVE_MCP_HTTP_TOKEN",
            "isSecret": true,
            "description": "Opt-in bearer token for the HTTP transport (>= 16 chars, no whitespace; a weaker value refuses to start). When set, /mcp requires 'Authorization: Bearer <token>' or answers 401. Compared constant-time, never logged."
          },
          {
            "name": "PKINATIVE_MCP_PASSWORD",
            "isSecret": true,
            "description": "Operator-side password of the encrypted PKCS#8 key or PKCS#12 file the tools open (keeps the secret out of the model transcript). Exclusive with the per-call password input (both at once is VALIDATION_ERROR). Never logged; only its presence is reported at startup."
          },
          {
            "name": "PKINATIVE_MCP_AT",
            "description": "Pinned instant (ISO 8601 or epoch milliseconds) every omitted at / notBefore / signingTime falls back to, for reproducible verdicts and artefacts. Unset: the wall clock (a clock-dependent result is never cached). An invalid value refuses to start."
          },
          {
            "name": "PKINATIVE_MCP_MAX_INPUT_BYTES",
            "format": "number",
            "description": "Operator ceiling for limits.maxInputBytes and the decoded size of one PKI object (default 67108864 = 64 MiB, the engine default). Integer >= 1024, read once at startup; an invalid value refuses to start. A per-call value above it is refused with LIMIT_CEILING_EXCEEDED."
          },
          {
            "name": "PKINATIVE_MCP_MAX_KDF_ITERATIONS",
            "format": "number",
            "description": "Operator ceiling for limits.maxKdfIterations and limits.maxPkcs12KdfIterations (default 10000000, the engine default): the CPU bound of a hostile PBES2 key or PKCS#12 file. Integer >= 1, read once at startup; an invalid value refuses to start."
          },
          {
            "name": "PKINATIVE_MCP_MAX_PATHS_EXPLORED",
            "format": "number",
            "description": "Operator ceiling for limits.maxPathsExplored (default 1000, the engine default): the RFC 5280 section 6 path-building work bound. Integer >= 1, read once at startup; an invalid value refuses to start."
          }
        ]
      }
    ],
    "repository": {
      "url": "https://github.com/Nizoka/pkinative-mcp",
      "source": "github"
    },
    "websiteUrl": "https://github.com/Nizoka/pkinative-mcp#readme",
    "description": "PKI MCP server: inspect, verify, issue, sign X.509, CSR, CRL, OCSP, CMS, TSP, PKCS#12. 34 tools"
  }
}