MCP server

Connect a client

claude mcp add --transport http ecdsa https://ecdsa.com/api/mcp
claude mcp add --transport http ecdsa --scope project https://ecdsa.com/api/mcp

{
  "mcpServers": {
    "ecdsa": {
      "type": "http",
      "url": "https://ecdsa.com/api/mcp"
    }
  }
}

claude mcp add --transport http ecdsa https://ecdsa.com/api/mcp \
  --header "Authorization: Bearer ecdsa_live_…"

{
  "mcpServers": {
    "ecdsa": {
      "url": "https://ecdsa.com/api/mcp"
    }
  }
}

{
  "mcpServers": {
    "ecdsa": {
      "url": "https://ecdsa.com/api/mcp",
      "headers": {
        "Authorization": "Bearer ${env:ECDSA_API_KEY}"
      }
    }
  }
}

{
  "servers": {
    "ecdsa": {
      "type": "http",
      "url": "https://ecdsa.com/api/mcp"
    }
  }
}

code --add-mcp '{"name":"ecdsa","type":"http","url":"https://ecdsa.com/api/mcp"}'

{
  "inputs": [
    {
      "type": "promptString",
      "id": "ecdsa-api-key",
      "description": "ecdsa.com API key",
      "password": true
    }
  ],
  "servers": {
    "ecdsa": {
      "type": "http",
      "url": "https://ecdsa.com/api/mcp",
      "headers": {
        "Authorization": "Bearer ${input:ecdsa-api-key}"
      }
    }
  }
}

{
  "mcpServers": {
    "ecdsa": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://ecdsa.com/api/mcp"
      ]
    }
  }
}

Tools

The server lists 11 tools, read here from its own registry — the same list tools/list returns.

• verify_signatureVerify an ECDSA signature

  Verifies a signature over a message (or a precomputed digest) against a public key. Curves: P-256, P-384, P-521, secp256k1. Signature formats auto-detected: ASN.1 DER or raw r‖s, in hex, base64 or base64url. Public key formats: PEM SPKI ("PUBLIC KEY"), EC JWK, or a bare SEC1 point in hex/base64. A signature that simply does not verify returns valid: false with HTTP 200; only unparseable input yields 400.

  Read-onlyScope api · 1 unit of quota per call with a keyPOST/v1/verify

• convert_signatureConvert a signature between DER and raw r‖s

  Decodes a signature (DER or raw, auto-detected; hex/base64/base64url) and returns both encodings plus r, s and the high-S flag. normalize: "low-s" replaces a high-S s with n − s. Warnings list DER canonicality deviations (BER lengths, missing 0x00 pads, trailing bytes) and curve-ambiguity notes.

  Read-onlyScope api · 1 unit of quota per call with a keyPOST/v1/convert

• decode_jwtDecode a JWT (no signature check)

  Decodes a compact JWS token: header, payload, enriched exp/iat/nbf time claims and a classification of the algorithm. The signature is NOT verified — the response carries verified: false explicitly. Use /v1/jwt/verify to check ES* signatures.

  Read-onlyScope api · 1 unit of quota per call with a keyPOST/v1/jwt/decode

• verify_jwtVerify an ES256/ES384/ES512 JWT signature

  Verifies the token's ECDSA signature against a public key (PEM SPKI, EC JWK, or bare SEC1 point). Non-ECDSA algorithms (HS*, RS*, PS*, EdDSA, ES256K, none) return 400 with code unsupported_algorithm. A signature that fails verification returns valid: false with HTTP 200. Time claims are noted in explanations but do not affect valid.

  Read-onlyScope api · 1 unit of quota per call with a keyPOST/v1/jwt/verify

• decode_certificateDecode an X.509 certificate or chain

  Accepts PEM (one or more CERTIFICATE blocks — a whole chain works) or a single DER certificate as base64/hex. Returns a structured summary per certificate — subject, issuer, validity, key and signature algorithms, SAN, key usage, fingerprint — plus assessments (weak hashes, expiry, CA/Browser Forum lifetime limits, post-quantum notes).

