io.github.theluckystrike/subdomain-finder-mcp · v1.0.0 · cloud-and-infra
Subdomain Finder MCP is healthy: it completed an MCP handshake in 1026 ms and exposes 4 tools.
Passive subdomain enumeration from certificate transparency (certspotter, crt.sh) with DNS checks.
Endpoint: https://subdomain-finder-mcp.lipmichal.workers.dev/mcp (streamable-http)
Repository · Website · JSON · Add to my inventory
| Users (last 30 days) | 0 |
| Handshake | Healthy |
| Auth needed | None |
| Tool count | 4 |
| Latency | 1026 ms |
| Last checked (UTC) | 2026-11-02T08:00:22.872Z |
| Checked (UTC) | Status | Latency | Error |
|---|---|---|---|
| 2026-11-02T08:00:22.872Z | Healthy | 1026 |
find_subdomains | Passive subdomain enumeration for a domain from live certificate transparency logs: certspotter (unexpired certificates) with crt.sh as fallback or for expired history. Returns deduplicated hostnames with first seen and last seen issuance dates, certificate count, issuers and whether a wildcard cert |
resolve_subdomains | Resolve up to 40 hostnames now through Cloudflare DNS over HTTPS (A, AAAA and the CNAME chain). Each host is marked live, nxdomain, no_records or dangling_cname (a CNAME whose target does not exist, a subdomain takeover lead), and CNAME targets on cloud platforms (S3, Azure, Heroku, GitHub Pages, Ne |
get_certificate_history | Certificates logged in certificate transparency for one hostname (or a whole domain with include_subdomains): issuer organisation and DN, not_before and not_after dates, every SAN on the certificate, revocation status and SHA-256 where certspotter has them. Summarises first and last issuance and the |
summarize_attack_surface | Reads a domain's subdomains from live certificate transparency and groups them for recon triage: development and test, staging, admin and internal tools, APIs, authentication, mail, remote access (VPN), storage and CDN, legacy and backup. Each group has a count, examples and why it matters. Also ret |