Subdomain Finder MCP

io.github.theluckystrikePublished by GitHub account theluckystrikev1.0.0Updated Nov 3, 2026

Passive subdomain enumeration from certificate transparency (certspotter, crt.sh) with DNS checks.

The publisher's own server: Finder Jobs

VerifiedStreamable HTTPWeb executable

Overview

Subdomain Finder's hosted MCP server (subdomain-finder-mcp.lipmichal.workers.dev); no sign-in required; Streamable HTTP; 4 tools.

No AI overview yet: these facts come from the registry entry and the server itself.

Endpoint
subdomain-finder-mcp.lipmichal.workers.dev
Last checked

Installation

In SourceWeft

  1. Open Subdomain Finder MCP in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.theluckystrike%2Fsubdomain-finder-mcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "subdomain-finder": {
      "type": "http",
      "url": "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp"
    }
  }
}

README

subdomain-finder-mcp

Passive subdomain finder for AI assistants: live certificate transparency lookups (certspotter, crt.sh) with DNS checks over Cloudflare DNS over HTTPS.

This is a Model Context Protocol (MCP) server for subdomain enumeration in bug bounty and security recon. It reads public certificate transparency (CT) logs, deduplicates the names, handles wildcard certificates, and reports first seen, last seen and issuer for each host. It can then resolve the hosts to mark which are live and which have dangling CNAMEs. It needs no API key.

Passive and read-only

  • It only reads public CT logs and public DNS. It sends nothing to the target's servers.
  • No port scanning, no HTTP probing, no brute-force wordlists.
  • Use it on domains you own or are authorised to test, for example inside a bug bounty program's scope.

Tools

ToolWhat it returns
find_subdomainsDeduplicated hostnames for a domain from CT logs, with first seen, last seen, valid until, certificate count, issuers and a wildcard flag. Optional DNS check of up to 40 names.
resolve_subdomainsA, AAAA and CNAME chain for up to 40 hosts. Marks live, NXDOMAIN, no records and dangling CNAMEs, names cloud services behind CNAMEs, and detects wildcard DNS.
get_certificate_historyCertificates for one host: issuer, validity dates, every SAN, revocation status and SHA-256, plus first and latest issuance and the issuers used.
summarize_attack_surfaceThe domain's CT hostnames grouped into development and test, staging, admin, API, auth, mail, remote access, storage and legacy, with naming clusters, issuers and the newest names.

Every result has structured JSON, a one-paragraph summary, as_of, source (the CT or DNS query URL) and more (the matching tool on bugbountyreality.com).

What it knows that your model does not

  • A domain's current subdomains. New hosts appear in CT logs within minutes of getting a certificate; a model's training data is months old and never had most of them.
  • Which hosts resolve right now, which CNAMEs point at a deleted cloud resource, and whether the zone has wildcard DNS.
  • Certificate history: when each name first got a certificate, which CAs issued it, and when the current one expires.
  • How to read CT data cleanly: precertificate and certificate rows merged, e-mail SANs and out-of-scope names dropped, *. entries reported as wildcards instead of hosts.

Install

Hosted (Claude.ai custom connector, ChatGPT developer mode)

Paste this URL. No token, no sign-up.

https://subdomain-finder-mcp.lipmichal.workers.dev/mcp

Claude Code

claude mcp add --transport http subdomain-finder https://subdomain-finder-mcp.lipmichal.workers.dev/mcp

Or run it locally over stdio:

claude mcp add subdomain-finder -- npx -y github:theluckystrike/subdomain-finder-mcp

Claude Desktop

Add to claude_desktop_config.json:

json
{  "mcpServers": {    "subdomain-finder": { "command": "npx", "args": ["-y", "github:theluckystrike/subdomain-finder-mcp"] }  }}

Cursor

Add to ~/.cursor/mcp.json:

json
{  "mcpServers": {    "subdomain-finder": { "url": "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp" }  }}

VS Code

Add to .vscode/mcp.json:

json
{  "servers": {    "subdomain-finder": { "type": "http", "url": "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp" }  }}

Node 20 or newer is needed for the local stdio version. The local version uses your own IP for the CT and DNS lookups, so it has its own rate-limit allowance.

Example prompts

  • "Find subdomains of hackerone.com from certificate transparency and tell me which are live."
  • "Which of these hosts have dangling CNAMEs: assets.example.com, docs.example.com, status.example.com?"
  • "Show the certificate history for api.example.com. Did they change CA this year?"
  • "Summarise the attack surface of example.com. Any staging, admin or VPN hosts?"
  • "Include expired certificates and list hosts under example.com that first appeared before 2020."

Data sources

All public and keyless. Full list with fetch dates in DATA_SOURCES.md.

  • SSLMate certspotter CT Search API (api.certspotter.com), unexpired certificates. Primary.
  • crt.sh, including expired certificates. Fallback, and used when include_expired is true.
  • Cloudflare DNS over HTTPS (cloudflare-dns.com/dns-query).

