Cryptographic Posture Management — discover, grade & remediate your whole cryptographic estate
Sovereign Certificate Authority for enterprise-grade certificate issuance & management
Certificate Lifecycle Management, discovery, governance & automation
DNS-agnostic Domain Control Validation, ready for 47-day TLS certificates
The Model Context Protocol (MCP) connects AI assistants to enterprise tools. The Horizon MCP server puts your certificate lifecycle manager behind that protocol, so teams can query, operate and configure their CLM in plain language — from the tools they already use, within the RBAC permissions they already have, and inside the same approval workflows and audit trail.
The Model Context Protocol (MCP) is an open standard that connects large language models to enterprise tools in a structured, permissioned way. The Horizon MCP server is an open-source implementation that exposes a certificate lifecycle manager (CLM) over MCP: an AI assistant can search the certificate estate, operate the request pipeline, and configure the platform, all in natural language.
The point is not to bolt a chatbot onto a console. It is to let a security team drive the CLM through the assistant they already use, authenticated as a normal CLM client, bounded by the connected account's RBAC, and subject to the same approval workflows and audit trail as any other client. This guide covers what that looks like in practice, the capability model, and the governance guarantees that keep it safe.
Certificate lifecycle management platforms are powerful and, for most teams, under-used. The query language, the computation and auto-validation rules, the datasources, the triggers and discovery campaigns — the parts that make a CLM more than a spreadsheet — are exactly the parts people avoid because the learning curve is steep. The Model Context Protocol offers a different front door: describe what you want in plain language and let an AI assistant translate it into the platform's own operations.
This guide explains how the Horizon MCP server exposes a CLM over MCP, what an operator can actually do through a conversation, and — the part that matters for anyone responsible for the estate — why doing it this way does not loosen a single control.
The Model Context Protocol is an open standard that lets a large language model call enterprise tools through a well-defined, permissioned interface instead of screen-scraping a UI or holding raw API keys in a prompt. A CLM is an unusually good fit: its operations are already structured (query, enroll, renew, revoke, configure), already permissioned by RBAC, and already audited. MCP simply gives an assistant a typed, governed way to invoke them.
Because the server speaks a standard, it is not tied to one assistant. It runs locally at an operator's desk or hosted for a team, installs as a single command or a prebuilt binary, and works with any MCP-compatible client. The transport is open; the tools behind it are the CLM's own.
The capability set is not a read-only demo. It mirrors the platform's real operations, grouped into four pillars.
Search and aggregate certificates, requests and events across the whole estate. Plain-language questions are translated into the CLM's query language, validated and executed — no syntax to learn — and useful queries can be saved and reused, in chat or in the CLM interface.
Enroll, renew, revoke, recover and update certificates through the same request pipeline as the web registration authority. Review, approve, deny or cancel pending requests conversationally, and download certificates in the format you need.
Reach the parts teams usually call in Professional Services for — computation rules, auto-validation rules, datasources (LDAP, DNS, REST), triggers and discovery campaigns — and build dashboards by describing what you want to see. Datasource flows, triggers and computation rules can be dry-run in conversation before touching production.
Decode X.509 certificates, CSRs, CRLs, OCSP responses and RFC 3161 timestamps on the spot; get a rule-by-rule explanation of why a certificate scored the grade it did, from ANSSI to CA/Browser Forum policies; search product and API documentation matched to your CLM version; and export reports and CSVs of what you find.
The reasonable first reaction to "let an AI operate my PKI" is caution, and the design answers it directly: the assistant is just another CLM client, with no special powers.
The result is a CLM you can talk to without giving anything up: the estate becomes queryable and operable in natural language, but every guardrail — authentication, RBAC, approvals, audit — stays exactly where it was. For teams already investing in automated certificate management, MCP is the conversational layer on top of that automation rather than a replacement for it.
The assistant connects with an API key or an mTLS client certificate, in local mode as in hosted mode. No ambient credentials, no shared superuser.
It can only see and do what the connected account's permissions allow, and every action lands in the CLM audit trail. Scope the account read-only and conversational query is all it can ever do.
Sensitive operations keep going through the same approval workflows as always; mutating tools ask for confirmation before acting, and destructive ones require explicit validation against the target object.
