Subdomain Finder MCP

io.github.theluckystrike由 GitHub 账号 theluckystrike 发布v1.0.0更新于 Nov 3, 2026

通过证书透明度（certspotter、crt.sh）进行被动子域名枚举，并进行DNS检查。

AI 翻译由 AI 模型根据下方的原文描述翻译，可能有误。

原文描述

Passive subdomain enumeration from certificate transparency (certspotter, crt.sh) with DNS checks.

发布方自己的服务：Finder Jobs

已验证Streamable HTTP可网页运行

概览

Subdomain Finder 的托管 MCP 服务（subdomain-finder-mcp.lipmichal.workers.dev）；无需登录；Streamable HTTP；4 个工具。

暂无 AI 概览：以下信息来自注册中心条目和服务本身。

端点
subdomain-finder-mcp.lipmichal.workers.dev
最近检查

安装

在 SourceWeft 中

  1. 打开 控制台中的 Subdomain Finder MCP，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/io.github.theluckystrike%2Fsubdomain-finder-mcp/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "subdomain-finder": {
      "type": "http",
      "url": "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp"
    }
  }
}

README

subdomain-finder-mcp

Passive subdomain finder for AI assistants: live certificate transparency lookups (certspotter, crt.sh) with DNS checks over Cloudflare DNS over HTTPS.

This is a Model Context Protocol (MCP) server for subdomain enumeration in bug bounty and security recon. It reads public certificate transparency (CT) logs, deduplicates the names, handles wildcard certificates, and reports first seen, last seen and issuer for each host. It can then resolve the hosts to mark which are live and which have dangling CNAMEs. It needs no API key.

Passive and read-only

  • It only reads public CT logs and public DNS. It sends nothing to the target's servers.
  • No port scanning, no HTTP probing, no brute-force wordlists.
  • Use it on domains you own or are authorised to test, for example inside a bug bounty program's scope.

Tools

ToolWhat it returns
find_subdomainsDeduplicated hostnames for a domain from CT logs, with first seen, last seen, valid until, certificate count, issuers and a wildcard flag. Optional DNS check of up to 40 names.
resolve_subdomainsA, AAAA and CNAME chain for up to 40 hosts. Marks live, NXDOMAIN, no records and dangling CNAMEs, names cloud services behind CNAMEs, and detects wildcard DNS.
get_certificate_historyCertificates for one host: issuer, validity dates, every SAN, revocation status and SHA-256, plus first and latest issuance and the issuers used.
summarize_attack_surfaceThe domain's CT hostnames grouped into development and test, staging, admin, API, auth, mail, remote access, storage and legacy, with naming clusters, issuers and the newest names.

Every result has structured JSON, a one-paragraph summary, as_of, source (the CT or DNS query URL) and more (the matching tool on bugbountyreality.com).

What it knows that your model does not

  • A domain's current subdomains. New hosts appear in CT logs within minutes of getting a certificate; a model's training data is months old and never had most of them.
  • Which hosts resolve right now, which CNAMEs point at a deleted cloud resource, and whether the zone has wildcard DNS.
  • Certificate history: when each name first got a certificate, which CAs issued it, and when the current one expires.
  • How to read CT data cleanly: precertificate and certificate rows merged, e-mail SANs and out-of-scope names dropped, *. entries reported as wildcards instead of hosts.

Install

Hosted (Claude.ai custom connector, ChatGPT developer mode)

Paste this URL. No token, no sign-up.

https://subdomain-finder-mcp.lipmichal.workers.dev/mcp

Claude Code

claude mcp add --transport http subdomain-finder https://subdomain-finder-mcp.lipmichal.workers.dev/mcp

Or run it locally over stdio:

claude mcp add subdomain-finder -- npx -y github:theluckystrike/subdomain-finder-mcp

Claude Desktop

Add to claude_desktop_config.json:

json
{  "mcpServers": {    "subdomain-finder": { "command": "npx", "args": ["-y", "github:theluckystrike/subdomain-finder-mcp"] }  }}

Cursor

Add to ~/.cursor/mcp.json:

json
{  "mcpServers": {    "subdomain-finder": { "url": "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp" }  }}

VS Code

Add to .vscode/mcp.json:

json
{  "servers": {    "subdomain-finder": { "type": "http", "url": "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp" }  }}

Node 20 or newer is needed for the local stdio version. The local version uses your own IP for the CT and DNS lookups, so it has its own rate-limit allowance.

Example prompts

  • "Find subdomains of hackerone.com from certificate transparency and tell me which are live."
  • "Which of these hosts have dangling CNAMEs: assets.example.com, docs.example.com, status.example.com?"
  • "Show the certificate history for api.example.com. Did they change CA this year?"
  • "Summarise the attack surface of example.com. Any staging, admin or VPN hosts?"
  • "Include expired certificates and list hosts under example.com that first appeared before 2020."

Data sources

All public and keyless. Full list with fetch dates in DATA_SOURCES.md.

