Detent Point
Plans & pricing
The four read-only audit tools are free, no license, no payment, live today on the PowerShell Gallery. The three tools that change a binding need a paid tier. A purchase issues and emails your license automatically.
No license needed.
- The four read-only audit tools (full list below)
- Runs locally, stdio, PowerShell
- Works with Claude Code or any MCP client
- No license key, ever
For one person.
- Adds the two binding tools, for SQL Server and Reporting Services (full list below)
- Licensed for one person
- Covers 2 servers at a time
- Everything in Free
For a team.
- Adds the full reserve → bind → restart → verify orchestrator (full list below)
- Licensed for your team
- Covers 25 servers at a time
- Everything in Starter
Every tool, unlimited servers.
- Same tool access as Professional — the difference is capacity
- Covers unlimited servers
- Everything in Professional
Starter covers 2 servers at a time and Professional covers 25; Enterprise covers unlimited servers. The count is servers in active use — only what you are currently managing. Re-running against a server already under management never takes a second place, and a server that goes unused for 90 days drops off the count on its own, no action needed.
Free, read-only: inventory and check what’s bound today. Nothing here changes anything.
| Tool | What it does |
|---|---|
get_rs_http_config | Inventory a Reporting Services HTTPS surface: reserved URLs, SSL bindings, registered URLs |
test_rs_https_endpoint | Confirm an RS endpoint actually serves over HTTPS, GETs it, validates the served cert’s SAN and thumbprint |
test_sql_cert_binding | Report the TLS cert bound to a SQL Server instance from the registry: thumbprint, ForceEncryption, expiry |
test_rs_cert_binding | Report the TLS cert bound to an RS endpoint via WMI |
Paid, state-changing: these bind, reserve, and restart. Called without a license, each returns a clear message saying so instead of a bare error.
| Tool | Tier | What it does |
|---|---|---|
set_sql_cert_binding | Starter+ | Bind a cert to a SQL Server instance via the registry, restart to apply |
set_rs_cert_binding | Starter+ | Bind a cert to an RS endpoint via WMI |
install_rs_connection_certificate | Professional+ | Full orchestration: reserve URL, bind, restart, then verify it actually serves |
SqlCertForge acts on your SQL Server or Reporting Services host, locally or on a remote node over -Node / -Credential.
It runs on Windows PowerShell 5.1 or PowerShell 7 — either is enough. Windows Server ships with 5.1, so a locked-down SQL host needs no new PowerShell install. Everything it talks to is inside your network — your certificate authority, your SQL Server and Reporting Services hosts, your own report URLs — and it makes no outbound internet calls at run time. Licenses verify offline: no license-server call, no phone-home, no telemetry.
- Point it at your instance: a SQL Server instance name, or an RS/PBIRS install
- It binds the cert: a registry write for SQL’s
SuperSocketNetLib, or a WMI call and URL reservation for RS, then restarts the service that has to pick it up - It checks its own work: hits the endpoint over HTTPS and reads back the served certificate’s thumbprint, rather than trusting that the bind command returned success
PowerShell, stdio, local only
The four read-only tools, running as a local PowerShell MCP server. No license, no payment, no network calls beyond the SQL/RS host you point it at.
Install-Module SqlCertForge.Audit — the module ships the four audit commands and the MCP server, and runs on Windows PowerShell 5.1 or PowerShell 7.
C#, stdio or hosted
Same read-only tools stay free; the three binding tools need a license to run. Runs locally over stdio, or hosted for a team.
dotnet tool install --global DetentPoint.SqlCertForge.Mcp — then save the .lic emailed after purchase and point SQLCERTFORGE_LICENSE_FILE at it.
SqlCertForge binds the TLS certificate on each Always On replica — the same per-instance operation it runs on a standalone server. Verified live against a two-node synchronous-commit availability group: encrypted connections through the listener kept working across a manual failover. It does not build the availability group or create the listener; point it at replicas that already exist.
129 of 132 Pester tests passing, 3 skipped because they need a lab node (13 test files covering the underlying cert-binding logic). 303 of 303 xUnit tests passing (the C# MCP layer: tier-to-tool mapping, the license gate including real RSA sign/verify/tamper/expiry cases, and Stripe webhook signature verification). All seven tools have been exercised live against real SQL Server 2022, SSRS, and Power BI Report Server, with certificate rotation checked across four nodes.
Every command has a reference page with six views — written for management, practitioners, and learners, plus software-approval, dependency, and compliance lenses. The same content ships as a single adoption guide that walks all six phases of putting TLS on SQL Server and Reporting Services.
Command reference → · Adoption guide → · The guide as a PDF →
SqlCertForge.MCP is the second in a line of single-purpose MCP servers, after ClusterValidator.MCP and before PesterForge.MCP.