{ "slug": "io-github-nizoka-pkinative-mcp", "name": "io.github.Nizoka/pkinative-mcp", "title": "pkinative MCP — X.509, CMS, OCSP, time-stamps and PKCS#12 without a key byte leaving", "description": "PKI MCP server: inspect, verify, issue, sign X.509, CSR, CRL, OCSP, CMS, TSP, PKCS#12. 34 tools", "version": "1.0.0", "publishedAt": "2026-10-17T11:30:00.265364Z", "updatedAt": "2026-10-17T11:30:00.265364Z", "repoUrl": "https://github.com/Nizoka/pkinative-mcp", "websiteUrl": "https://github.com/Nizoka/pkinative-mcp#readme", "namespace": { "type": "github", "owner": "Nizoka" }, "kind": "local", "packages": [ { "registryType": "npm", "identifier": "pkinative-mcp", "version": "1.0.0", "transport": "stdio", "runtimeHint": "npx" } ], "remotes": [], "envVars": [ { "name": "PKINATIVE_MCP_OUTPUT_DIR", "isSecret": false, "isRequired": false, "description": "Absolute path of the one sandbox directory: path inputs are read from it and outputMode='file' outputs are written under it (never overwritten; the real path of every file read and of every parent written must stay inside — a planted symlink or junction is SECURITY_VIOLATION). Key-bearing files (.key .p8 .p12 .pfx) are read by the key tools only, never written, never served as resources. Unset: every tool works on inline PEM / base64 only." }, { "name": "PKINATIVE_MCP_CACHE_DIR", "isSecret": false, "isRequired": false, "description": "Opt-in content-addressed response cache directory (SHA-256 keyed, 1h TTL, 256 MiB LRU, plaintext at rest). Never caches path inputs, file output, a call carrying a password or a signer, a clock-dependent instant, a random serial or nonce, describe_engine or draft_governance_issue." }, { "name": "PKINATIVE_MCP_PORT", "isSecret": false, "isRequired": false, "description": "Serve Streamable HTTP on this loopback port (POST /mcp) instead of stdio (MCP 2026-07-28, stateless, legacy fallback). Unauthenticated unless PKINATIVE_MCP_HTTP_TOKEN is set." }, { "name": "PKINATIVE_MCP_HTTP_TOKEN", "isSecret": true, "isRequired": false, "description": "Opt-in bearer token for the HTTP transport (>= 16 chars, no whitespace; a weaker value refuses to start). When set, /mcp requires 'Authorization: Bearer ' or answers 401. Compared constant-time, never logged." }, { "name": "PKINATIVE_MCP_PASSWORD", "isSecret": true, "isRequired": false, "description": "Operator-side password of the encrypted PKCS#8 key or PKCS#12 file the tools open (keeps the secret out of the model transcript). Exclusive with the per-call password input (both at once is VALIDATION_ERROR). Never logged; only its presence is reported at startup." }, { "name": "PKINATIVE_MCP_AT", "isSecret": false, "isRequired": false, "description": "Pinned instant (ISO 8601 or epoch milliseconds) every omitted at / notBefore / signingTime falls back to, for reproducible verdicts and artefacts. Unset: the wall clock (a clock-dependent result is never cached). An invalid value refuses to start." }, { "name": "PKINATIVE_MCP_MAX_INPUT_BYTES", "isSecret": false, "isRequired": false, "description": "Operator ceiling for limits.maxInputBytes and the decoded size of one PKI object (default 67108864 = 64 MiB, the engine default). Integer >= 1024, read once at startup; an invalid value refuses to start. A per-call value above it is refused with LIMIT_CEILING_EXCEEDED." }, { "name": "PKINATIVE_MCP_MAX_KDF_ITERATIONS", "isSecret": false, "isRequired": false, "description": "Operator ceiling for limits.maxKdfIterations and limits.maxPkcs12KdfIterations (default 10000000, the engine default): the CPU bound of a hostile PBES2 key or PKCS#12 file. Integer >= 1, read once at startup; an invalid value refuses to start." }, { "name": "PKINATIVE_MCP_MAX_PATHS_EXPLORED", "isSecret": false, "isRequired": false, "description": "Operator ceiling for limits.maxPathsExplored (default 1000, the engine default): the RFC 5280 section 6 path-building work bound. Integer >= 1, read once at startup; an invalid value refuses to start." } ], "category": "agent-gov", "subcategory": "trust", "company": "", "categoryAuto": true, "checks": [ { "id": "source-linked", "label": "Source repository linked", "result": "pass", "detail": "https://github.com/Nizoka/pkinative-mcp" }, { "id": "version-pinned", "label": "Version pinned", "result": "pass", "detail": "Every package has an explicit version" }, { "id": "secrets-requested", "label": "Secrets requested", "result": "info", "detail": "Asks for 2 secrets: PKINATIVE_MCP_HTTP_TOKEN, PKINATIVE_MCP_PASSWORD" }, { "id": "known-registry", "label": "Known package registry", "result": "pass", "detail": "All packages come from npm, PyPI, OCI, NuGet or MCPB" }, { "id": "namespace", "label": "Namespace ownership", "result": "info", "detail": "Name verified via GitHub account Nizoka" }, { "id": "meta-text", "label": "Registry text aimed at the AI", "result": "pass", "detail": "Description and settings contain no hidden characters or instructions to the AI" }, { "id": "install-scripts", "label": "Install scripts", "result": "pass", "detail": "pkinative-mcp@1.0.0 runs nothing at install" }, { "id": "code-flags", "label": "Code red flags", "result": "pass", "detail": "Read 165 files in pkinative-mcp@1.0.0: no obfuscation, encoded execution, credential reads or data-collection endpoints found" }, { "id": "ai-text", "label": "Text aimed at the AI", "result": "pass", "detail": "No hidden characters or instructions to the AI in 165 files, including comments and the README" } ], "scannedAt": "2026-10-29", "level": "Scanned", "install": [ { "label": "Claude Desktop (npm)", "kind": "claude_desktop_json", "text": "{\n \"mcpServers\": {\n \"pkinative-mcp\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"pkinative-mcp@1.0.0\"\n ]\n }\n }\n}" } ], "curated": true, "stars": 0, "archived": false, "pushedAt": "2026-10-26T01:37:57Z", "health": { "score": 50, "parts": { "popularity": 0.1810098516544866, "activity": 0.6, "issues": null, "security": 1 }, "fail": 0, "warn": 0, "raw": { "stars": 0, "forks": 0, "downloads": 82, "hn": null, "issuesOpen": 0, "issuesClosed": 0, "prsMerged": 1, "commits90": 0, "release": "2026-10-17T11:03:53Z", "pushed": "2026-10-26T01:37:57Z", "growth": null, "growthDays": null, "archived": false }, "at": "2026-10-31T07:35:52.424Z" } }