Live, passive subdomain discovery for AI assistants. Names come from public certificate transparency logs (certspotter, with crt.sh as fallback); optional DNS checks go through Cloudflare DNS over HTTPS. No port scans and no requests to the target. Use it on assets you own or are authorised to test. Version 1.0.0.
find_subdomains | Passive subdomain list for a domain from certificate transparency logs (certspotter, crt.sh fallback): deduplicated, wildcards marked, first and last seen, issuers. Optional DNS check. |
resolve_subdomains | DNS over HTTPS (Cloudflare) A, AAAA and CNAME for up to 40 hosts. Marks live, NXDOMAIN and dangling CNAMEs to cloud services. Detects wildcard DNS. |
get_certificate_history | Certificates logged for one host: issuer, validity dates, SANs, revocation, SHA-256, with first and last issuance. |
summarize_attack_surface | Groups a domain's CT subdomains into dev/test, staging, admin, API, auth, mail, VPN, storage and legacy, with clusters, issuer mix and the newest names. |
Hosted endpoint (Streamable HTTP, no token, no sign-up). Paste it into a Claude.ai custom connector or ChatGPT developer mode:
https://subdomain-finder-mcp.lipmichal.workers.dev/mcp
Claude Code:
claude mcp add --transport http subdomain-finder https://subdomain-finder-mcp.lipmichal.workers.dev/mcp
Local stdio (Node 20+):
npx -y github:theluckystrike/subdomain-finder-mcp
Source and install notes for Cursor and VS Code: github.com/theluckystrike/subdomain-finder-mcp
Recon checklists, the subdomain takeover checker and more bug bounty tools are on bugbountyreality.com (web subdomain finder).
Part of the Zovo MCP collection: https://mcp.zovo.one