  Read-onlyScope api · 1 unit of quota per call with a keyPOST/v1/cert/decode

• get_domain_healthTLS signature-health grade for a domain

  Connects to the domain on port 443, examines the served certificate chain, key and signature algorithms, protocol versions and lifetimes, and returns a letter grade with findings, plus the leaf certificate's expiry and key algorithm as structured fields. Results are cached for 1 hour. Only public DNS hostnames are accepted — IP addresses, single-label names and private/reserved addresses are refused. Extra rate limit: 10 requests/minute per IP. A fresh scan can take several seconds.

  Read-only, connects to the host you give itScope scan · 5 units of quota per call with a keyGET/v1/health/{domain}

• explain_errorExplain an error message

  Looks up an error message from a cryptography, TLS, certificate, JWT, SSH, code-signing or Web3 library in the ecdsa.com error catalog (299 messages, reproduced against the libraries that print them) and returns what it means, its likely causes and step-by-step fixes with code. Paste the message as printed; a whole log excerpt or stack trace works too. Never include private keys or secrets: input containing a private key is refused.

  Read-onlyScope api · 1 unit of quota per call with a key

• lookup_oidLook up an object identifier (OID)

  Resolves an ASN.1 object identifier used in X.509 certificates, CSRs, CMS/PKCS#7, PKCS#8/#12 and post-quantum PKI against the ecdsa.com OID catalog (938 identifiers: curated, IANA SMI arcs, CCADB EV policies). Accepts a dotted OID, its DER encoding in hex, or a name such as prime256v1 or ecdsa-with-SHA256; returns the name, aliases, category, DER encoding, OpenSSL names and references. Unknown OIDs still get their DER encoding and nearest known ancestor.

  Read-onlyScope api · 1 unit of quota per call with a key

• lookup_algorithmLook up a cryptographic algorithm identifier

  Resolves an algorithm identifier against the IANA registries for JOSE and COSE (algorithms, key types, curves), TLS (cipher suites, signature schemes, supported groups), SSH, DNSSEC and HPKE: what it is, its code point, recommendation status, parameters (curve, hash, key size), names in OpenSSL/GnuTLS/NSS and the defining RFCs. Accepts names (ES256, TLS_AES_128_GCM_SHA256, ECDHE-ECDSA-AES128-GCM-SHA256, ecdsa-sha2-nistp256, X25519MLKEM768) or code points (-7, 0x0403, 13); `registry` narrows the search.

  Read-onlyScope api · 1 unit of quota per call with a key

• lookup_curveLook up an elliptic curve

  Describes a named elliptic curve from the ecdsa.com curve catalog (54 curves, each checked arithmetically): its names in every standard (SEC 2, NIST, ANSI X9.62, JOSE/COSE, SSH, TLS), OIDs with DER encoding, domain parameters, security level, status (recommended to broken) and where it is used. Accepts any spelling — P-256, secp256r1, prime256v1, nistp256, X25519, Ed25519, brainpoolP256r1 — or the curve's OID.

  Read-onlyScope api · 1 unit of quota per call with a key

• glossaryDefine a cryptography term

  Defines a term from the ecdsa.com glossary (302 terms on signatures, JOSE, PKI, TLS, email authentication, Web3, post-quantum cryptography, identity and supply chain): a one-sentence definition, the explanation from the term's page, references to the standards and related terms, tools and errors.

  Read-onlyScope api · 1 unit of quota per call with a key

Limits

Anonymous calls share the REST API’s budget: 60 requests per minute per IP, plus 10 per minute for get_domain_health, whose real scans also draw on the shared scan budgets. Hosted clients — claude.ai and Claude Desktop connectors — call from Anthropic’s cloud, so their users count against the same per-IP budget and heavy use sees rate_limited.

Private keys

Arguments that contain private-key material — a PEM PRIVATE KEY block, an OpenSSH, SSH2 or PuTTY key, a JWK with “d” — are refused with private_key_rejected before anything else happens, exactly as on the REST API. Arguments are never logged.