CertBridge MCP
The padlock, without the paywall — agent-native ACME issuance, challenge placement, install, and renewal watching for shared-hosting sites.
status: in-developmentclass: mcpTLS CertificatesHosting Infrastructure
Vendor: Cyan Eclipse Technologies
What it does
- Full ACME (RFC 8555) certificate lifecycle: account, order, authorization
- HTTP-01 challenge computation and placement
- Finalize orders and download PEM chains (Let's Encrypt primary, ZeroSSL via EAB)
- Parse any certificate for expiry and renewal-due status (<=30 days)
- Staging always labelled; append-only audit log of every step
Tools
register_account · request_certificate · get_challenges · place_challenge · complete_validation · download_certificate · install_certificate · certificate_status · audit_log
Platforms
- MCP over stdio
Certification
Bench verdict: CERTIFIED(staging)
Certified scope: Test Bench v0.1.0, 2026-10-24, Let's Encrypt STAGING environment: end-to-end staging order, byte-exact challenge placement, staging/production labelling, renewal-due detection, audit completeness — 12 pass, 1 na of 13 checks
Not tested:
- Auth enforcement (bench U1 = na: local stdio transport has no credential layer to test)
- cPanel UAPI install — declared in the server, returns explicit not-live errors; not scored by the bench. Live production issuance itself was proven separately by dogfood (see live_state_note)
- Production CA account on the BENCH run (bench created a staging account only); the dogfood run created a production account outside the bench
Live state note: Live issuance PROVEN by dogfood run 2026-10-25 — real Let's Encrypt production certificate issued end-to-end for eclipsebazaar.com + www.eclipsebazaar.com (test-bench/results/certbridge-mcp-dogfood-2026-10-25.md). NOT a bench scorecard: bench verdict remains CERTIFIED(staging); the §7 production label is withheld (cPanel install, public repo, named support outstanding).
Bench scorecard (evidence): https://eclipsebazaar.com/cards/certbridge-mcp-2026-10-24-2.json
Pricing
Free local / open reference implementation; hosted renewal-watch tier planned (per site/mo)
Install / verify
docker run -i ghcr.io/cyan-eclipse-technologies-llc/certbridge-mcp:0.2.0
Official MCP Registry name: io.github.CYAN-ECLIPSE-TECHNOLOGIES-LLC/certbridge
Registry listing: https://registry.modelcontextprotocol.io/v0.1/servers/io.github.CYAN-ECLIPSE-TECHNOLOGIES-LLC%2Fcertbridge/versions/0.2.0
Repository: https://github.com/CYAN-ECLIPSE-TECHNOLOGIES-LLC/certbridge-mcp
Verify any MCP server in your client configs against this catalog with bazaar check (Eclipse Bazaar MCP / CLI — see llms.txt).