Passive subdomain enumeration from certificate transparency (certspotter, crt.sh) with DNS checks.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Passive subdomain enumeration for a domain from live certificate transparency logs: certspotter (unexpired certificates) with crt.sh as fallback or for expired history. Returns deduplicated hostnames with first seen and last seen issuance dates, certificate count, issuers and whether a wildcard certificate covers the name, plus the list of wildcard entries. Set resolve=true to also check the first 40 names with DNS over HTTPS and mark live hosts. Passive lookup of public certificate transparency logs; nothing is sent to the target. Use it on assets you own or are authorised to test.
Registered domain, for example "example.com". A URL is accepted and reduced to its host.
Max hostnames returned (1-1000). Totals are always reported.
auto = certspotter first (fast, unexpired certificates), crt.sh if it fails or throttles. crtsh = crt.sh only (includes expired with include_expired).
Also resolve up to 40 of the returned names over DNS (newest first).
certspotter pages to read (1-5). Each page is one request against its keyless rate limit.
Also include names from expired certificates (uses crt.sh). Finds retired hosts; slower.
Pick your client. Values in capitals, like YOUR_TOKEN, are yours to fill in.
claude mcp add --transport http subdomain-finder-mcp https://subdomain-finder-mcp.lipmichal.workers.dev/mcp
Passive subdomain enumeration for a domain from live certificate transparency logs: certspotter (unexpired certificates) with crt.sh as fallback or for expired history. Returns deduplicated hostnames with first seen and last seen issuance dates, certificate count, issuers and whether a wildcard certificate covers the name, plus the list of wildcard entries. Set resolve=true to also check the first 40 names with DNS over HTTPS and mark live hosts. Passive lookup of public certificate transparency logs; nothing is sent to the target. Use it on assets you own or are authorised to test.
| Argument | Type | Description |
|---|---|---|
| limit | integer | Max hostnames returned (1-1000). Totals are always reported. |
| domain* | string | Registered domain, for example "example.com". A URL is accepted and reduced to its host. |
| source | string | auto = certspotter first (fast, unexpired certificates), crt.sh if it fails or throttles. crtsh = crt.sh only (includes expired with include_expired). |
| resolve | boolean | Also resolve up to 40 of the returned names over DNS (newest first). |
| max_pages | integer | certspotter pages to read (1-5). Each page is one request against its keyless rate limit. |
| include_expired | boolean | Also include names from expired certificates (uses crt.sh). Finds retired hosts; slower. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"domain"
],
"properties": {
"limit": {
"type": "integer",
"default": 200,
"maximum": 1000,
"minimum": 1,
"description": "Max hostnames returned (1-1000). Totals are always reported."
},
"domain": {
"type": "string",
"maxLength": 253,
"minLength": 3,
"description": "Registered domain, for example \"example.com\". A URL is accepted and reduced to its host."
},
"source": {
"enum": [
"auto",
"certspotter",
"crtsh"
],
"type": "string",
"default": "auto",
"description": "auto = certspotter first (fast, unexpired certificates), crt.sh if it fails or throttles. crtsh = crt.sh only (includes expired with include_expired)."
},
"resolve": {
"type": "boolean",
"default": false,
"description": "Also resolve up to 40 of the returned names over DNS (newest first)."
},
"max_pages": {
"type": "integer",
"default": 3,
"maximum": 5,
"minimum": 1,
"description": "certspotter pages to read (1-5). Each page is one request against its keyless rate limit."
},
"include_expired": {
"type": "boolean",
"default": false,
"description": "Also include names from expired certificates (uses crt.sh). Finds retired hosts; slower."
