// SCAN REPORT

PKI Studio MCP

28 tools. 6 can modify or destroy data without limits.

6 write tools that can modify data. Rate limits recommended.

Last updated: 2 Jul 2026

6 can modify or destroy data

22 read-only

28 tools total

Community server · catalogue entry verified 02/07/2026

How to control PKI Studio MCP ↓

TOOL MAP

What PKI Studio MCP exposes to your agents

Read (22) Write / Execute (6) Destructive / Financial (0)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

High Risk

The most dangerous PKI Studio MCP tools

Execute · Medium verify_key_pair This tool executes cryptographic operations (signing and verifying) using private and public key material. Write · Medium create_asn1_instance This is a Write operation because it constructs (creates) new cryptographic data structures (DER-encoded ASN.1 objects) from JSON specifications. Write · Medium create_csr This tool creates a new certificate signing request, which is a reversible operation (CSRs can be discarded or replaced). Write · Medium create_self_signed_certificate This tool creates (generates) a new X.509 certificate artifact, which is a reversible action—certificates can be discarded or regenerated.

6 of PKI Studio MCP's 28 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control PKI Studio MCP

PolicyLayer is an MCP gateway — it sits between your AI agents and PKI Studio MCP, and nothing reaches the server without passing your rules. These are the rules we recommend:

Rate limit write operations

{
  "create_asn1_instance": {
    "limits": [
      {
        "counter": "create_asn1_instance_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "asn1_node_value": {
    "limits": [
      {
        "counter": "asn1_node_value_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register PKI Studio MCP — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON PKI STUDIO →

Instant setup, no code required.

FULL CATALOGUE

All 28 PKI Studio MCP tools

EXECUTE 1 tools

Execute verify_key_pair Verify that a PKCS8 private key matches an SPKI public key by signing and verifying sample data.

WRITE 5 tools

Write create_asn1_instance Build DER bytes from JSON instance input and a selected type in a supported ASN.1 definition subset or Schema Write create_csr Create a PKCS10 certificate signing request from a PKCS8 private key, SPKI public key, and subject DN. Write create_self_signed_certificate Create a self-signed X.509 certificate from a PKCS8 private key, SPKI public key, and subject DN. Write generate_key_pair Generate a key pair and return the private key as PKCS8 DER and public key as SPKI DER. Write write_pkcs12 Create PKCS12/PFX data from one or more private keys and optional X.509 certificates.

READ 22 tools

Read asn1_node_value Return the decoded display value and raw value bytes for one parsed ASN.1 node. Read certificate_matches_key Check whether an X.509 certificate public key matches supplied public key bytes or a PKCS8 private key. Read decode_oid_value Decode ASN.1 OBJECT IDENTIFIER value bytes into dotted object identifier text. Read describe_node Describe a parsed ASN.1 node by node id. Read encode_oid Encode an object identifier string into ASN.1 OBJECT IDENTIFIER value bytes. Read extract_asn1_node Extract a parsed ASN.1 node and its subtree by node id as DER bytes. Read fetch_certificate_network_resources Fetch HTTP(S) CDP/AIA/OCSP-related resources discovered in an X.509 certificate. Parsing itself is local; this Read list_asn1_builder_features List the supported ASN.1 Instance Builder subset, JSON input shapes, and known limitations. Read list_asn1_definition_sifter_features List ASN.1 Definition Sifter tool scope, PKI profiles, and candidate report options. Read list_supported_key_algorithms List WebCrypto key pair algorithms supported by this runtime for key generation. Read normalize_asn1_input Decode DER, BER, PEM, HEX, or base64 input and return round-trip re-encoded ASN.1 bytes. Read parse_asn1 Parse ASN.1 DER, BER, PEM, HEX, or base64 text and return a JSON tree. Read parse_asn1_definition Parse a supported ASN.1 definition subset into ASN.1 Instance Builder Schema Model JSON and return defined typ Read parse_certificate Parse an X.509 certificate with CertGadgets and return its structure, details, and CDP/AIA/OCSP resource plans Read read_pkcs12 Read PKCS12/PFX data and return contained private keys, public keys, and certificates. Read recognize_key_material Recognize a PKCS8 private key or SPKI public key and return its key family, label, and capabilities. Read resolve_oid Resolve an object identifier using the OID names bundled with PkiStudioJS. Read sift_asn1_definition_candidates Rank ASN.1 definition candidates for ASN.1 data using custom ASN.1 definitions or the built-in PKI component c Read sift_pki_asn1_definition_candidates Rank PKI ASN.1 definition candidates using the built-in ASN.1 Definition Sifter PKI corpus and optional profil Read summarize_asn1 Parse ASN.1 input and return a compact summary of tags, OIDs, and top-level nodes. Read validate_asn1_instance Validate JSON instance input against a selected type in a supported ASN.1 definition subset or Schema Model JS Read validate_asn1_schema Validate a supported ASN.1 definition subset or ASN.1 Instance Builder Schema Model JSON and return schema dia

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about PKI Studio MCP

How do I prevent bulk modifications through PKI Studio MCP? +

The PKI Studio MCP server has 5 write tools including create_asn1_instance, create_csr, create_self_signed_certificate. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach PKI Studio MCP.

How many tools does the PKI Studio MCP server expose? +

28 tools across 3 categories: Execute, Read, Write. 22 are read-only. 6 can modify, create, or delete data.

How do I enforce a policy on PKI Studio MCP? +

Register the PKI Studio MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every PKI Studio MCP tool call.

Deterministic rules across all 28 PKI Studio MCP tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON PKI STUDIO →

Instant setup, no code required.

28 PKI Studio MCP tools catalogued and risk-classified — across an index of 43,000+ MCP servers.