NestDaddy

Subdomain Finder MCP

io.github.theluckystrike/subdomain-finder-mcp · v1.0.0

Passive subdomain enumeration from certificate transparency (certspotter, crt.sh) with DNS checks.

Connect Remote server

Terminal
claude mcp add --transport http subdomain-finder-mcp https://subdomain-finder-mcp.lipmichal.workers.dev/mcp
~/.cursor/mcp.json
{
  "mcpServers": {
    "subdomain-finder-mcp": {
      "url": "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp"
    }
  }
}
.vscode/mcp.json
{
  "servers": {
    "subdomain-finder-mcp": {
      "type": "http",
      "url": "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp"
    }
  }
}
Claude Desktop
Settings > Connectors > Add custom connector
URL: https://subdomain-finder-mcp.lipmichal.workers.dev/mcp

Tools 4 found in our last check

  • find_subdomains

    Passive subdomain enumeration for a domain from live certificate transparency logs: certspotter (unexpired certificates) with crt.sh as fallback or for expired history. Returns deduplicated hostnames with first seen and last seen issuance dates, certificate count, issuers and wh…

  • resolve_subdomains

    Resolve up to 40 hostnames now through Cloudflare DNS over HTTPS (A, AAAA and the CNAME chain). Each host is marked live, nxdomain, no_records or dangling_cname (a CNAME whose target does not exist, a subdomain takeover lead), and CNAME targets on cloud platforms (S3, Azure, Her…

  • get_certificate_history

    Certificates logged in certificate transparency for one hostname (or a whole domain with include_subdomains): issuer organisation and DN, not_before and not_after dates, every SAN on the certificate, revocation status and SHA-256 where certspotter has them. Summarises first and…

  • summarize_attack_surface

    Reads a domain's subdomains from live certificate transparency and groups them for recon triage: development and test, staging, admin and internal tools, APIs, authentication, mail, remote access (VPN), storage and CDN, legacy and backup. Each group has a count, examples and why…

Details

Endpointhttps://subdomain-finder-mcp.lipmichal.workers.dev/mcp (Streamable HTTP)
First published2 Nov 2026
Last updated2 Nov 2026
Registry nameio.github.theluckystrike/subdomain-finder-mcp

More other servers See all

Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.