Limitations

  • Certificate transparency only shows names that got a publicly trusted certificate. Hosts behind a wildcard certificate (*.example.com) or with no TLS never appear by name. Pair it with other passive sources for full coverage.
  • certspotter's keyless tier is rate limited per IP (x-ratelimit-limit: 10 observed). Results are cached for an hour, the tool reads at most 5 pages per call, and it falls back to crt.sh when certspotter throttles. If both throttle, the error says to wait a few minutes.
  • crt.sh is often slow or overloaded, and two calls minutes apart can return different rows (its database replicas lag). Calls time out after 25 seconds, retry once, then fail with a clear message.
  • Very large domains return the first pages only; the result says when it was truncated.
  • DNS checks are capped at 40 hosts per call. A "dangling CNAME" is a lead to verify inside an authorised scope, not proof of a vulnerability.

More

The web versions of these tools, a subdomain takeover checker and a manual recon checklist are on bugbountyreality.com. See also the certificate transparency lookup and the subdomain enumeration checklist.

Part of the Zovo MCP collection: https://mcp.zovo.one

Development

npm installnpm test            # builds, then runs the fixture tests against saved CT and DNS payloadsnode scripts/smoke-stdio.mjs   # live stdio check, one real call per toolnpx wrangler deploy            # Cloudflare Worker, Streamable HTTP at /mcp

License

MIT

More data servers from the same author

Each one is free, needs no API key and has a hosted URL you can paste into Claude or ChatGPT.

servertoolshosted URL
cups-to-grams-mcpconvert_ingredient, search_ingredients, scale_recipe, convert_oven_temperaturehttps://cups-to-grams-mcp.lipmichal.workers.dev/mcp
dscr-loan-calculator-mcpcalculate_dscr, max_loan_for_target_dscr, rent_needed_for_target_dscr, compare_scenarios, amortization_summaryhttps://dscr-loan-calculator-mcp.lipmichal.workers.dev/mcp
gold-price-per-gram-mcpget_gold_price_per_gram, get_metal_prices, calculate_jewelry_value, convert_gold_unitshttps://gold-price-per-gram-mcp.lipmichal.workers.dev/mcp
lake-level-mcpsearch_lakes, get_lake_level, get_lake_history, compare_lakeshttps://lake-level-mcp.lipmichal.workers.dev/mcp
minimum-wage-mcpget_minimum_wage, list_upcoming_increases, compare_states, annual_income_at_minimum_wagehttps://minimum-wage-mcp.lipmichal.workers.dev/mcp
no-tax-on-overtime-mcpcalculate_overtime_deduction, calculate_tips_deduction, calculate_senior_deduction, estimate_tax_savings, explain_eligibilityhttps://no-tax-on-overtime-mcp.lipmichal.workers.dev/mcp
paycheck-calculator-mcpcalculate_take_home_pay, compare_states_take_home, salary_to_hourly, hourly_to_salary, get_federal_tax_bracketshttps://paycheck-calculator-mcp.lipmichal.workers.dev/mcp
uk-income-tax-salary-mcpcalculate_uk_take_home, get_uk_tax_bands, compare_salaries, marginal_rate_at_incomehttps://uk-income-tax-salary-mcp.lipmichal.workers.dev/mcp
us-federal-holidays-business-days-mcplist_federal_holidays, is_business_day, add_business_days, count_business_days, invoice_due_datehttps://us-federal-holidays-business-days-mcp.lipmichal.workers.dev/mcp
ab-test-sample-size-calculator-mcpcalculate_sample_size, estimate_test_duration, test_ab_significance, fisher_exact_test, check_peeking_riskhttps://ab-test-sample-size-calculator-mcp.lipmichal.workers.dev/mcp
aca-premium-tax-credit-calculator-mcpget_federal_poverty_level, calculate_premium_tax_credit, check_subsidy_cliff, get_aptc_repayment_caphttps://aca-premium-tax-credit-calculator-mcp.lipmichal.workers.dev/mcp
ap-score-distributions-mcpget_ap_score_distribution, estimate_ap_percentile, compare_ap_exams, list_ap_exams, estimate_ap_score_from_compositehttps://ap-score-distributions-mcp.lipmichal.workers.dev/mcp
car-loan-interest-deduction-calculator-mcpcalculate_car_loan_interest_deduction, calculate_salt_deduction, get_tax_brackets_and_standard_deduction, calculate_child_tax_credithttps://car-loan-interest-deduction-calculator-mcp.lipmichal.workers.dev/mcp
estate-gift-tax-exemption-calculator-mcpget_exemption_amounts, calculate_estate_tax, check_gift, compare_yearshttps://estate-gift-tax-exemption-calculator-mcp.lipmichal.workers.dev/mcp
recipe-nutrition-calculator-mcplookup_ingredient_nutrition, calculate_recipe_nutrition, round_nutrition_label, scale_recipe_nutritionhttps://recipe-nutrition-calculator-mcp.lipmichal.workers.dev/mcp
retirement-contribution-limits-2027-mcpget_contribution_limits, calculate_max_contribution, get_social_security_cola, compare_yearshttps://retirement-contribution-limits-2027-mcp.lipmichal.workers.dev/mcp
section-179-deduction-calculator-mcpcalculate_section_179, calculate_bonus_depreciation, get_vehicle_depreciation_limits, calculate_asset_loan_paymenthttps://section-179-deduction-calculator-mcp.lipmichal.workers.dev/mcp
student-loan-repayment-assistance-plan-calculator-mcpcalculate_rap_payment, compare_rap_vs_standard, get_federal_loan_limits, get_plan_transition_dateshttps://student-loan-repayment-assistance-plan-calculator-mcp.lipmichal.workers.dev/mcp
uk-statutory-sick-pay-maternity-pay-calculator-mcpcalculate_statutory_sick_pay, calculate_statutory_maternity_pay, get_minimum_wage_rates, check_eligibilityhttps://uk-statutory-sick-pay-maternity-pay-calculator-mcp.lipmichal.workers.dev/mcp

