Search / io.github.theluckystrike/subdomain-finder-mcp
protogridR0· no sign-inPassive subdomain enumeration from certificate transparency (certspotter, crt.sh) with DNS checks.
v1.0.0 · active · repository · website · descriptor JSON · versions
{
"mcpServers": {
"subdomain-finder-mcp": {
"type": "http",
"url": "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp"
}
}
}claude mcp add --transport http subdomain-finder-mcp https://subdomain-finder-mcp.lipmichal.workers.dev/mcp[mcp_servers.subdomain-finder-mcp]
url = "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"subdomain-finder-mcp": {
"type": "remote",
"url": "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp",
"enabled": true
}
}
}{
"mcpServers": {
"subdomain-finder-mcp": {
"type": "http",
"url": "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp"
}
},
"deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=subdomain-finder-mcp&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vc3ViZG9tYWluLWZpbmRlci1tY3AubGlwbWljaGFsLndvcmtlcnMuZGV2L21jcCJ9"
}{
"servers": {
"subdomain-finder-mcp": {
"type": "http",
"url": "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp"
}
}
}{
"mcpServers": {
"subdomain-finder-mcp": {
"httpUrl": "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp"
}
}
}extensions:
"subdomain-finder-mcp":
enabled: true
name: "subdomain-finder-mcp"
type: streamable_http
uri: "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp"
timeout: 300
protocol.modernnewest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28protocol.statelessonly applies to 2026-07-28 serversprotocol.transportstreamable HTTPprotocol.list_ttlonly applies to 2026-07-28 serversauth.prm, auth.as_metadata, auth.cimdno remote uses OAuthauth.secret_in_urlno templated URLtools.descriptionsevery tool has a descriptiontools.description_lengthdescriptions are concisetools.schemasevery tool has an object input schematools.annotations4 of 4 tools declare readOnlyHint or destructiveHinttools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHinttools.token_costabout 1,438 tokens to load every tooltools.api_dumptools are not a one-to-one API dumpstability.changes, stability.rug_pulltool history recorded for 5 of the 7 days neededdeps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI packageNo tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.
Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.
+repository +namespace-matches-repo +website +reachable +uptime-95% +updated-6d-ago
Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.
| remote | auth | reachable | uptime 30d | p50 | protocol | last ok |
|---|---|---|---|---|---|---|
https://subdomain-finder-mcp.lipmichal.workers.dev/mcp streamable-http | none | yes | 95% | 321 ms | 2025-11-25 | 2026-11-07 |
find_subdomainsread-only | Passive subdomain enumeration for a domain from live certificate transparency logs: certspotter (unexpired certificates) with crt.sh as fallback or for expired history. Returns deduplicated hostnames with first seen and last seen issuance dates, certificate count, issuers and whether a wildcard certificate covers the name, plus the list of wildcard entries. Set resolve=true to also check the first 40 names with DNS over HTTPS and mark live hosts. Passive lookup of public certificate transparency logs; nothing is sent to the target. Use it on assets you own or are authorised to test. |
get_certificate_historyread-only | Certificates logged in certificate transparency for one hostname (or a whole domain with include_subdomains): issuer organisation and DN, not_before and not_after dates, every SAN on the certificate, revocation status and SHA-256 where certspotter has them. Summarises first and last issuance and the issuers used, which shows CA changes and renewal cadence. Default source certspotter (unexpired); include_expired uses crt.sh for the full history. |
resolve_subdomainsread-only | Resolve up to 40 hostnames now through Cloudflare DNS over HTTPS (A, AAAA and the CNAME chain). Each host is marked live, nxdomain, no_records or dangling_cname (a CNAME whose target does not exist, a subdomain takeover lead), and CNAME targets on cloud platforms (S3, Azure, Heroku, GitHub Pages, Netlify, Vercel and others) are named. Also probes a random label per parent domain to detect wildcard DNS. DNS lookups only; no connection is made to the hosts. |
summarize_attack_surfaceread-only | Reads a domain's subdomains from live certificate transparency and groups them for recon triage: development and test, staging, admin and internal tools, APIs, authentication, mail, remote access (VPN), storage and CDN, legacy and backup. Each group has a count, examples and why it matters. Also returns naming clusters (for example *.eu.example.com), certificate issuers in use, wildcard entries and the 10 newest names. Passive only. |
Schemas: list_tools.
And 298 more from this publisher.
{
"name": "io.github.theluckystrike/subdomain-finder-mcp",
"title": "Subdomain Finder MCP",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"remotes": [
{
"url": "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp",
"type": "streamable-http"
}
],
"version": "1.0.0",
"repository": {
"url": "https://github.com/theluckystrike/subdomain-finder-mcp",
"source": "github"
},
"websiteUrl": "https://bugbountyreality.com/tools/subdomain-finder-real/",
"description": "Passive subdomain enumeration from certificate transparency (certspotter, crt.sh) with DNS checks."
}