Your Data · Attack Surface

`list_my_ssl_certificates`

List TLS certificates observed on your services, ordered by expiry. Set expired_only to surface expired certs. Costs 1 credit.

POST

tools/call

Cost: 1 credit per successful call · Scope: mcp:org · Response shape: jsonb

Returns data scoped to your own organisation only — the organisation is resolved from your API key and injected server-side, never read from the request.

Parameters

expired_onlybooleanoptionaldefault: false

When true, only certificates that have already expired are returned.

limitintegeroptionaldefault: 100

Maximum number of certificates to return. Accepted range: 1–500.

Example invocation

Ask your agent: "Which of our TLS certificates have expired or expire soon?"

curl -s https://api.precursorintelligence.com/functions/v1/mcp \
  -H "Authorization: Bearer $PRECURSOR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"list_my_ssl_certificates","arguments":{"expired_only":false,"limit":100}}}'

Response

result.content[0].text (parsed)

{
  "count": 2,
  "items": [
    {
      "subject_common_name": "precursorsecurity.com",
      "subject_organization": "Precursor Security Ltd",
      "issuer_common_name": "R11",
      "issuer_organization": "Let's Encrypt",
      "serial_number": "04:9f:2c:7a:3b:1e:8d:6f:0a:c4:5e:91:22:7b:de:01",
      "fingerprint_sha256": "9b71d224bd62f3785d96d46ad3ea3d73319bfbc2890caadae2dff72519673ca7",
      "valid_from": "2026-04-02T00:00:00.000Z",
      "valid_to": "2026-07-01T23:59:59.000Z",
      "is_expired": false,
      "is_wildcard": false,
      "subject_alternative_names": [
        "precursorsecurity.com",
        "www.precursorsecurity.com"
      ],
      "key_algorithm": "RSA",
      "key_size": 2048,
      "signature_algorithm": "SHA256-RSA"
    },
    {
      "subject_common_name": "*.precursorsecurity.com",
      "subject_organization": "Precursor Security Ltd",
      "issuer_common_name": "R10",
      "issuer_organization": "Let's Encrypt",
      "serial_number": "03:b1:88:4c:5d:9a:71:2f:e6:30:c8:14:9b:0d:af:77",
      "fingerprint_sha256": "2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae",
      "valid_from": "2026-01-05T00:00:00.000Z",
      "valid_to": "2026-04-05T23:59:59.000Z",
      "is_expired": true,
      "is_wildcard": true,
      "subject_alternative_names": [
        "*.precursorsecurity.com"
      ],
      "key_algorithm": "ECDSA",
      "key_size": 256,
      "signature_algorithm": "ECDSA-SHA384"
    }
  ],
  "generated_at": "2026-06-18T08:15:00.000Z"
}

The full MCP envelope, including _meta.precursor with request_id, credits, and response_truncated, is documented in Response Format.

Response fields

countintegeroptional

Number of certificates returned (equals items.length).

itemsarrayoptional

TLS certificates observed on your services, ordered by expiry. Each object contains the fields below.

items[].subject_common_namestringoptional

The certificate subject common name (CN).

items[].subject_organizationstring | nulloptional

The organisation named in the certificate subject, when present.

items[].issuer_common_namestringoptional

The common name of the issuing certificate authority.

items[].issuer_organizationstringoptional

The organisation of the issuing certificate authority.

items[].serial_numberstringoptional

The certificate serial number.

items[].fingerprint_sha256stringoptional

SHA-256 fingerprint of the certificate.

items[].valid_fromstringoptional

ISO 8601 timestamp of the start of the validity window (UTC).

items[].valid_tostringoptional

ISO 8601 timestamp of the end of the validity window (UTC).

items[].is_expiredbooleanoptional

Whether the certificate has passed its valid_to date.

items[].is_wildcardbooleanoptional

Whether the certificate covers a wildcard name, e.g. *.precursorsecurity.com.

items[].subject_alternative_namesarrayoptional

Array of subject alternative name (SAN) strings covered by the certificate.

items[].key_algorithmstringoptional

Public key algorithm, e.g. RSA or ECDSA.

items[].key_sizeintegeroptional

Public key size in bits.

items[].signature_algorithmstringoptional

The certificate signature algorithm, e.g. SHA256-RSA.

generated_atstringoptional

ISO 8601 timestamp indicating when this response was generated.

Errors

Code	Message	When
`-32602`	`invalid_params: expired_only: boolean`	`expired_only` is not a boolean
`-32602`	`invalid_params: limit: min:1`	`limit` is less than 1
`-32602`	`invalid_params: limit: max:500`	`limit` exceeds 500
`-32001`	`unauthorized`	The API key is invalid/revoked, the IP is not allowed, or the key lacks the `mcp:org` scope.
`-32002`	`insufficient_credits`	Your credit balance is zero; top up from the dashboard
`-32603`	`internal`	Unexpected server error; the credit is automatically refunded