Certus MCP

MCP server that exposes the Certus Certificate Management Service to agents (Claude / Cursor). Talks only to Certus. Use ServiceNEX MCP separately for tickets/incidents.

Install

pip install mcp-certus

Configure and run

export CERTUS_API_BASE="http://127.0.0.1:8080"
export LOG_LEVEL="INFO"
mcp-certus

(CMS_BASE is accepted as an alias for CERTUS_API_BASE.)

Cursor / Claude Desktop

{
  "mcpServers": {
    "certus": {
      "command": "mcp-certus",
      "env": {
        "CERTUS_API_BASE": "http://127.0.0.1:8080",
        "LOG_LEVEL": "INFO"
      }
    }
  }
}

Development setup

cd certus-mcp
python3 -m venv .venv
source .venv/bin/activate
pip install -e .
# or: pip install -r requirements.txt

.env:

CERTUS_API_BASE=http://127.0.0.1:8080
LOG_LEVEL=INFO

Start Certus first, then:

mcp-certus
# or: python -m app.server

Tools (by Certus domain)

Prompts

For natural language (e.g. “Run cert renewal”), Claude should call get_cert_renewal_playbook first — same content and ServiceNEX templates as the Connector prompt — then execute the flow. During the run it should call render_renewal_pipeline at each stage and show the returned board/mermaid in chat.

Agent flow (cert_renewal_flow / get_cert_renewal_playbook)

Requires Certus MCP + ServiceNEX MCP. For each inventory cert with status: "expiring":

1. DETECT — list_cert_inventory, filter expiring
2. Parent ticket — ServiceNEX create_ticket from the cert object
3. RENEW — create_ca_order → poll get_ca_order → get_ca_certificate
   • success → comment parent
   • fail → child ticket → stop this cert
4. RUNBOOK — find_runbook(tls-server, target) → list_runbook_runs
   • success history → comment parent
   • else → child ticket → stop this cert
5. EXECUTE — create_deployment with certRef=certs/<cn> → poll get_deployment → get_deployment_logs
   • success → comment parent (include logs)
   • fail → child ticket with remediation from logs → stop this cert

Then continue with the next expiring cert. Skip put_secret and verify_endpoint unless asked.

Polling advances Certus mocks — call get_* again; do not sleep on wall clock.

Publish to PyPI

See the sibling guide pattern in lmsnex-mcp-server/docs/PUBLISH_PYPI.md. Short version:

python3 -m venv .venv && source .venv/bin/activate
pip install -U build twine
rm -rf dist/ build/ *.egg-info
python -m build && twine check dist/*
# TestPyPI first, then:
python -m twine upload --repository testpypi dist/*
python -m twine upload dist/*