Metadata-Version: 2.4
Name: mcp-certus
Version: 0.1.1
Summary: MCP server bridging agents to Certus Certificate Management Service
Author-email: banusoppan <banu.soppan@ivedha.com>
License: MIT
Project-URL: Homepage, https://github.com/ivedha-tech/certus-mcp
Project-URL: Documentation, https://github.com/ivedha-tech/certus-mcp#readme
Project-URL: Repository, https://github.com/ivedha-tech/certus-mcp
Project-URL: Issues, https://github.com/ivedha-tech/certus-mcp/issues
Keywords: mcp,certus,certificates,model-context-protocol,ai,claude
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Classifier: Topic :: Internet :: WWW/HTTP :: Dynamic Content
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: mcp<2,>=1.0.0
Requires-Dist: httpx>=0.28.0
Requires-Dist: python-dotenv>=1.0.0
Provides-Extra: dev
Requires-Dist: build>=1.0.0; extra == "dev"
Requires-Dist: twine>=5.0.0; extra == "dev"
Requires-Dist: pytest>=7.0.0; extra == "dev"
Requires-Dist: ruff>=0.9.0; extra == "dev"
Dynamic: license-file

# Certus MCP

MCP server that exposes the Certus Certificate Management Service to agents
(Claude / Cursor). Talks **only** to Certus. Use ServiceNEX MCP separately for
tickets/incidents.

| Item | Value |
|------|--------|
| PyPI | `mcp-certus` |
| Console script | `mcp-certus` |
| Python | `>=3.10` |

## Install

```bash
pip install mcp-certus
```

## Configure and run

```bash
export CERTUS_API_BASE="http://127.0.0.1:8080"
export LOG_LEVEL="INFO"
mcp-certus
```

(`CMS_BASE` is accepted as an alias for `CERTUS_API_BASE`.)

## Cursor / Claude Desktop

```json
{
  "mcpServers": {
    "certus": {
      "command": "mcp-certus",
      "env": {
        "CERTUS_API_BASE": "http://127.0.0.1:8080",
        "LOG_LEVEL": "INFO"
      }
    }
  }
}
```

## Development setup

```bash
cd certus-mcp
python3 -m venv .venv
source .venv/bin/activate
pip install -e .
# or: pip install -r requirements.txt
```

`.env`:

```
CERTUS_API_BASE=http://127.0.0.1:8080
LOG_LEVEL=INFO
```

Start Certus first, then:

```bash
mcp-certus
# or: python -m app.server
```

## Tools (by Certus domain)

| Module | Tools |
|---|---|
| certificates | `list_cert_inventory`, `get_cert` |
| ca | `create_ca_order`, `get_ca_order`, `get_ca_certificate` |
| secrets | `put_secret`, `get_secret` |
| runbooks | `find_runbook`, `list_runbook_runs` |
| deployments | `create_deployment`, `get_deployment`, `get_deployment_logs` |
| verify | `verify_endpoint` |
| scenario | `certus_health`, `get_scenario`, `set_scenario`, `reset_mock` |
| playbook | `get_cert_renewal_playbook`, `render_renewal_pipeline` |

## Prompts

| Prompt | Purpose |
|---|---|
| `cert_renewal_flow` | Full renewal loop with ServiceNEX parent/child tickets |

For natural language (e.g. “Run cert renewal”), Claude should call
`get_cert_renewal_playbook` first — same content and ServiceNEX templates as the
Connector prompt — then execute the flow. During the run it should call
`render_renewal_pipeline` at each stage and show the returned board/mermaid in chat.

## Agent flow (`cert_renewal_flow` / `get_cert_renewal_playbook`)

Requires **Certus MCP** + **ServiceNEX MCP**. For each inventory cert with `status: "expiring"`:

1. **DETECT** — `list_cert_inventory`, filter `expiring`
2. **Parent ticket** — ServiceNEX `create_ticket` from the cert object
3. **RENEW** — `create_ca_order` → poll `get_ca_order` → `get_ca_certificate`  
   - success → comment parent  
   - fail → child ticket → **stop this cert**
4. **RUNBOOK** — `find_runbook(tls-server, target)` → `list_runbook_runs`  
   - success history → comment parent  
   - else → child ticket → **stop this cert**
5. **EXECUTE** — `create_deployment` with `certRef=certs/<cn>` → poll `get_deployment` → `get_deployment_logs`  
   - success → comment parent (include logs)  
   - fail → child ticket with remediation from logs → **stop this cert**

Then continue with the next expiring cert. Skip `put_secret` and `verify_endpoint` unless asked.

Polling advances Certus mocks — call get_* again; do not sleep on wall clock.

## Publish to PyPI

See the sibling guide pattern in `lmsnex-mcp-server/docs/PUBLISH_PYPI.md`. Short version:

```bash
python3 -m venv .venv && source .venv/bin/activate
pip install -U build twine
rm -rf dist/ build/ *.egg-info
python -m build && twine check dist/*
# TestPyPI first, then:
python -m twine upload --repository testpypi dist/*
python -m twine upload dist/*
```