The paid back-office collection (invoices, VAT, PDFs, spreadsheets) is at https://mcp.zovo.one

Source: README.md at commit 8cea1ee

Tools

4

find_subdomains

Find subdomains (certificate transparency)

Passive subdomain enumeration for a domain from live certificate transparency logs: certspotter (unexpired certificates) with crt.sh as fallback or for expired history. Returns deduplicated hostnames with first seen and last seen issuance dates, certificate count, issuers and whether a wildcard certificate covers the name, plus the list of wildcard entries. Set resolve=true to also check the first 40 names with DNS over HTTPS and mark live hosts. Passive lookup of public certificate transparency logs; nothing is sent to the target. Use it on assets you own or are authorised to test.

Parameterslimitdomainrequiredsourceresolvemax_pagesinclude_expired

resolve_subdomains

Resolve subdomains (DNS over HTTPS)

Resolve up to 40 hostnames now through Cloudflare DNS over HTTPS (A, AAAA and the CNAME chain). Each host is marked live, nxdomain, no_records or dangling_cname (a CNAME whose target does not exist, a subdomain takeover lead), and CNAME targets on cloud platforms (S3, Azure, Heroku, GitHub Pages, Netlify, Vercel and others) are named. Also probes a random label per parent domain to detect wildcard DNS. DNS lookups only; no connection is made to the hosts.

Parametershostsrequiredcheck_wildcard

get_certificate_history

Get certificate history for a host

Certificates logged in certificate transparency for one hostname (or a whole domain with include_subdomains): issuer organisation and DN, not_before and not_after dates, every SAN on the certificate, revocation status and SHA-256 where certspotter has them. Summarises first and last issuance and the issuers used, which shows CA changes and renewal cadence. Default source certspotter (unexpired); include_expired uses crt.sh for the full history.

Parametershostrequiredlimitsourceinclude_expiredinclude_subdomains

summarize_attack_surface

Summarize attack surface from CT

Reads a domain's subdomains from live certificate transparency and groups them for recon triage: development and test, staging, admin and internal tools, APIs, authentication, mail, remote access (VPN), storage and CDN, legacy and backup. Each group has a count, examples and why it matters. Also returns naming clusters (for example *.eu.example.com), certificate issuers in use, wildcard entries and the 10 newest names. Passive only.

Parametersdomainrequiredsourceinclude_expired

Version history

1
  1. v1.0.0LatestNov 3, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Finder integrations

Finder Jobs

work.finderOfficial publisher

Finder Jobs's hosted MCP server, published by finder.work; no sign-in required; Streamable HTTP; 4 tools.

Streamable HTTPWeb executable
Web Search & Scraping4 toolsOct 24, 2026

Mcp Us Import Records Buyer Finder

com.mambabuilt

Finds US importers and their overseas suppliers from customs bill of lading records, by company name, via an Apify actor.

STDIODesktop only
Business & CommerceNot validated yetNov 7, 2026

Machine Demand Radar Finder

Published by GitHub account gdangalov

A remote MCP server that helps an assistant find documented page-extraction services matching format, JavaScript, auth and price constraints, and record which…

Streamable HTTPWeb executable
Developer Tools2 toolsNov 4, 2026

EU Tenders Finder & Bid Matcher

Published by GitHub account Nero-Engine

Remote Apify-hosted MCP server that surfaces open EU tenders from TED, scored against your CPV codes and keywords, with past winners and prices.

Streamable HTTPWeb executableAuth
Business & CommerceCredential requiredNov 4, 2026

Local Business Lead Finder

Published by GitHub account ellokillox

Find local businesses on Google Maps that have no website, then export them to CSV.

STDIODesktop only
Data & AnalyticsNot validated yetNov 3, 2026