dcert (Python)
A Python MCP wrapper for the dcert Rust server.
Uses FastMCP to create a transparent proxy around the dcert-mcp Rust binary, exposing all TLS certificate tools via the Model Context Protocol. New tools added to the Rust binary are automatically available without any Python code changes.
Requirements
- Python 3.12+
- The
dcert-mcpRust binary is bundled in platform-specific wheels (no network access needed at runtime)
Installation
pip install dcert
Platform-specific wheels are available for:
- Linux x86_64 (Ubuntu 22.04+, glibc 2.35+)
- macOS Intel (x86_64)
- macOS Apple Silicon (ARM64)
A universal fallback wheel auto-downloads the binary on first use if no platform wheel matches.
Quick Start
As a server
from dcert import create_server
server = create_server()
server.run() # stdio mode (default)
As a client
import asyncio
from dcert import create_client
async def main():
async with create_client() as client:
tools = await client.list_tools()
print(f"Available tools: {len(tools)}")
result = await client.call_tool(
"analyze_certificate", {"target": "example.com"}
)
print(result)
asyncio.run(main())
Typed async tool wrappers
For production use with type safety, timeouts, and automatic reconnection:
import asyncio
from dcert.tools import DcertClient
async def main():
async with DcertClient(timeout=60.0) as dcert:
# Analyze a certificate
result = await dcert.analyze_certificate(target="example.com")
# Check expiry with custom threshold
expiry = await dcert.check_expiry(target="example.com", days=90)
# Get TLS connection details
info = await dcert.tls_connection_info(target="example.com")
# Export PEM chain
pem = await dcert.export_pem(target="example.com", output_path="chain.pem")
asyncio.run(main())
All 11 tools are available as typed async methods:
| Method | Description |
|---|---|
analyze_certificate() |
Decode and analyze TLS certificates |
check_expiry() |
Check certificate expiry within N days |
check_revocation() |
Check OCSP revocation status |
compare_certificates() |
Compare certificates between two targets |
tls_connection_info() |
Get TLS connection details (cipher, protocol, latency) |
export_pem() |
Export certificate chain as PEM |
verify_key_match() |
Verify private key matches a certificate |
convert_pfx_to_pem() |
Convert PKCS12/PFX to PEM files |
convert_pem_to_pfx() |
Convert PEM cert+key to PKCS12/PFX |
create_keystore() |
Create PKCS12 keystore (Java-compatible) |
create_truststore() |
Create PKCS12 truststore from CA certs |
Error handling
from dcert.tools import (
DcertClient,
DcertError, # Base exception
DcertTimeoutError, # Tool call timed out
DcertConnectionError,# Subprocess died
DcertToolError, # MCP tool returned an error
)
async with DcertClient(timeout=30.0, max_reconnects=3) as dcert:
try:
result = await dcert.analyze_certificate(target="example.com")
except DcertTimeoutError:
print("Tool call timed out")
except DcertToolError as e:
print(f"Tool error: {e} (tool={e.tool})")
except DcertConnectionError:
print("Binary subprocess crashed")
CLI
# stdio mode (default, for MCP clients like Claude Code)
dcert-python
# HTTP mode
dcert-python --transport http --host 0.0.0.0 --port 8080
# Pre-download binary (universal wheel only)
dcert-python --setup
# Explicit binary path
dcert-python --binary /usr/local/bin/dcert-mcp
Binary Discovery
The package locates the dcert-mcp Rust binary in this order:
DCERT_MCP_BINARYenvironment variable- Bundled binary in the package
bin/directory dcert-mcponPATH(platform wheels install the binary here)- Auto-download from GitHub Releases (universal wheel fallback, with SHA256 verification)
Environment Variables
The proxy forwards these environment variables to the Rust binary:
| Category | Variables |
|---|---|
| Proxy | HTTP_PROXY, HTTPS_PROXY, NO_PROXY (and lowercase variants) |
| TLS | SSL_CERT_FILE, SSL_CERT_DIR |
| dcert | DCERT_PATH, DCERT_MCP_TIMEOUT, DCERT_MCP_CONNECTION_TIMEOUT, DCERT_MCP_READ_TIMEOUT |
Scalability
This package uses the MCP proxy pattern: the Python layer never needs to know about individual dcert tools. All tool discovery, input schemas, and invocations are forwarded to the Rust binary via the MCP protocol at runtime. When new capabilities are added to the Rust server, they are immediately available through the Python wrapper.
