Nhi

NHI Claude Plugin

A Claude Code plugin for the NHI PKI platform — manage certificates, realms, issuing policies, and trust stores directly from your editor via MCP.

---

Requirements

Tool	Version	Install
Claude Code	≥ 2.1	npm install -g @anthropic-ai/claude-code
Git	any	brew install git
Python 3	≥ 3.8	pre-installed on macOS
You will also need:

• An NHI backend endpoint URL — https://your-domain/mcp/<portal_id>
• An NHI service key for authentication

---

Installation

Step 1 — Clone the repository

git clone https://github.com/arkion-inc/nhi-claude-plugin ~/nhi-claude-plugin

You can clone to any directory. The path used here (~/nhi-claude-plugin) is the default.

---

Step 2 — Register as a local marketplace

claude plugin marketplace add ~/nhi-claude-plugin

Expected output:

Adding marketplace...
✔ Successfully added marketplace: nhi-claude-plugin

---

Step 3 — Install the plugin

claude plugin install nhi@nhi-claude-plugin

Expected output:

Installing plugin "nhi@nhi-claude-plugin"...
✔ Successfully installed plugin: nhi@nhi-claude-plugin (scope: user)

---

Step 4 — Verify

claude plugin list

Expected output:

❯ nhi@nhi-claude-plugin
    Version: 1.0.1
    Scope:   user
    Status:  ✔ enabled

---

Step 5 — First launch

Start Claude Code in any project:

claude

The first time an NHI tool is called, Claude Code will prompt for credentials — once only, then both values are saved to your macOS Keychain:

NHI MCP endpoint URL (e.g. https://your-domain/mcp/<portal_id>)
> https://your-domain/mcp/your-portal-id

NHI service key for authentication
> ••••••••••••••••••••••••••••••••  (input is masked)

---

Usage

Commands

Type any of these directly in Claude Code:

Command	Description
/cert-audit	Full certificate inventory — status, realm, expiry
/expiring-certs	Certificates expiring in the next 30 days
/expiring-certs 60	Certificates expiring in the next N days
/compliance-report	PKI compliance report — realms, policies, trust stores, health
/connection	Show current MCP endpoint and API key configuration
/connection test	Verify connectivity to the current endpoint
/connection change	Reset credentials and switch to a new endpoint or key

Skill

/nhi list                    List all certificates
/nhi show <history_id>       Full certificate details
/nhi request                 Issue a new certificate (guided)
/nhi renew <history_id>      Renew a certificate
/nhi reissue <history_id>    Reissue with a new key
/nhi revoke <history_id>     Revoke a certificate
/nhi retire <history_id>     Retire a certificate
/nhi rollback <id> <version> Roll back to a previous version
/nhi export <id> <format>    Export (pem / der / pkcs7 / pkcs12)
/nhi realms                  List all realms
/nhi realm <id>              Realm details + policies
/nhi policies                List all issuing policies
/nhi policy <id>             Issuing policy details
/nhi trust-stores            List all trust stores
/nhi trust-store <id>        Trust store details + certificates

Connection

View, test, or change the current NHI MCP connection:

/connection              Show current endpoint and auth config
/connection test         Verify connectivity to the current endpoint
/connection change       Reset credentials and switch to a new endpoint or key

To change the connection, /connection change will clear the cached credentials from the Keychain. The next MCP call will prompt for the new endpoint URL and service key.

You can also change manually:

claude mcp remove nhi -s user                      # clear cached credentials
claude mcp add-json nhi '{"type":"http","url":"${input:nhi_endpoint}","headers":{"Authorization":"Bearer ${input:nhi_service_key}"}}' --scope user  # re-register

Agents

Use these in natural language:

Use the cert-analyst agent to show me certificate <name>
Use the policy-checker agent to review all trust stores

---

Plugin Management

Action	Command
List installed plugins	claude plugin list
Update to latest version	claude plugin update nhi@nhi-claude-plugin
Disable (keep installed)	claude plugin disable nhi@nhi-claude-plugin
Re-enable	claude plugin enable nhi@nhi-claude-plugin
Uninstall	claude plugin uninstall nhi@nhi-claude-plugin
Reconfigure connection	claude plugin configure nhi@nhi-claude-plugin
Reset cached credentials	claude mcp remove nhi -s user then re-add (see /connection change)

---

Updating

Pull the latest changes and update the installed plugin:

git -C ~/nhi-claude-plugin pull
claude plugin update nhi@nhi-claude-plugin

Restart Claude Code to apply the update.

---

Automated Setup

An interactive setup script is included that runs all steps above and tests your MCP connection:

bash ~/nhi-claude-plugin/setup.sh

Or with a custom install path:

bash setup.sh /path/to/install

---

Structure

nhi-claude-plugin/
├── .claude-plugin/
│   └── marketplace.json        Marketplace manifest
├── plugins/
│   └── nhi/
│       ├── .claude-plugin/
│       │   └── plugin.json     Plugin metadata
│       ├── .mcp.json           MCP server config (endpoint + service key inputs)
│       ├── commands/
│       │   ├── cert-audit.md
│       │   ├── expiring-certs.md
│       │   ├── compliance-report.md
│       │   ├── connection.md
│       ├── agents/
│       │   ├── cert-analyst.md
│       │   └── policy-checker.md
│       ├── skills/
│       │   └── nhi/
│       │       └── SKILL.md
│       ├── scripts/
│       │   ├── credential-store.sh   Credential store (macOS/Linux)
│       │   └── credential-store.ps1  Credential store (Windows)
│       └── hooks/
│           └── hooks.json      Warns before destructive operations
├── setup.sh                    Automated install + connectivity test
└── README.md

---

Security

This plugin has been scanned with Cisco AI Defense Skill Scanner using all analyzers (static, bytecode, pipeline, behavioral, LLM) under strict policy.

Result: SAFE — 0 critical, 0 high, 0 medium findings.

---

Troubleshooting

Plugin not showing after install Restart Claude Code. Plugin changes require a restart to take effect.

MCP connection refused Ensure your NHI backend is running and the endpoint URL is reachable. Use /connection to check your current config, or test manually:

curl -s https://your-domain/mcp/your-portal-id \
  -H "Authorization: Bearer your-service-key" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}},"id":1}'

Wrong endpoint or expired service key Reset the cached credentials and re-enter them on next use:

claude mcp remove nhi -s user
claude mcp add-json nhi '{"type":"http","url":"${input:nhi_endpoint}","headers":{"Authorization":"Bearer ${input:nhi_service_key}"}}' --scope user

Marketplace already registered error Safe to ignore — it means the marketplace was registered in a previous install. The plugin will still install correctly.

---

License

This project is dual-licensed. You may use it under either:

• GNU General Public License v3.0 — for open-source and community use (copyleft: modifications must remain open source)
• Apache License 2.0 — for commercial and partnership use (permissive: modifications may remain proprietary)

For Anthropic partnership integrations, Claude marketplace distribution, and enterprise deployments, the Apache 2.0 license applies.