MCP connect

Connect your agent.
Keep the keys in CertLocker.

Point Claude, Codex, Gemini, or Cursor at https://trust.certlocker.io/rest/mcp. The agent asks; scopes, groups, and audit decide.

Get started See live-style examples

From Trust → Copy MCP config

one-time reveal 
{
  "mcpServers": {
    "demo-mcp": {
      "url": "https://trust.certlocker.io/rest/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_TOKEN"
      }
    }
  }
}

Same block the UI shows after you create an MCP token. Swap in your token once, store it in an env var, never commit it.

Connect in three steps

Operators create secrets, certificates, and hosts in Trust. Agents then consume them through MCP under a scoped token.

Step 1

Create an AI agent

Name it, set risk, pick scopes like secret:read and certificate:read.

Step 2

Issue an MCP token

Link the token to the agent, set groups + expiry, copy the config once. Max TTL 90 days.

Step 3

Paste into your client

Claude, Codex, Gemini, or Cursor. Ask it to list allowed resources to prove the link.

CertLocker MCP token created screen with endpoint and mcpServers JSON

Open full size screenshot

CertLocker agent detail MCP tab showing endpoint and client configuration

Open full size screenshot

Client configs

Endpoint for hosted: https://trust.certlocker.io/rest/mcp 

claude mcp add --transport http certlocker https://trust.certlocker.io/rest/mcp \
  --header "Authorization: Bearer $CERTLOCKER_MCP_TOKEN"
{
  "mcpServers": {
    "certlocker": {
      "type": "http",
      "url": "https://trust.certlocker.io/rest/mcp",
      "headers": {
        "Authorization": "Bearer ${CERTLOCKER_MCP_TOKEN}"
      }
    }
  }
}

Requires "type": "http". Confirm with /mcp.

What MCP can do

Create secrets, certificates, and hosts in Trust. Then let agents use them through these tools — never by pasting a shared .env.

Read secrets

Metadata first, raw value only with secret:read and group access.

Read certificates

Fetch allowed cert bundles and inspect expiry / SANs.

List inventory

See only the secrets, certs, and hosts this agent may touch.

Request SSH

Ask for a short-lived session; dry-run before creating one.

Create probes

Validate live TLS endpoints under policy.

Ask for approval

Pause privileged work until a human says yes.

Write audit events

Leave evidence of what the agent checked and when.

Use workflow prompts

Built-in playbooks like investigate_certificate_expiry.

Working examples

A real MCP session, step by step

These calls match the live CertLocker MCP tool surface. Demo names like demo1.certlocker.io come from a verified Demo MCP session. Responses are truncated where values are sensitive.

01

List what this agent can see

certlocker_list_allowed_resources

You ask the agent

“What CertLocker resources am I allowed to use?”

Tool arguments

{}

MCP returns

{
  "certificates": [
    { "id": "k8juvv0ck", "name": "demo1.certlocker.io" },
    { "id": "b5d17g8fo", "name": "IIS Test Server" }
  ],
  "secrets": [
    { "id": "c2jauo9th", "name": "Haproxy Test Token" }
  ],
  "hosts": []
}

Live shape from a Demo MCP session. Your token only returns assets inside its groups and scopes.

02

Read secret metadata safely

certlocker_get_secret_metadata

You ask the agent

“Show metadata for Haproxy Test Token — do not return the raw value.”

Tool arguments

{ "id": "c2jauo9th" }

MCP returns

{
  "id": "c2jauo9th",
  "name": "Haproxy Test Token",
  "expiresAt": null,
  "deny": null
}

Prefer metadata until the agent truly needs the secret. Creating and rotating secrets stays in the Trust UI.

03

Read a scoped secret value

certlocker_get_secret

You ask the agent

“Fetch the secret value for staging-api-key if I am allowed.”

Tool arguments

{ "id": "staging-api-key" }

MCP returns

{
  "id": "sec_staging_api",
  "name": "staging-api-key",
  "value": "••••••••••••",
  "deny": null
}

Requires secret:read. Outside group scope → access_denied and an audit event. Raw values are never shown on this marketing page.