License
MIT
1 maintainer
Release files for dcert 3.0.45
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Built distributions (wheels)
| File | Reset | |||
|---|---|---|---|---|
| dcert-3.0.45-py3-none-win_amd64.whl | Python 3 | none | Windows x86-64 | Details |
| dcert-3.0.45-py3-none-manylinux_2_35_x86_64.whl | Python 3 | none | Linux glibc 2.35+ x86-64 | Details |
| dcert-3.0.45-py3-none-macosx_11_0_arm64.whl | Python 3 | none | macOS 11.0+ ARM64 | Details |
| dcert-3.0.45-py3-none-macosx_10_15_x86_64.whl | Python 3 | none | macOS 10.15+ x86-64 | Details |
| dcert-3.0.45-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 40.0 MB
Release files / dcert-3.0.45-py3-none-win_amd64.whl
| Download URL | dcert-3.0.45-py3-none-win_amd64.whl |
|---|---|
| Size | 12.0 MB |
| Tags | Python 3 Windows x86-64 |
|
SHA-256 checksum How to use checksums |
d9ec87f4bb9213fb3751a70d3240e23aa5cb18ffead09ce5de2c6e853c4020d5
|
|
BLAKE2b-256 checksum How to use checksums |
4e19a0482e9bd36a9a1fb0cbcd7271f6714579ddd7f8ac2e32719491e28471f8
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 31, 2026.
Transparency logRelease files / dcert-3.0.45-py3-none-manylinux_2_35_x86_64.whl
| Download URL | dcert-3.0.45-py3-none-manylinux_2_35_x86_64.whl |
|---|---|
| Size | 9.7 MB |
| Tags | Linux glibc 2.35+ x86-64 Python 3 |
|
SHA-256 checksum How to use checksums |
0d71ad1579bfa6c2d3d9a52a98be84c12dd2e398aa6cd3fb6f7da1fc3281a690
|
|
BLAKE2b-256 checksum How to use checksums |
c27fe5a34a21c7f955d74eab0302fc048040f7559e20bc52097551e0dda147be
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 31, 2026.
Transparency logRelease files / dcert-3.0.45-py3-none-macosx_11_0_arm64.whl
| Download URL | dcert-3.0.45-py3-none-macosx_11_0_arm64.whl |
|---|---|
| Size | 8.9 MB |
| Tags | Python 3 macOS 11.0+ ARM64 |
|
SHA-256 checksum How to use checksums |
6ea2aeb923b979d259d19a76ad7ca27ae102daed2f668222ca54dd66d73f6446
|
|
BLAKE2b-256 checksum How to use checksums |
de2a70bbc2ca940e6b4f0e2edd93c462514e2c067b664e6e951961654a569c44
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 31, 2026.
Transparency logRelease files / dcert-3.0.45-py3-none-macosx_10_15_x86_64.whl
| Download URL | dcert-3.0.45-py3-none-macosx_10_15_x86_64.whl |
|---|---|
| Size | 9.4 MB |
| Tags | Python 3 macOS 10.15+ x86-64 |
|
SHA-256 checksum How to use checksums |
1932b30c4f07c1ba92818ab808d96b86ab38a9c06bc6e922367ce968c162c606
|
|
BLAKE2b-256 checksum How to use checksums |
3cf24d8c151912f4d02d72a3cceb3fa78e5c0cf316469f8710c0b3b590232f53
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 31, 2026.
Transparency logRelease files / dcert-3.0.45-py3-none-any.whl
| Download URL | dcert-3.0.45-py3-none-any.whl |
|---|---|
| Size | 24.9 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
f76f45136383f674603506e46eb59eb2cb6edea755620e5e2b66cb604c4e4474
|
|
BLAKE2b-256 checksum How to use checksums |
87141cd0c2067259f0d98df5c61acafec98cb7f32b5f3745f5903b1267e5f92c
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 31, 2026.
Transparency log
