Skip to content
AdminKit

Developers & SaaS teams

Check your site's certificate, headers, and MCP endpoints before a user does

AdminKit's free tools let developers and SaaS teams check a site's TLS certificate expiry, missing HTTP security headers, and whether an MCP endpoint is reachable without authentication today, since these are exactly the kind of quiet misconfigurations that sit unnoticed until a certificate expires in production or an endpoint gets found by someone who wasn't supposed to reach it, with a scriptable Check API for CI/CD planned for later.

Updated October 30, 2026

At a glance

Live
Segment: Developers & SaaS teams
Check a host’s TLS certificate, expiry, and negotiated protocol — a real handshake, run live, so an expiring certificate shows up before a visitor’s browser throws a warning.
Check which HTTP security headers a site sends — see what’s present, what’s missing, and the actual value of each header that is set.
Check if an MCP endpoint is reachable without authentication — confirms your server isn’t callable by anyone who finds it.

The problem

A small developer or SaaS team is usually responsible for a production TLS certificate, a set of HTTP response headers, and increasingly an MCP server exposing tools to an AI agent, without anyone specifically owning “check the external perimeter” as a job. In practice, that means these things get checked once at launch, if at all, and then not revisited until something breaks — a certificate expires in the middle of a business day, or a security scanner (or a less friendly visitor) notices a header that was never set.

MCP servers add a newer version of the same problem. It’s easy to stand one up without authentication during prototyping, intending to add it before launch, and then ship it that way because nothing forced a second look. A public MCP server with no auth can be called by anyone who finds it, not just the agent it was built for.

None of this requires a security team to catch; it requires a check that runs before the thing that would otherwise surface it the hard way — a browser warning, an outage, or an unauthenticated caller finding an endpoint first.

Huy Nguyen (David), Founder and CEO of Netbase JSC

Talk to an expert

Huy Nguyen (David), Founder & CEO, Netbase JSC

Ask how AdminKit fits developers & saas teams — setup, timeline, or pricing.

WhatsApp +84 937 869 689 [email protected]

What you can do for free today

For certificate expiry specifically, how to read a TLS/SSL certificate check result walks through the chain, expiry countdown and protocol fields, and HSTS and HSTS preload explained covers one of the headers worth getting right before launch. If you want to see how the TLS check compares to a deeper scanner, see AdminKit vs Qualys SSL Labs.

What AdminKit will add

AdminKit’s Check API is in early access and development, aimed at letting developers wire these same checks into CI/CD pipelines and internal tooling instead of running them one at a time through the website. There’s no dashboard or scheduled monitoring to point to today — the honest status is that each free tool above is a point-in-time check you run yourself, and the Check API is the first step toward running them automatically as part of a build or deploy.

For now, the practical path is to run the free checks above before a launch or a deploy that touches TLS, headers, or an MCP endpoint, and to treat the Check API as something to evaluate once it’s further along, rather than something to build an automated pipeline around today.

This page is general guidance, not a security audit of your specific network — see our disclaimer for what AdminKit's guidance does and does not commit to.

Frequently asked questions

How would we normally find out our TLS certificate is about to expire?

Often from a browser warning a visitor reports, or an outage, rather than from anything that checked ahead of time. The ssl-check tool shows the expiry date and negotiated protocol for any host today, so it can be checked before that happens.

Can AdminKit run these checks automatically in our CI/CD pipeline?

Not yet in an automated, scriptable way; today each check runs one at a time through the website. A Check API for wiring checks into CI/CD and internal tooling is in early access and development, not available to call yet.

What does 'missing security headers' actually mean for us?

It means a response is missing recommended protections such as a Content-Security-Policy or HSTS header, which a browser would otherwise enforce automatically. The http-headers tool shows which recommended headers are present or missing, and the actual value of each one that is present, so you can judge the real policy, not just whether a header exists.

We expose an MCP server for our product's AI features — what should we check?

Whether it's reachable without authentication. The mcp-check tool sends a real initialize request and checks whether the server requires auth before listing tools, the same thing an attacker scanning for exposed MCP endpoints would do, without ever calling a tool itself.

Is there a dashboard that watches our certificates and headers continuously?

No, that's not built yet. Today's free tools are a point-in-time check you run yourself; continuous, scripted monitoring is part of what the planned Check API is meant to enable, not something available today.

Sources

Related

Want AdminKit set up for you?

Tell us about your setup — we will follow up about early access and, if you need it, expert help.

Get early access See all solutions

How AdminKit works with you

  • Delivered remotely — Netbase JSC, the company behind AdminKit, has worked with clients in 80 countries.
  • Contracts and invoices are issued by Netbase JSC; payment goes to the company by bank transfer to Netbase JSC's company account or PayPal Business.
  • Talk to the CEO, Huy Nguyen (David), directly on WhatsApp or by email at [email protected].