  • SSLMate certspotter CT Search API (api.certspotter.com), unexpired certificates. Primary.
  • crt.sh, including expired certificates. Fallback, and used when include_expired is true.
  • Cloudflare DNS over HTTPS (cloudflare-dns.com/dns-query).

Limitations

  • Certificate transparency only shows names that got a publicly trusted certificate. Hosts behind a wildcard certificate (*.example.com) or with no TLS never appear by name. Pair it with other passive sources for full coverage.
  • certspotter's keyless tier is rate limited per IP (x-ratelimit-limit: 10 observed). Results are cached for an hour, the tool reads at most 5 pages per call, and it falls back to crt.sh when certspotter throttles. If both throttle, the error says to wait a few minutes.
  • crt.sh is often slow or overloaded, and two calls minutes apart can return different rows (its database replicas lag). Calls time out after 25 seconds, retry once, then fail with a clear message.
  • Very large domains return the first pages only; the result says when it was truncated.
  • DNS checks are capped at 40 hosts per call. A "dangling CNAME" is a lead to verify inside an authorised scope, not proof of a vulnerability.

More

The web versions of these tools, a subdomain takeover checker and a manual recon checklist are on bugbountyreality.com. See also the certificate transparency lookup and the subdomain enumeration checklist.

Part of the Zovo MCP collection: https://mcp.zovo.one

Development

npm installnpm test            # builds, then runs the fixture tests against saved CT and DNS payloadsnode scripts/smoke-stdio.mjs   # live stdio check, one real call per toolnpx wrangler deploy            # Cloudflare Worker, Streamable HTTP at /mcp

License

MIT

More data servers from the same author

Each one is free, needs no API key and has a hosted URL you can paste into Claude or ChatGPT.

servertoolshosted URL
cups-to-grams-mcpconvert_ingredient, search_ingredients, scale_recipe, convert_oven_temperaturehttps://cups-to-grams-mcp.lipmichal.workers.dev/mcp
dscr-loan-calculator-mcpcalculate_dscr, max_loan_for_target_dscr, rent_needed_for_target_dscr, compare_scenarios, amortization_summaryhttps://dscr-loan-calculator-mcp.lipmichal.workers.dev/mcp
gold-price-per-gram-mcpget_gold_price_per_gram, get_metal_prices, calculate_jewelry_value, convert_gold_unitshttps://gold-price-per-gram-mcp.lipmichal.workers.dev/mcp
lake-level-mcpsearch_lakes, get_lake_level, get_lake_history, compare_lakeshttps://lake-level-mcp.lipmichal.workers.dev/mcp
minimum-wage-mcpget_minimum_wage, list_upcoming_increases, compare_states, annual_income_at_minimum_wagehttps://minimum-wage-mcp.lipmichal.workers.dev/mcp
no-tax-on-overtime-mcpcalculate_overtime_deduction, calculate_tips_deduction, calculate_senior_deduction, estimate_tax_savings, explain_eligibilityhttps://no-tax-on-overtime-mcp.lipmichal.workers.dev/mcp
paycheck-calculator-mcpcalculate_take_home_pay, compare_states_take_home, salary_to_hourly, hourly_to_salary, get_federal_tax_bracketshttps://paycheck-calculator-mcp.lipmichal.workers.dev/mcp
uk-income-tax-salary-mcpcalculate_uk_take_home, get_uk_tax_bands, compare_salaries, marginal_rate_at_incomehttps://uk-income-tax-salary-mcp.lipmichal.workers.dev/mcp
us-federal-holidays-business-days-mcplist_federal_holidays, is_business_day, add_business_days, count_business_days, invoice_due_datehttps://us-federal-holidays-business-days-mcp.lipmichal.workers.dev/mcp
ab-test-sample-size-calculator-mcpcalculate_sample_size, estimate_test_duration, test_ab_significance, fisher_exact_test, check_peeking_riskhttps://ab-test-sample-size-calculator-mcp.lipmichal.workers.dev/mcp
aca-premium-tax-credit-calculator-mcpget_federal_poverty_level, calculate_premium_tax_credit, check_subsidy_cliff, get_aptc_repayment_caphttps://aca-premium-tax-credit-calculator-mcp.lipmichal.workers.dev/mcp
ap-score-distributions-mcpget_ap_score_distribution, estimate_ap_percentile, compare_ap_exams, list_ap_exams, estimate_ap_score_from_compositehttps://ap-score-distributions-mcp.lipmichal.workers.dev/mcp
car-loan-interest-deduction-calculator-mcpcalculate_car_loan_interest_deduction, calculate_salt_deduction, get_tax_brackets_and_standard_deduction, calculate_child_tax_credithttps://car-loan-interest-deduction-calculator-mcp.lipmichal.workers.dev/mcp
estate-gift-tax-exemption-calculator-mcpget_exemption_amounts, calculate_estate_tax, check_gift, compare_yearshttps://estate-gift-tax-exemption-calculator-mcp.lipmichal.workers.dev/mcp
recipe-nutrition-calculator-mcplookup_ingredient_nutrition, calculate_recipe_nutrition, round_nutrition_label, scale_recipe_nutritionhttps://recipe-nutrition-calculator-mcp.lipmichal.workers.dev/mcp
retirement-contribution-limits-2027-mcpget_contribution_limits, calculate_max_contribution, get_social_security_cola, compare_yearshttps://retirement-contribution-limits-2027-mcp.lipmichal.workers.dev/mcp
section-179-deduction-calculator-mcpcalculate_section_179, calculate_bonus_depreciation, get_vehicle_depreciation_limits, calculate_asset_loan_paymenthttps://section-179-deduction-calculator-mcp.lipmichal.workers.dev/mcp
student-loan-repayment-assistance-plan-calculator-mcpcalculate_rap_payment, compare_rap_vs_standard, get_federal_loan_limits, get_plan_transition_dateshttps://student-loan-repayment-assistance-plan-calculator-mcp.lipmichal.workers.dev/mcp
uk-statutory-sick-pay-maternity-pay-calculator-mcpcalculate_statutory_sick_pay, calculate_statutory_maternity_pay, get_minimum_wage_rates, check_eligibilityhttps://uk-statutory-sick-pay-maternity-pay-calculator-mcp.lipmichal.workers.dev/mcp

