NHI Claude Plugin
A Claude Code plugin for the NHI PKI platform — manage certificates, realms, issuing policies, and trust stores directly from your editor via MCP.
Requirements
| Tool | Version | Install |
|---|
| Claude Code | ≥ 2.1 | npm install -g @anthropic-ai/claude-code |
| Git | any | brew install git |
| Python 3 | ≥ 3.8 | pre-installed on macOS |
| You will also need: | | |
- An NHI backend endpoint URL —
https://your-domain/mcp/<portal_id>
- An NHI service key for authentication
Installation
Step 1 — Clone the repository
git clone https://github.com/Aeyrix-Inc/nhi-claude-plugin ~/nhi-claude-plugin
You can clone to any directory. The path used here (~/nhi-claude-plugin) is the default.
Step 2 — Register as a local marketplace
claude plugin marketplace add ~/nhi-claude-plugin
Expected output:
Adding marketplace...
✔ Successfully added marketplace: nhi-claude-plugin
Step 3 — Install the plugin
claude plugin install nhi@nhi-claude-plugin
Expected output:
Installing plugin "nhi@nhi-claude-plugin"...
✔ Successfully installed plugin: nhi@nhi-claude-plugin (scope: user)
Step 4 — Verify
claude plugin list
Expected output:
❯ nhi@nhi-claude-plugin
Version: 1.0.1
Scope: user
Status: ✔ enabled
Step 5 — First launch
Start Claude Code in any project:
claude
The first time an NHI tool is called, Claude Code will prompt for credentials — once only, then both values are saved to your macOS Keychain:
NHI MCP endpoint URL (e.g. https://your-domain/mcp/<portal_id>)
> https://your-domain/mcp/your-portal-id
NHI service key for authentication
> •••••••••••••••••••••••••••••••• (input is masked)
Usage
Commands
Type any of these directly in Claude Code:
| Command | Description |
|---|
/cert-audit | Full certificate inventory — status, realm, expiry |
/expiring-certs | Certificates expiring in the next 30 days |
/expiring-certs 60 | Certificates expiring in the next N days |
/compliance-report | PKI compliance report — realms, policies, trust stores, health |
/connection | Show current MCP endpoint and API key configuration |
/connection test | Verify connectivity to the current endpoint |
/connection change | Reset credentials and switch to a new endpoint or key |
Skill
/nhi list List all certificates
/nhi show <history_id> Full certificate details
/nhi request Issue a new certificate (guided)
/nhi renew <history_id> Renew a certificate
/nhi reissue <history_id> Reissue with a new key
/nhi revoke <history_id> Revoke a certificate
/nhi retire <history_id> Retire a certificate
/nhi rollback <id> <version> Roll back to a previous version
/nhi export <id> <format> Export (pem / der / pkcs7 / pkcs12)
/nhi realms List all realms
/nhi realm <id> Realm details + policies
/nhi policies List all issuing policies
/nhi policy <id> Issuing policy details
/nhi trust-stores List all trust stores
/nhi trust-store <id> Trust store details + certificates
Connection
View, test, or change the current NHI MCP connection:
/connection Show current endpoint and auth config
/connection test Verify connectivity to the current endpoint
/connection change Reset credentials and switch to a new endpoint or key
To change the connection, /connection change will clear the cached credentials from the Keychain. The next MCP call will prompt for the new endpoint URL and service key.
You can also change manually:
claude mcp remove nhi -s user # clear cached credentials
claude mcp add-json nhi '{"type":"http","url":"${input:nhi_endpoint}","headers":{"Authorization":"Bearer ${input:nhi_service_key}"}}' --scope user # re-register
Agents
Use these in natural language:
Use the cert-analyst agent to show me certificate <name>
Use the policy-checker agent to review all trust stores
Plugin Management
| Action | Command |
|---|
| List installed plugins | claude plugin list |
| Update to latest version | claude plugin update nhi@nhi-claude-plugin |
| Disable (keep installed) | claude plugin disable nhi@nhi-claude-plugin |
| Re-enable | claude plugin enable nhi@nhi-claude-plugin |
| Uninstall | claude plugin uninstall nhi@nhi-claude-plugin |
| Reconfigure connection | claude plugin configure nhi@nhi-claude-plugin |
| Reset cached credentials | claude mcp remove nhi -s user then re-add (see /connection change) |
Updating
Pull the latest changes and update the installed plugin:
