Find known subdomains of a domain. Passive data; may include historic entries. List or count.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Return only the total number of distinct subdomains known for a domain — no list. Cheap and low-token. Use when the user asks "how many subdomains" or you only need the size of the attack surface. Count includes historic subdomains that may no longer be live. It is a point-in-time figure that changes over time, so treat it as current-as-of-query, not a fixed value.
Root (registrable) domain as a bare hostname, e.g. "example.com". No scheme, path, port, or leading "www." — these are stripped.
Return only the total number of distinct subdomains known for a domain — no list. Cheap and low-token. Use when the user asks "how many subdomains" or you only need the size of the attack surface. Count includes historic subdomains that may no longer be live. It is a point-in-time figure that changes over time, so treat it as current-as-of-query, not a fixed value.
| Argument | Type | Description |
|---|---|---|
| domain* | string | Root (registrable) domain as a bare hostname, e.g. "example.com". No scheme, path, port, or leading "www." — these are stripped. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"domain"
],
"properties": {
"domain": {
"type": "string",
"description": "Root (registrable) domain as a bare hostname, e.g. \"example.com\". No scheme, path, port, or leading \"www.\" — these are stripped."
}
}
}List known subdomains (hostnames) of a root domain. Data is passive (not active scanning): results are historic observations and may include subdomains that no longer resolve or are no longer live. Results are a point-in-time snapshot that changes over time as new subdomains are observed — re-query rather than caching the result. Use for attack-surface mapping, security recon, asset inventory, or SEO host discovery. Hostnames are returned most-recently-seen first. The response always reports `total` (full distinct count known) and a `truncated` flag, so you can tell when more exist beyond `limit`.
| Argument | Type | Description |
|---|---|---|
| limit | integer | Max subdomains to return (1-1000, default 200). `total` always reports the full count regardless of this cap. |
| domain* | string | Root (registrable) domain as a bare hostname, e.g. "example.com". No scheme, path, port, or leading "www." — these are stripped. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"domain"
],
"properties": {
"limit": {
"type": "integer",
"default": 200,
"maximum": 1000,
"minimum": 1,
"description": "Max subdomains to return (1-1000, default 200). `total` always reports the full count regardless of this cap."
},
"domain": {
"type": "string",
"description": "Root (registrable) domain as a bare hostname, e.g. \"example.com\". No scheme, path, port, or leading \"www.\" — these are stripped."
}
}
}