Koskamo

Subdomain Finder MCP

A community MCP server that performs passive subdomain enumeration using public certificate transparency logs like certspotter and crt.sh. It supports optional DNS checks via Cloudflare DoH to identify live hosts, dangling CNAMEs, and wildcard DNS. It also provides certificate history and attack surface summarization for security reconnaissance.

Endpoint and access

No sign-in to connect and list tools. Individual tools may still need a vendor account, credentials, or permissions; check the documented prerequisites.

Subdomain Finder MCP logo, by lipmichalCommunity listingStreamable HTTPNo sign-inEndpoint checked 2026-11-02Published by lipmichal
MCP endpoint (Streamable HTTP)
https://subdomain-finder-mcp.lipmichal.workers.dev/mcp
Vendor documentation

What you can do with it

  • Passive subdomain discovery from certificate transparency logs
  • DNS resolution checks for live hosts and dangling CNAMEs
  • Certificate history retrieval including issuers and validity dates
  • Summarizing attack surface by grouping subdomains into categories

Source and maintenance

Community listingRegistry 1.0.0
mcp-registry: io.github.theluckystrike/subdomain-finder-mcp@1.0.0Source repositoryProject website
Maintenance checked

Protocol and capabilities

Server
subdomain-finder-mcp 1.0.0
MCP protocol
2025-06-18
Tools
4 advertised
Resources
Not advertised
Resource templates
Not advertised
Prompts
Not advertised
Server-advertised capabilities
{
  "tools": {
    "listChanged": true
  }
}

Server-provided instructions

Untrusted server output shown for inspection. It is not Koskamo guidance and is excluded from knowledge search.

Live, passive subdomain discovery from certificate transparency logs (certspotter, crt.sh) plus DNS over HTTPS via Cloudflare. No port scans and no requests to the target. A model cannot know a domain's current subdomains from training data; call find_subdomains, then resolve_subdomains for the hosts that matter. For authorised recon only (bug bounty scope, your own assets).

Tools

4 advertised

find_subdomains — Find subdomains (certificate transparency)
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Passive subdomain enumeration for a domain from live certificate transparency logs: certspotter (unexpired certificates) with crt.sh as fallback or for expired history. Returns deduplicated hostnames with first seen and last seen issuance dates, certificate count, issuers and whether a wildcard certificate covers the name, plus the list of wildcard entries. Set resolve=true to also check the first 40 names with DNS over HTTPS and mark live hosts. Passive lookup of public certificate transparency logs; nothing is sent to the target. Use it on assets you own or are authorised to test.

find_subdomains input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "domain"
  ],
  "properties": {
    "limit": {
      "type": "integer",
      "default": 200,
      "maximum": 1000,
      "minimum": 1,
      "description": "Max hostnames returned (1-1000). Totals are always reported."
    },
    "domain": {
      "type": "string",
      "maxLength": 253,
      "minLength": 3,
      "description": "Registered domain, for example \"example.com\". A URL is accepted and reduced to its host."
    },
    "source": {
      "enum": [
        "auto",
        "certspotter",
        "crtsh"
      ],
      "type": "string",
      "default": "auto",
      "description": "auto = certspotter first (fast, unexpired certificates), crt.sh if it fails or throttles. crtsh = crt.sh only (includes expired with include_expired)."
    },
    "resolve": {
      "type": "boolean",
      "default": false,
      "description": "Also resolve up to 40 of the returned names over DNS (newest first)."
    },
    "max_pages": {
      "type": "integer",
      "default": 3,
      "maximum": 5,
      "minimum": 1,
      "description": "certspotter pages to read (1-5). Each page is one request against its keyless rate limit."
    },
    "include_expired": {
      "type": "boolean",
      "default": false,
      "description": "Also include names from expired certificates (uses crt.sh). Finds retired hosts; slower."
    }
  },
  "additionalProperties": false
}
find_subdomains annotations
{
  "title": "Find subdomains",
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
resolve_subdomains — Resolve subdomains (DNS over HTTPS)
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Resolve up to 40 hostnames now through Cloudflare DNS over HTTPS (A, AAAA and the CNAME chain). Each host is marked live, nxdomain, no_records or dangling_cname (a CNAME whose target does not exist, a subdomain takeover lead), and CNAME targets on cloud platforms (S3, Azure, Heroku, GitHub Pages, Netlify, Vercel and others) are named. Also probes a random label per parent domain to detect wildcard DNS. DNS lookups only; no connection is made to the hosts.

resolve_subdomains input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "hosts"
  ],
  "properties": {
    "hosts": {
      "type": "array",
      "items": {
        "type": "string",
        "maxLength": 253,
        "minLength": 3
      },
      "maxItems": 40,
      "minItems": 1,
      "description": "Hostnames, for example [\"www.example.com\", \"api.example.com\"]. Max 40."
    },
    "check_wildcard": {
      "type": "boolean",
      "default": true,
      "description": "Probe one random label under each parent domain (max 3) to detect wildcard DNS."
    }
  },
  "additionalProperties": false
}
resolve_subdomains annotations
{
  "title": "Resolve subdomains",
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
get_certificate_history — Get certificate history for a host
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Certificates logged in certificate transparency for one hostname (or a whole domain with include_subdomains): issuer organisation and DN, not_before and not_after dates, every SAN on the certificate, revocation status and SHA-256 where certspotter has them. Summarises first and last issuance and the issuers used, which shows CA changes and renewal cadence. Default source certspotter (unexpired); include_expired uses crt.sh for the full history.

