Subdomain Finder MCP

io.github.theluckystrike由 GitHub 帳號 theluckystrike 發布v1.0.0更新於 Nov 3, 2026

通過證書透明度（certspotter、crt.sh）進行被動子網域列舉，並進行DNS檢查。

AI 翻譯由 AI 模型根據下方的原文描述翻譯，可能有誤。

原文描述

Passive subdomain enumeration from certificate transparency (certspotter, crt.sh) with DNS checks.

發布方自己的服務：Finder Jobs

已驗證Streamable HTTP可網頁執行

概覽

Subdomain Finder 的託管 MCP 服務（subdomain-finder-mcp.lipmichal.workers.dev）；無需登入；Streamable HTTP；4 個工具。

暫無 AI 概覽：以下資訊來自註冊中心條目和服務本身。

端點
subdomain-finder-mcp.lipmichal.workers.dev
最近檢查

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Subdomain Finder MCP，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/io.github.theluckystrike%2Fsubdomain-finder-mcp/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "subdomain-finder": {
      "type": "http",
      "url": "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp"
    }
  }
}

README

subdomain-finder-mcp

Passive subdomain finder for AI assistants: live certificate transparency lookups (certspotter, crt.sh) with DNS checks over Cloudflare DNS over HTTPS.

This is a Model Context Protocol (MCP) server for subdomain enumeration in bug bounty and security recon. It reads public certificate transparency (CT) logs, deduplicates the names, handles wildcard certificates, and reports first seen, last seen and issuer for each host. It can then resolve the hosts to mark which are live and which have dangling CNAMEs. It needs no API key.

Passive and read-only

  • It only reads public CT logs and public DNS. It sends nothing to the target's servers.
  • No port scanning, no HTTP probing, no brute-force wordlists.
  • Use it on domains you own or are authorised to test, for example inside a bug bounty program's scope.

Tools

ToolWhat it returns
find_subdomainsDeduplicated hostnames for a domain from CT logs, with first seen, last seen, valid until, certificate count, issuers and a wildcard flag. Optional DNS check of up to 40 names.
resolve_subdomainsA, AAAA and CNAME chain for up to 40 hosts. Marks live, NXDOMAIN, no records and dangling CNAMEs, names cloud services behind CNAMEs, and detects wildcard DNS.
get_certificate_historyCertificates for one host: issuer, validity dates, every SAN, revocation status and SHA-256, plus first and latest issuance and the issuers used.
summarize_attack_surfaceThe domain's CT hostnames grouped into development and test, staging, admin, API, auth, mail, remote access, storage and legacy, with naming clusters, issuers and the newest names.

Every result has structured JSON, a one-paragraph summary, as_of, source (the CT or DNS query URL) and more (the matching tool on bugbountyreality.com).

What it knows that your model does not

  • A domain's current subdomains. New hosts appear in CT logs within minutes of getting a certificate; a model's training data is months old and never had most of them.
  • Which hosts resolve right now, which CNAMEs point at a deleted cloud resource, and whether the zone has wildcard DNS.
  • Certificate history: when each name first got a certificate, which CAs issued it, and when the current one expires.
  • How to read CT data cleanly: precertificate and certificate rows merged, e-mail SANs and out-of-scope names dropped, *. entries reported as wildcards instead of hosts.

Install

Hosted (Claude.ai custom connector, ChatGPT developer mode)

Paste this URL. No token, no sign-up.

https://subdomain-finder-mcp.lipmichal.workers.dev/mcp

Claude Code

claude mcp add --transport http subdomain-finder https://subdomain-finder-mcp.lipmichal.workers.dev/mcp

Or run it locally over stdio:

claude mcp add subdomain-finder -- npx -y github:theluckystrike/subdomain-finder-mcp

Claude Desktop

Add to claude_desktop_config.json:

json
{  "mcpServers": {    "subdomain-finder": { "command": "npx", "args": ["-y", "github:theluckystrike/subdomain-finder-mcp"] }  }}

Cursor

Add to ~/.cursor/mcp.json:

json
{  "mcpServers": {    "subdomain-finder": { "url": "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp" }  }}

VS Code

Add to .vscode/mcp.json:

json
{  "servers": {    "subdomain-finder": { "type": "http", "url": "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp" }  }}

Node 20 or newer is needed for the local stdio version. The local version uses your own IP for the CT and DNS lookups, so it has its own rate-limit allowance.

Example prompts

  • "Find subdomains of hackerone.com from certificate transparency and tell me which are live."
  • "Which of these hosts have dangling CNAMEs: assets.example.com, docs.example.com, status.example.com?"
  • "Show the certificate history for api.example.com. Did they change CA this year?"
  • "Summarise the attack surface of example.com. Any staging, admin or VPN hosts?"
  • "Include expired certificates and list hosts under example.com that first appeared before 2020."

Data sources

All public and keyless. Full list with fetch dates in DATA_SOURCES.md.

  • SSLMate certspotter CT Search API (api.certspotter.com), unexpired certificates. Primary.
  • crt.sh, including expired certificates. Fallback, and used when include_expired is true.
  • Cloudflare DNS over HTTPS (cloudflare-dns.com/dns-query).