04

Fetch a certificate bundle

certlocker_get_certificate

You ask the agent

“Get the certificate for demo1.certlocker.io and tell me when it expires.”

Tool arguments

{ "id": "k8juvv0ck" }

MCP returns

{
  "id": "k8juvv0ck",
  "name": "demo1.certlocker.io",
  "publicCert": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"
}

# openssl on the leaf:
# subject=CN = demo1.certlocker.io
# issuer=Let's Encrypt YE1
# notBefore=Jul  9 07:22:13 2026 GMT
# notAfter=Oct  7 07:22:12 2026 GMT
# DNS:demo1.certlocker.io

Verified live: MCP returned the public cert chain for demo1.certlocker.io.

05

Policy deny (the important bit)

certlocker_get_secret

You ask the agent

“Get the production database password.”

Tool arguments

{ "id": "prod-db-password" }

MCP returns

{
  "error": "access_denied",
  "http_status": 403,
  "reason": "Invalid secret prod-db-password",
  "required_scope": "secret:read"
}

Prompt injection cannot widen scope. Denied calls are auditable.

06

Dry-run an SSH session request

certlocker_request_ssh_session

You ask the agent

“Can I open SSH to staging-app-1? Dry-run only.”

Tool arguments

{ "hostId": "staging-app-1", "dryRun": true }

MCP returns

{
  "dryRun": true,
  "allowed": true,
  "hostId": "staging-app-1",
  "message": "SSH session would be issued under current scope"
}

Agents request sessions through CertLocker. They do not receive long-lived private keys.

07

Dry-run an endpoint probe

certlocker_create_probe

You ask the agent

“Create a probe for demo1.certlocker.io:443, dry-run first.”

Tool arguments

{ "host": "demo1.certlocker.io", "port": 443, "dryRun": true }

MCP returns

{
  "dryRun": true,
  "host": "demo1.certlocker.io",
  "port": 443,
  "allowed": true
}

Useful after renewals: confirm what TLS the endpoint will present before changing production.

08

Write an audit event

certlocker_write_audit_event

You ask the agent

“Record that I checked demo1.certlocker.io expiry.”

Tool arguments

{ "action": "cert_check", "message": "Reviewed demo1.certlocker.io", "level": "INFO" }

MCP returns

{
  "success": true,
  "auditEventId": "sek496jck",
  "deny": null
}

Verified live audit write from an MCP SDK client session.

Try this prompt after you connect

List allowed CertLocker resources.
For demo1.certlocker.io, fetch the certificate and summarize CN, SANs, and expiry.
For any allowed secret, call get_secret_metadata first — only read the raw value if I explicitly ask.
Finish with certlocker_write_audit_event describing what you checked.

Built-in workflow prompts

MCP prompts the agent can load without inventing the playbook.

investigate_certificate_expiry

List allowed certs, inspect one, probe if needed, write audit.

renew_certificate_safely

Check permissions, fetch cert, require approval before prod changes.

run_e2e_test_session

Use profile + hosts/secrets, SSH dry-run, probe, audit.

prepare_audit_summary

Read session audit context and summarize evidence.

request_production_access

Confirm prod is blocked, submit approval, wait.

Coming next

Nice to haves

Not in the live MCP tool surface yet. Shipping now: list, read, probe, SSH, approval, and audit. These are the next mutations we want under the same scopes and approvals.

Planned

Create / rotate secrets

Scoped create and rotate under group policy. Production stays behind approval. Today: create in Trust UI, read via MCP.

Planned

Create delivery tokens

Mint short-lived CERTIFICATE / SECRET / HOST install tokens for one job instead of pasting material into chat.

Planned

Request / renew certificates

Trigger ACME renew for allowed clients, then fetch the new bundle and create a probe.

Planned

Structured deny reasons

Return missing scope, wrong group, CIDR, expiry, or needs-approval so agents stop guessing.

Planned

Use secret without reveal

Inject a secret into SSH, probe, or env without returning the raw value to the model.

Planned

Session evidence pack

Export a summary of the last N MCP actions for auditors and incident review.

Create the agent token in Trust

Register, create one agent, issue an MCP token, paste the config, then run the examples above.

Open Trust
MCP product overview Stop sharing .env files Wiki: AI Agents