Acceptable use policy

Use the services for what they’re for

Check and monitor the certificates and domains you run or care about, check that your scheduled jobs run, make charts from your data, and read the guides. That covers almost everyone. This policy is part of our terms of service.

Connecting an AI assistant

You may connect an AI assistant or another MCP client to our MCP server, https://boringutils.com/api/mcp, and use it as its documentation describes, within the limits stated there. This covers that one endpoint, not the rest of our API, and the rules below still apply to it.

Pinging your scheduled jobs

Each scheduled job you add gets its own link, https://boringutils.com/api/beat/…. Your job may call it each time it runs, from cron, a systemd timer, GitHub Actions or anything else. This covers your own jobs’ links, called as those jobs run, and the rules below still apply to them.

Don’t

• Automate bulk checks or scrape the API. Our API exists to serve the website, not as a public service; the MCP server and your own jobs’ links, above, are the only parts you may call directly. Don’t script requests to the rest of it, run checks in bulk through any of it, or harvest results. Using the pages by hand is fine, including the bulk SSL checker’s 10 domains at a time. If you need to check many domains, write to us.
• Ping job links that aren’t yours. Only call the link of a job you added, when that job runs. Don’t call someone else’s job link, and don’t flood any link with calls far more often than its job runs.
• Point the checker at private networks. Don’t try to make our checker connect to private, internal, loopback, link-local or other non-public addresses, whether directly or through DNS tricks such as rebinding, and don’t try to use it to reach anything other than a public site’s TLS certificate.
• Attack or overload the services. No probing for vulnerabilities without permission, denial of service, getting around rate limits, or interfering with other people’s use.
• Get around the free limits. Don’t use many email addresses or other workarounds to monitor more domains or jobs than the free plan allows.
• Sign up other people. Only use email addresses that are yours or that you are allowed to sign up.
• Put illegal content in charts. Don’t use Chart Link to make or share charts that infringe someone’s rights, defame or harass anyone, incite violence, or include personal data you have no right to use.
• Misrepresent results. Don’t present a Boring Utils check as a security audit, a certification or a guarantee. It is a record of what our checker saw at one moment.

What happens if this policy is broken

We may rate-limit or block requests, remove watched domains, unsubscribe addresses, or suspend access, with or without warning depending on the harm involved. Where the law requires it, or where someone is at risk, we may report illegal activity to the authorities.

If our checker shows up in your logs

When someone checks your domain with Expiry Watch, our checker opens a TLS connection on port 443 to each of your site’s public addresses (up to 4 IPv4 and 4 IPv6), reads the certificate, and closes the connection. For a watched domain it also looks up public DNS records, through the DNS resolvers our server uses. It doesn’t request pages, follow redirects, submit forms or test for vulnerabilities. If you have a concern about checks of your domain, email hello@boringutils.com.

Report abuse

If you see the services being misused, tell us at hello@boringutils.com with as much detail as you can. We read every report.