Limitations

  • Certificate transparency only shows names that got a publicly trusted certificate. Hosts behind a wildcard certificate (*.example.com) or with no TLS never appear by name. Pair it with other passive sources for full coverage.
  • certspotter's keyless tier is rate limited per IP (x-ratelimit-limit: 10 observed). Results are cached for an hour, the tool reads at most 5 pages per call, and it falls back to crt.sh when certspotter throttles. If both throttle, the error says to wait a few minutes.
  • crt.sh is often slow or overloaded, and two calls minutes apart can return different rows (its database replicas lag). Calls time out after 25 seconds, retry once, then fail with a clear message.
  • Very large domains return the first pages only; the result says when it was truncated.
  • DNS checks are capped at 40 hosts per call. A "dangling CNAME" is a lead to verify inside an authorised scope, not proof of a vulnerability.

More

The web versions of these tools, a subdomain takeover checker and a manual recon checklist are on bugbountyreality.com. See also the certificate transparency lookup and the subdomain enumeration checklist.

Part of the Zovo MCP collection: https://mcp.zovo.one

Development

npm installnpm test            # builds, then runs the fixture tests against saved CT and DNS payloadsnode scripts/smoke-stdio.mjs   # live stdio check, one real call per toolnpx wrangler deploy            # Cloudflare Worker, Streamable HTTP at /mcp

License

MIT

More data servers from the same author

Each one is free, needs no API key and has a hosted URL you can paste into Claude or ChatGPT.

servertoolshosted URL
cups-to-grams-mcpconvert_ingredient, search_ingredients, scale_recipe, convert_oven_temperaturehttps://cups-to-grams-mcp.lipmichal.workers.dev/mcp
dscr-loan-calculator-mcpcalculate_dscr, max_loan_for_target_dscr, rent_needed_for_target_dscr, compare_scenarios, amortization_summaryhttps://dscr-loan-calculator-mcp.lipmichal.workers.dev/mcp
gold-price-per-gram-mcpget_gold_price_per_gram, get_metal_prices, calculate_jewelry_value, convert_gold_unitshttps://gold-price-per-gram-mcp.lipmichal.workers.dev/mcp
lake-level-mcpsearch_lakes, get_lake_level, get_lake_history, compare_lakeshttps://lake-level-mcp.lipmichal.workers.dev/mcp
minimum-wage-mcpget_minimum_wage, list_upcoming_increases, compare_states, annual_income_at_minimum_wagehttps://minimum-wage-mcp.lipmichal.workers.dev/mcp
no-tax-on-overtime-mcpcalculate_overtime_deduction, calculate_tips_deduction, calculate_senior_deduction, estimate_tax_savings, explain_eligibilityhttps://no-tax-on-overtime-mcp.lipmichal.workers.dev/mcp
paycheck-calculator-mcpcalculate_take_home_pay, compare_states_take_home, salary_to_hourly, hourly_to_salary, get_federal_tax_bracketshttps://paycheck-calculator-mcp.lipmichal.workers.dev/mcp
uk-income-tax-salary-mcpcalculate_uk_take_home, get_uk_tax_bands, compare_salaries, marginal_rate_at_incomehttps://uk-income-tax-salary-mcp.lipmichal.workers.dev/mcp
us-federal-holidays-business-days-mcplist_federal_holidays, is_business_day, add_business_days, count_business_days, invoice_due_datehttps://us-federal-holidays-business-days-mcp.lipmichal.workers.dev/mcp
ab-test-sample-size-calculator-mcpcalculate_sample_size, estimate_test_duration, test_ab_significance, fisher_exact_test, check_peeking_riskhttps://ab-test-sample-size-calculator-mcp.lipmichal.workers.dev/mcp
aca-premium-tax-credit-calculator-mcpget_federal_poverty_level, calculate_premium_tax_credit, check_subsidy_cliff, get_aptc_repayment_caphttps://aca-premium-tax-credit-calculator-mcp.lipmichal.workers.dev/mcp
ap-score-distributions-mcpget_ap_score_distribution, estimate_ap_percentile, compare_ap_exams, list_ap_exams, estimate_ap_score_from_compositehttps://ap-score-distributions-mcp.lipmichal.workers.dev/mcp
car-loan-interest-deduction-calculator-mcpcalculate_car_loan_interest_deduction, calculate_salt_deduction, get_tax_brackets_and_standard_deduction, calculate_child_tax_credithttps://car-loan-interest-deduction-calculator-mcp.lipmichal.workers.dev/mcp
estate-gift-tax-exemption-calculator-mcpget_exemption_amounts, calculate_estate_tax, check_gift, compare_yearshttps://estate-gift-tax-exemption-calculator-mcp.lipmichal.workers.dev/mcp
recipe-nutrition-calculator-mcplookup_ingredient_nutrition, calculate_recipe_nutrition, round_nutrition_label, scale_recipe_nutritionhttps://recipe-nutrition-calculator-mcp.lipmichal.workers.dev/mcp
retirement-contribution-limits-2027-mcpget_contribution_limits, calculate_max_contribution, get_social_security_cola, compare_yearshttps://retirement-contribution-limits-2027-mcp.lipmichal.workers.dev/mcp
section-179-deduction-calculator-mcpcalculate_section_179, calculate_bonus_depreciation, get_vehicle_depreciation_limits, calculate_asset_loan_paymenthttps://section-179-deduction-calculator-mcp.lipmichal.workers.dev/mcp
student-loan-repayment-assistance-plan-calculator-mcpcalculate_rap_payment, compare_rap_vs_standard, get_federal_loan_limits, get_plan_transition_dateshttps://student-loan-repayment-assistance-plan-calculator-mcp.lipmichal.workers.dev/mcp
uk-statutory-sick-pay-maternity-pay-calculator-mcpcalculate_statutory_sick_pay, calculate_statutory_maternity_pay, get_minimum_wage_rates, check_eligibilityhttps://uk-statutory-sick-pay-maternity-pay-calculator-mcp.lipmichal.workers.dev/mcp

