Skip to content
MCPSTAMP

Live dataNo token

Subdomain finder MCP server

Passive subdomain discovery from live certificate transparency logs, with DNS checks for live and dangling hosts.

Connect free Source on GitHub

Free. No key, no sign-in, no paid tier. 4 tools.

Connector URL

https://subdomain-finder-mcp.lipmichal.workers.dev/mcp

Paste it as a custom connector in Claude, or add it to Claude Code, Cursor or VS Code. Setup for each is below.

What it knows that a model does not

A model answers from training data. This server reads the source when you ask.

  • A domain's current subdomains. New hosts show up in certificate logs within minutes, and a model's training data never had most of them.
  • Which hosts resolve right now, which CNAMEs point at a deleted cloud resource, and whether the zone has wildcard DNS.
  • When each name first got a certificate, which CA issued it and when the current one expires.

Sources certspotter and crt.sh certificate transparency logs, Cloudflare DNS over HTTPS. Passive only, for authorized recon.

Tools (4)

Read from the live server with tools/list on 2026-11-02.

ToolWhat it does
find_subdomains Find subdomains (certificate transparency). Passive subdomain enumeration for a domain from live certificate transparency logs: certspotter (unexpired certificates) with crt.sh as fallback or for expired history.
resolve_subdomains Resolve subdomains (DNS over HTTPS). Resolve up to 40 hostnames now through Cloudflare DNS over HTTPS (A, AAAA and the CNAME chain).
get_certificate_history Get certificate history for a host. Certificates logged in certificate transparency for one hostname (or a whole domain with include_subdomains): issuer organisation and DN, not_before and not_after dates, every SAN on the certificate, revocation status and SHA-256 where certspotter has them.
summarize_attack_surface Summarize attack surface from CT. Reads a domain's subdomains from live certificate transparency and groups them for recon triage: development and test, staging, admin and internal tools, APIs, authentication, mail, remote access (VPN), storage and CDN, legacy and backup.

Connect it

One URL, no token. Pick your app.

Claude.ai and Claude Desktop

Open Settings, then Connectors, then Add custom connector. Paste the URL. Leave the OAuth fields empty. Save.

https://subdomain-finder-mcp.lipmichal.workers.dev/mcp

Claude Code

Run this in your terminal. Then run claude mcp list to check it.

claude mcp add --transport http subdomain-finder https://subdomain-finder-mcp.lipmichal.workers.dev/mcp

Cursor

Merge this into ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (one project).

{
  "mcpServers": {
    "subdomain-finder": {
      "url": "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp"
    }
  }
}

VS Code

Put this in .vscode/mcp.json. The top key is servers, not mcpServers.

{
  "servers": {
    "subdomain-finder": {
      "type": "http",
      "url": "https://subdomain-finder-mcp.lipmichal.workers.dev/mcp"
    }
  }
}

Things to ask

Paste one into a new chat after you connect.

Sourcegithub.com/theluckystrike/subdomain-finder-mcp Web calculatorBug Bounty Reality

Questions

Is the subdomain finder MCP server free?
Yes. The hosted URL is free and needs no token, key or account. The source is open on GitHub.
Why not just ask the model?
A model answers from its training data. That data stops at a cutoff date, and long sums can drift. This server reads its data or rules each time you ask, so the answer is current and exact.
Where does the data come from?
certspotter and crt.sh certificate transparency logs, Cloudflare DNS over HTTPS. Passive only, for authorized recon.
Which apps can use it?
Any MCP client that accepts a remote server URL: Claude.ai and Claude Desktop custom connectors, Claude Code, Cursor, VS Code and others. You can also run it locally with npx.

More free live-data servers

All free servers ยท Back-office servers on McpStamp