}
},
"additionalProperties": false
}Certificates logged in certificate transparency for one hostname (or a whole domain with include_subdomains): issuer organisation and DN, not_before and not_after dates, every SAN on the certificate, revocation status and SHA-256 where certspotter has them. Summarises first and last issuance and the issuers used, which shows CA changes and renewal cadence. Default source certspotter (unexpired); include_expired uses crt.sh for the full history.
| Argument | Type | Description |
|---|---|---|
| host* | string | Hostname, for example "api.example.com" or "example.com". |
| limit | integer | Max certificates returned, newest first (1-100). |
| source | string | auto = certspotter first (fast, unexpired certificates), crt.sh if it fails or throttles. crtsh = crt.sh only (includes expired with include_expired). |
| include_expired | boolean | Also include names from expired certificates (uses crt.sh). Finds retired hosts; slower. |
| include_subdomains | boolean | Also include certificates for names under the host. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"host"
],
"properties": {
"host": {
"type": "string",
"maxLength": 253,
"minLength": 3,
"description": "Hostname, for example \"api.example.com\" or \"example.com\"."
},
"limit": {
"type": "integer",
"default": 25,
"maximum": 100,
"minimum": 1,
"description": "Max certificates returned, newest first (1-100)."
},
"source": {
"enum": [
"auto",
"certspotter",
"crtsh"
],
"type": "string",
"default": "auto",
"description": "auto = certspotter first (fast, unexpired certificates), crt.sh if it fails or throttles. crtsh = crt.sh only (includes expired with include_expired)."
},
"include_expired": {
"type": "boolean",
"default": false,
"description": "Also include names from expired certificates (uses crt.sh). Finds retired hosts; slower."
},
"include_subdomains": {
"type": "boolean",
"default": false,
"description": "Also include certificates for names under the host."
}
},
"additionalProperties": false
}Resolve up to 40 hostnames now through Cloudflare DNS over HTTPS (A, AAAA and the CNAME chain). Each host is marked live, nxdomain, no_records or dangling_cname (a CNAME whose target does not exist, a subdomain takeover lead), and CNAME targets on cloud platforms (S3, Azure, Heroku, GitHub Pages, Netlify, Vercel and others) are named. Also probes a random label per parent domain to detect wildcard DNS. DNS lookups only; no connection is made to the hosts.
| Argument | Type | Description |
|---|---|---|
| hosts* | array | Hostnames, for example ["www.example.com", "api.example.com"]. Max 40. |
| check_wildcard | boolean | Probe one random label under each parent domain (max 3) to detect wildcard DNS. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"hosts"
],
"properties": {
"hosts": {
"type": "array",
"items": {
"type": "string",
"maxLength": 253,
"minLength": 3
},
"maxItems": 40,
"minItems": 1,
"description": "Hostnames, for example [\"www.example.com\", \"api.example.com\"]. Max 40."
},
"check_wildcard": {
"type": "boolean",
"default": true,
"description": "Probe one random label under each parent domain (max 3) to detect wildcard DNS."
}
},
"additionalProperties": false
}Reads a domain's subdomains from live certificate transparency and groups them for recon triage: development and test, staging, admin and internal tools, APIs, authentication, mail, remote access (VPN), storage and CDN, legacy and backup. Each group has a count, examples and why it matters. Also returns naming clusters (for example *.eu.example.com), certificate issuers in use, wildcard entries and the 10 newest names. Passive only.
| Argument | Type | Description |
|---|---|---|
| domain* | string | Registered domain, for example "example.com". A URL is accepted and reduced to its host. |
| source | string | auto = certspotter first (fast, unexpired certificates), crt.sh if it fails or throttles. crtsh = crt.sh only (includes expired with include_expired). |
| include_expired | boolean | Also include names from expired certificates (uses crt.sh). Finds retired hosts; slower. |
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"domain"
],
"properties": {
"domain": {
"type": "string",
"maxLength": 253,
"minLength": 3,
"description": "Registered domain, for example \"example.com\". A URL is accepted and reduced to its host."
},
"source": {
"enum": [
"auto",
"certspotter",
"crtsh"
],
"type": "string",
"default": "auto",
"description": "auto = certspotter first (fast, unexpired certificates), crt.sh if it fails or throttles. crtsh = crt.sh only (includes expired with include_expired)."
},
"include_expired": {
"type": "boolean",
"default": false,
"description": "Also include names from expired certificates (uses crt.sh). Finds retired hosts; slower."
}
},
"additionalProperties": false
}We read every tool's name, description and inputs the way the model will, looking for instructions hidden from you. A clean result means no warning signs, not a guarantee. Scanned Nov 2, 2026.