The paid back-office collection (invoices, VAT, PDFs, spreadsheets) is at https://mcp.zovo.one

來源：README.md，提交 8cea1ee

工具

4

find_subdomains

Find subdomains (certificate transparency)

Passive subdomain enumeration for a domain from live certificate transparency logs: certspotter (unexpired certificates) with crt.sh as fallback or for expired history. Returns deduplicated hostnames with first seen and last seen issuance dates, certificate count, issuers and whether a wildcard certificate covers the name, plus the list of wildcard entries. Set resolve=true to also check the first 40 names with DNS over HTTPS and mark live hosts. Passive lookup of public certificate transparency logs; nothing is sent to the target. Use it on assets you own or are authorised to test.

輸入參數limitdomain必填sourceresolvemax_pagesinclude_expired

resolve_subdomains

Resolve subdomains (DNS over HTTPS)

Resolve up to 40 hostnames now through Cloudflare DNS over HTTPS (A, AAAA and the CNAME chain). Each host is marked live, nxdomain, no_records or dangling_cname (a CNAME whose target does not exist, a subdomain takeover lead), and CNAME targets on cloud platforms (S3, Azure, Heroku, GitHub Pages, Netlify, Vercel and others) are named. Also probes a random label per parent domain to detect wildcard DNS. DNS lookups only; no connection is made to the hosts.

輸入參數hosts必填check_wildcard

get_certificate_history

Get certificate history for a host

Certificates logged in certificate transparency for one hostname (or a whole domain with include_subdomains): issuer organisation and DN, not_before and not_after dates, every SAN on the certificate, revocation status and SHA-256 where certspotter has them. Summarises first and last issuance and the issuers used, which shows CA changes and renewal cadence. Default source certspotter (unexpired); include_expired uses crt.sh for the full history.

輸入參數host必填limitsourceinclude_expiredinclude_subdomains

summarize_attack_surface

Summarize attack surface from CT

Reads a domain's subdomains from live certificate transparency and groups them for recon triage: development and test, staging, admin and internal tools, APIs, authentication, mail, remote access (VPN), storage and CDN, legacy and backup. Each group has a count, examples and why it matters. Also returns naming clusters (for example *.eu.example.com), certificate issuers in use, wildcard entries and the 10 newest names. Passive only.

輸入參數domain必填sourceinclude_expired

版本歷史

1
  1. v1.0.0最新Nov 3, 2026

評分

已滿足適用檢查項的 100%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分

其他 Finder 整合

Finder Jobs

work.finder官方發布者

即時職位空缺與薪資統計：俄羅斯、白俄羅斯、哈薩克、德國、法國等。AI 翻譯

Streamable HTTP可網頁執行
網頁搜尋與抓取4 個工具Oct 24, 2026

Mcp Us Import Records Buyer Finder

com.mambabuilt

透過 Apify 服務，依公司名稱從海關提單紀錄中查找美國進口商及其海外供應商。

STDIO僅桌面
商業與電商尚未驗證Nov 7, 2026

Machine Demand Radar Finder

由 GitHub 帳號 gdangalov 發布

一個遠端 MCP 伺服器，協助助理依格式、JavaScript、驗證與價格等條件尋找有文件的網頁擷取服務，並記錄最後選用的服務。

Streamable HTTP可網頁執行
開發者工具2 個工具Nov 4, 2026

EU Tenders Finder & Bid Matcher

由 GitHub 帳號 Nero-Engine 發布

由 Apify 託管的遠端 MCP 伺服器，依你的 CPV 代碼與關鍵字為 TED 上的歐盟公開招標評分媒合，並提供歷屆得標者與價格。

Streamable HTTP可網頁執行驗證方式
商業與電商需要憑證Nov 4, 2026

Local Business Lead Finder

由 GitHub 帳號 ellokillox 發布

在Google Maps上查詢沒有網站的本機商家，然後將其匯出為CSV。AI 翻譯

STDIO僅桌面
資料與分析尚未驗證Nov 3, 2026