Subdomain Finder MCP

by FastDrop

MCP MCP VERIFIED Verified yesterday Registry import free

Passive subdomain enumeration from certificate transparency (certspotter, crt.sh) with DNS checks.

Passive subdomain enumeration from certificate transparency (certspotter, crt.sh) with DNS checks. Official MCP Registry: io.github.theluckystrike/subdomain-finder-mcp@1.0.0. Remote endpoint: https://subdomain-finder-mcp.lipmichal.workers.dev/mcp

Problem it solves

Discoverable MCP server listed in the official MCP Registry.

How it's different

Remote MCP endpoint ingested from the official registry and probed by FastDrop.

Ingested from the official MCP Registry

FastDrop pulled this entry from the official MCP Registry as io.github.theluckystrike/subdomain-finder-mcp and probed the endpoint. The maker did not submit it, so the outbound link is not endorsed and the description is not theirs.

If this is your server, claim the listing to edit it and take ownership. The registry index lists everything else still awaiting a probe.

Claim this listing

Tools this endpoint exposes

Read directly from the endpoint on 2 Nov 2026. Not supplied by the maker.

find_subdomains
Passive subdomain enumeration for a domain from live certificate transparency logs: certspotter (unexpired certificates) with crt.sh as fallback or for expired history. Returns deduplicated hostnames
resolve_subdomains
Resolve up to 40 hostnames now through Cloudflare DNS over HTTPS (A, AAAA and the CNAME chain). Each host is marked live, nxdomain, no_records or dangling_cname (a CNAME whose target does not exist, a
get_certificate_history
Certificates logged in certificate transparency for one hostname (or a whole domain with include_subdomains): issuer organisation and DN, not_before and not_after dates, every SAN on the certificate,
summarize_attack_surface
Reads a domain's subdomains from live certificate transparency and groups them for recon triage: development and test, staging, admin and internal tools, APIs, authentication, mail, remote access (VPN