The paid back-office collection (invoices, VAT, PDFs, spreadsheets) is at https://mcp.zovo.one

来源：README.md，提交 8cea1ee

工具

4

find_subdomains

Find subdomains (certificate transparency)

Passive subdomain enumeration for a domain from live certificate transparency logs: certspotter (unexpired certificates) with crt.sh as fallback or for expired history. Returns deduplicated hostnames with first seen and last seen issuance dates, certificate count, issuers and whether a wildcard certificate covers the name, plus the list of wildcard entries. Set resolve=true to also check the first 40 names with DNS over HTTPS and mark live hosts. Passive lookup of public certificate transparency logs; nothing is sent to the target. Use it on assets you own or are authorised to test.

输入参数limitdomain必填sourceresolvemax_pagesinclude_expired

resolve_subdomains

Resolve subdomains (DNS over HTTPS)

Resolve up to 40 hostnames now through Cloudflare DNS over HTTPS (A, AAAA and the CNAME chain). Each host is marked live, nxdomain, no_records or dangling_cname (a CNAME whose target does not exist, a subdomain takeover lead), and CNAME targets on cloud platforms (S3, Azure, Heroku, GitHub Pages, Netlify, Vercel and others) are named. Also probes a random label per parent domain to detect wildcard DNS. DNS lookups only; no connection is made to the hosts.

输入参数hosts必填check_wildcard

get_certificate_history

Get certificate history for a host

Certificates logged in certificate transparency for one hostname (or a whole domain with include_subdomains): issuer organisation and DN, not_before and not_after dates, every SAN on the certificate, revocation status and SHA-256 where certspotter has them. Summarises first and last issuance and the issuers used, which shows CA changes and renewal cadence. Default source certspotter (unexpired); include_expired uses crt.sh for the full history.

输入参数host必填limitsourceinclude_expiredinclude_subdomains

summarize_attack_surface

Summarize attack surface from CT

Reads a domain's subdomains from live certificate transparency and groups them for recon triage: development and test, staging, admin and internal tools, APIs, authentication, mail, remote access (VPN), storage and CDN, legacy and backup. Each group has a count, examples and why it matters. Also returns naming clusters (for example *.eu.example.com), certificate issuers in use, wildcard entries and the 10 newest names. Passive only.

输入参数domain必填sourceinclude_expired

版本历史

1
  1. v1.0.0最新Nov 3, 2026

评分

已满足适用检查项的 100%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分

其他 Finder 集成

Finder Jobs

work.finder官方发布者

实时职位空缺与薪资统计：俄罗斯、白俄罗斯、哈萨克斯坦、德国、法国等。AI 翻译

Streamable HTTP可网页运行
网页搜索与抓取4 个工具Oct 24, 2026

Mcp Us Import Records Buyer Finder

com.mambabuilt

通过 Apify 服务，按公司名称从海关提单记录中查找美国进口商及其海外供应商。

STDIO仅桌面
商业与电商尚未验证Nov 7, 2026

Machine Demand Radar Finder

由 GitHub 账号 gdangalov 发布

一个远程 MCP 服务器，帮助助手按格式、JavaScript、认证和价格等条件查找有文档的网页抽取服务，并记录最终选用的服务。

Streamable HTTP可网页运行
开发者工具2 个工具Nov 4, 2026

EU Tenders Finder & Bid Matcher

由 GitHub 账号 Nero-Engine 发布

由 Apify 托管的远程 MCP 服务器，按你的 CPV 代码和关键词为 TED 上的欧盟公开招标评分匹配，并提供往届中标者与价格。

Streamable HTTP可网页运行鉴权
商业与电商需要凭据Nov 4, 2026

Local Business Lead Finder

由 GitHub 账号 ellokillox 发布

在Google Maps上查找没有网站的本地商家，然后将其导出为CSV。AI 翻译

STDIO仅桌面
数据与分析尚未验证Nov 3, 2026