get_certificate_history input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "host"
  ],
  "properties": {
    "host": {
      "type": "string",
      "maxLength": 253,
      "minLength": 3,
      "description": "Hostname, for example \"api.example.com\" or \"example.com\"."
    },
    "limit": {
      "type": "integer",
      "default": 25,
      "maximum": 100,
      "minimum": 1,
      "description": "Max certificates returned, newest first (1-100)."
    },
    "source": {
      "enum": [
        "auto",
        "certspotter",
        "crtsh"
      ],
      "type": "string",
      "default": "auto",
      "description": "auto = certspotter first (fast, unexpired certificates), crt.sh if it fails or throttles. crtsh = crt.sh only (includes expired with include_expired)."
    },
    "include_expired": {
      "type": "boolean",
      "default": false,
      "description": "Also include names from expired certificates (uses crt.sh). Finds retired hosts; slower."
    },
    "include_subdomains": {
      "type": "boolean",
      "default": false,
      "description": "Also include certificates for names under the host."
    }
  },
  "additionalProperties": false
}
get_certificate_history annotations
{
  "title": "Certificate history",
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}
summarize_attack_surface — Summarize attack surface from CT
Advertised by the server during the last successful anonymous check.
Advertised read-onlyOpen-world

Reads a domain's subdomains from live certificate transparency and groups them for recon triage: development and test, staging, admin and internal tools, APIs, authentication, mail, remote access (VPN), storage and CDN, legacy and backup. Each group has a count, examples and why it matters. Also returns naming clusters (for example *.eu.example.com), certificate issuers in use, wildcard entries and the 10 newest names. Passive only.

summarize_attack_surface input schema
{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "domain"
  ],
  "properties": {
    "domain": {
      "type": "string",
      "maxLength": 253,
      "minLength": 3,
      "description": "Registered domain, for example \"example.com\". A URL is accepted and reduced to its host."
    },
    "source": {
      "enum": [
        "auto",
        "certspotter",
        "crtsh"
      ],
      "type": "string",
      "default": "auto",
      "description": "auto = certspotter first (fast, unexpired certificates), crt.sh if it fails or throttles. crtsh = crt.sh only (includes expired with include_expired)."
    },
    "include_expired": {
      "type": "boolean",
      "default": false,
      "description": "Also include names from expired certificates (uses crt.sh). Finds retired hosts; slower."
    }
  },
  "additionalProperties": false
}
summarize_attack_surface annotations
{
  "title": "Attack surface summary",
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": false
}

Prompts

Not advertised

No prompt definitions available.

Resources

Not advertised

No resource definitions available.

30-day availability

Aggregated from read-only remote checks; this is not a tool-execution or security guarantee.

Successful checks
1 of 1 (100%)
Average latency
694 ms
95th percentile latency
694 ms

Maintenance history

Public check and source-refresh events. Editorial and ownership records remain private.

  • · probe · passed · 694 ms · metadata changed · 4 tool(s)

Connect from your client

Each snippet registers the same endpoint; pick the client you use.

This server is operated by the named third party. Listing and endpoint checks are not an endorsement or a security audit. Review the operator's permissions, terms, and data handling before connecting. How listings are checked and corrected.

Claude Code

Run this once in a terminal. It registers the remote server. Use --scope project to write .mcp.json for the repo.
Claude Code configuration
claude mcp add --transport http subdomain-finder-mcp https://subdomain-finder-mcp.lipmichal.workers.dev/mcp

Codex

Run this once. Codex stores MCP servers in ~/.codex/config.toml (or .codex/config.toml in a trusted project).
Codex configuration
codex mcp add subdomain-finder-mcp --url https://subdomain-finder-mcp.lipmichal.workers.dev/mcp

Cursor

Merge this server into .cursor/mcp.json in your project, then enable subdomain-finder-mcp in your MCP settings.
Cursor configuration
{
  "mcpServers": {
    "subdomain-finder-mcp": {
      "url": "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp"
    }
  }
}

Cline

Merge this into cline_mcp_settings.json (Cline → MCP Servers → Configure).
Cline configuration
{
  "mcpServers": {
    "subdomain-finder-mcp": {
      "type": "streamableHttp",
      "url": "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp",
      "disabled": false
    }
  }
}

VS Code

Merge this server into .vscode/mcp.json. Use MCP: List Servers to start subdomain-finder-mcp and inspect its tools.
VS Code configuration
{
  "servers": {
    "subdomain-finder-mcp": {
      "type": "http",
      "url": "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp"
    }
  }
}

Gemini CLI

Run this once. It writes .gemini/settings.json in the current project; pass --scope user for ~/.gemini/settings.json.
Gemini CLI configuration
gemini mcp add --transport http subdomain-finder-mcp https://subdomain-finder-mcp.lipmichal.workers.dev/mcp

Claude Desktop

Merge this into claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/, Windows: %APPDATA%\Claude\), then restart Claude Desktop.
Claude Desktop configuration
{
  "mcpServers": {
    "subdomain-finder-mcp": {
      "url": "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp"
    }
  }
}

Windsurf

Merge this into ~/.codeium/windsurf/mcp_config.json, then refresh MCP in Cascade. Windsurf remote servers use serverUrl, not url.
Windsurf configuration
{
  "mcpServers": {
    "subdomain-finder-mcp": {
      "serverUrl": "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp"
    }
  }
}

Let your agent find its tools

Find servers like Subdomain Finder MCP from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.

Connect Koskamo Explore workflows
See all 7,527