Automate Keysmith with the API, MCP and project links

Everything Keysmith runs on the server is a normal usefulweb.site tool. On the Keysmith host the API, the MCP server and the OpenAPI document list exactly these fourteen tools.

Run a tool

curl -s https://keysmith.usefulweb.site/api/v1/tools/tls-cipher-suite-simulator/calculate \
  -H 'content-type: application/json' -d '{"serverPreset":"modern"}'

The summary of the answer reads Mozilla modern (guidelines 6.0): 14 of 36 simulated clients connect, 22 fail (Android 2.3.7, Android 4.4.2, Android 5.0.0, …); grade A+ on our scale. result.results holds one handshake per client — the same data Keysmith's Compare tab uses.

Through MCP the tools are called x509_certificate_inspector, rsa_ecc_key_inspector, tls_cipher_suite_simulator and so on. Rate limits are the same as on the main site; heavier tools (hashing files, key derivation, file encryption) allow about six calls per minute and answer HTTP 429 with retry-after when exceeded.

Remember that server tools receive their inputs. Agents should send public material (certificates, public keys, TLS settings) and test values only.

Build a project

A project is JSON with format: "keysmith-project", version: 1, a name and items. Each item has an id, a kind and inputs:

{
  "format": "keysmith-project",
  "version": 1,
  "name": "Nightly certificate check",
  "settings": { "serverPolicy": "ask", "expiryWarnDays": 45, "reminderLeadDays": 21 },
  "items": [
    { "id": "i1", "kind": "certificate", "name": "www", "owner": "Web team", "inputs": { "pem": "-----BEGIN CERTIFICATE-----\n…" } },
    { "id": "i2", "kind": "tls", "name": "Load balancer", "inputs": { "serverPreset": "intermediate" } },
    { "id": "i3", "kind": "key", "name": "Deploy key", "reviewBy": "2027-01-15", "inputs": { "key": "ssh-ed25519 AAAA… deploy@ci" } }
  ]
}

Kinds: certificate, key, tls, checksum, password, kdf, recipe, sharing, passkey, encryption, emoji. Unknown fields fall back to defaults; secret fields are only read from secrets when an item sets keepSecrets: true.

An agent may also add runs — for example the results of its own API calls — with toolId, at, where, ok, summary, metrics, findings (severity + text) and a digest. Keysmith then shows them on the dashboard and in the history immediately.

Open it in the workspace

Encode the JSON as Base64URL and append it: https://keysmith.usefulweb.site/app#project=<base64url>. The link opens the project, saves it in the browser and removes the fragment from the address bar. File → Copy share link… creates the same kind of link from the workspace. Long projects make long links; for big inventories send the .keysmith.json file instead (File → Open project file…).

Template links work the same way: /app#template=web-shop-audit opens a template and runs its public items.