How christoph865/certops-agent works
CertOps Agent manages certificate and secret lifecycle through a JWT-secured Flask API, with an MCP server exposing API operations to LLM agents. Certificate operations use Key Vault for the live certificate and SQLAlchemy-backed metadata; audit events are mirrored to Azure Storage Tables. A separate daily scan refreshes expiry status and records a summary. The README documents secret management and Entra ID authentication, but their implementation details were not sampled, so those links are shown as unverified where appropriate.
Main entry points: certificates.py Certificate API · certificate_service.py Certificate service · audit_service.py Audit service · secrets.py Secret API
Components 20
API and access
- Flask application
app/__init__.py - Certificate API
app/api/certificates.py - Secret API
app/api/secrets.py - Health API
app/api/health.py - JWT access
app/core/extensions.py
Certificate lifecycle
- Certificate service
app/services/certificate_service.py - Certificate metadata
app/models/certificate.py - X.509 utilities
app/services/x509_utils.py
Secret lifecycle
- Secret service
app/services/secret_service.py - Key Vault integration
app/services/key_vault_service.py
Persistence and audit
- SQL database
- Audit service
app/services/audit_service.py - Audit records
app/models/audit_log.py - Storage Tables integration
app/services/storage_table_service.py
Agent and batch operations
- MCP tools
mcp_server/server.py - Expiry scan
app/jobs/expiry_scan.py
Other components
- LLM agent
- Entra ID
- Azure Key Vault
- Azure Storage Tables
Connections 24
- LLM agent → MCP tools: requests tools
README.md - MCP tools → Certificate API: calls API
README.md - MCP tools → Secret API: calls API
README.md - Flask application → Certificate API: registers route
app/__init__.py - Flask application → Secret API: registers route
app/__init__.py - Flask application → Health API: registers route
app/__init__.py - Certificate API → JWT access: requires JWT
app/api/certificates.py - Secret API → JWT access: requires JWT
- Entra ID → JWT access: provides identity
- Certificate API → Certificate service: calls
app/api/certificates.py - Certificate API → Audit service: logs rotation
app/api/certificates.py - Certificate API → Certificate metadata: loads record
app/api/certificates.py - Certificate service → Certificate metadata: queries and updates
app/services/certificate_service.py - Certificate service → Key Vault integration: rotates certificate
app/services/certificate_service.py - Key Vault integration → Azure Key Vault: reads and rotates
app/services/key_vault_service.py - Certificate service → SQL database: commits metadata
app/services/certificate_service.py - Audit service → Audit records: creates record
app/services/audit_service.py - Audit service → Storage Tables integration: appends event
app/services/audit_service.py - Audit service → SQL database: commits event
app/services/audit_service.py - Storage Tables integration → Azure Storage Tables: writes event
app/services/storage_table_service.py - Expiry scan → Certificate service: refreshes status
app/jobs/expiry_scan.py - Expiry scan → Audit service: records summary
app/jobs/expiry_scan.py - Secret API → Secret service: delegates operations
- Secret service → Key Vault integration: uses vault