TrustLint CLI

Fast, zero-dependency TLS risk analysis with OCSP revocation detection (where OCSP URL present in certificate AIA) and structured decisions — powered by spl-tls-analyze.

Probes domains for TLS certificate validity, checks OCSP revocation (where available), detects deprecated protocols (TLS 1.0/1.1), and produces ALLOW/REVIEW/DENY decisions across 20 risk categories with 5 severity levels. 3 operating profiles. JSON + Markdown structured output.

Beta software. Use for TLS risk assessment and CI guardrails; not a complete security audit.

Install

pip install spl-tls-analyze

Quickstart

# Analyze a single domain
spl-tls-analyze example.com

# Batch analysis with strict profile, JSON output
spl-tls-analyze domains.txt --profile strict --json-out report.json

# Markdown report with conservative profile
spl-tls-analyze domains.txt --profile conservative --markdown-out report.md

Free 5-Domain Sample Report

TrustLint CLI is open source and free to run locally on any number of domains — no limits, no license key required.

The free 5-domain sample report is a commercial service preview, not a CLI restriction. Submit up to 5 domains you own or are authorized to test, and receive a lightweight preview of what a TrustLint Audit looks like.

Important: This is not a full security audit, penetration test, compliance certification, or security guarantee. It is a preview of the TrustLint Audits service.

Request a free sample report by opening an Audit Request issue.

Paid TrustLint Audits are available for full client-ready reports, white-label agency reports, and monthly monitoring.

What It Detects

Profiles

Exit Codes

Output Example

{
  "domain": "expired.badssl.com",
  "final": {
    "decision": "DENY",
    "risk": "HIGH",
    "primary_reason": "Security risk (strict profile): RENEW_OR_DENY for EXPIRED_CERT",
    "recommended_action": "Renew or replace the certificate immediately."
  },
  "tls_probe": {
    "classification": "EXPIRED_CERT",
    "tls_version": null,
    "cert_is_expired": true,
    "resolved_ip": "104.154.89.93"
  }
}

TrustLint Audits

TrustLint commercial TLS audit reports are available for teams, freelancers, and web agencies that want a clear, client-ready review of their domains.

Start free: docs/FREE_SAMPLE_REPORT.md — up to 5 domains, service preview.

Upgrade to paid: docs/COMMERCIAL_AUDITS.md — client-ready reports, white-label delivery, monthly monitoring, and support.

See a sample: examples/sample_tls_audit_report.md.

Development

python -m pytest tests/ -q
python -m build

License

MIT