Skip to content
MCPSTAMP

AnswerLive data

Can Claude find the subdomains of a website?

Not on its own. Claude can't send DNS queries or read certificate transparency logs, and web search only shows hosts that someone happened to link to. Connect the free Subdomain Finder server and Claude reads public certificate transparency logs (Cert Spotter, then crt.sh) for the domain, lists the hostnames with first and last seen dates, flags wildcard certificates and can resolve the names over DNS. Use it on domains you own or are allowed to test.

Connect free, no token Subdomain finder MCP server

What Claude does alone, and what needs the server

Claude on its own

  • Explains certificate transparency, DNS and what a subdomain is.
  • Suggests common names such as www, mail and api to check by hand.

With the Subdomain Finder server

  • Every hostname that appeared on a public TLS certificate for the domain.
  • Wildcard entries, which hide individual hosts.
  • DNS resolution and a short attack surface summary.

A real call to the live server

We sent this to the hosted server on 2026-11-03. The answer below is the server's own text, not a mock-up. Live values will differ when you ask.

You ask

Which subdomains of zovo.one show up in certificate logs?

Tool call

find_subdomains {"domain":"zovo.one","limit":20}

Server answer

101 unique hostnames under zovo.one in 218 certificates from certspotter (first 3 pages only; raise max_pages for more). 100 wildcard entries (*.anon.zovo.one, *.ar-aging.zovo.one, *.avery-labels.zovo.one, ...), so some hosts will never appear in CT. Newest: ar-aging.zovo.one (2026-10-26), cap-table.zovo.one (2026-10-26), client-report.zovo.one (2026-10-26), depreciation.zovo.one (2026-10-26), gradebook.zovo.one (2026-10-26). Showing 20 of 101. certspotter lists unexpired certificates only.

zovo.one is our own domain. The full answer lists each hostname with its dates and certificate issuer.

Connect it in 1 minute

One URL, no token, no account. In Claude.ai or Claude Desktop open Settings, then Connectors, then Add custom connector, and paste the URL.

Connector URL

https://subdomain-finder-mcp.lipmichal.workers.dev/mcp

Claude Code

claude mcp add --transport http subdomain-finder https://subdomain-finder-mcp.lipmichal.workers.dev/mcp

Cursor (~/.cursor/mcp.json)

{
  "mcpServers": {
    "subdomain-finder": {
      "url": "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp"
    }
  }
}

VS Code (.vscode/mcp.json)

{
  "servers": {
    "subdomain-finder": {
      "type": "http",
      "url": "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp"
    }
  }
}

All 4 tools, sources and more prompts: Subdomain finder MCP server · Bug Bounty Reality

Questions

Can Claude find the subdomains of a website?
Not on its own. Claude can't send DNS queries or read certificate transparency logs, and web search only shows hosts that someone happened to link to. Connect the free Subdomain Finder server and Claude reads public certificate transparency logs (Cert Spotter, then crt.sh) for the domain, lists the hostnames with first and last seen dates, flags wildcard certificates and can resolve the names over DNS. Use it on domains you own or are allowed to test.
Does it scan or brute force anything?
No. It reads public certificate transparency logs and, if you ask, resolves names over DNS. It does not probe ports or guess names.
Why are some hosts missing?
A host behind a wildcard certificate never appears by name in the logs, and certspotter lists unexpired certificates only. Use crt.sh with expired certificates for older names.
Is the server free?
Yes. The Subdomain Finder server is free at its hosted URL with no token, key or account. The source is open on GitHub.

More questions people ask Claude

All answers · All free servers