Subdomain API

app.subdomain/subdomainsVersion 1.0.1

Find known subdomains of a domain. Passive data; may include historic entries. List or count.

Status

Responds383 msNov 14, 2026, 13:38 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 13:38 UTC
Latency: 383 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 22:14 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://api.subdomain.app/mcpResponds383 msNov 14, 2026, 13:38 UTC

No sign-in

Claude Code

claude mcp add --transport http subdomains https://api.subdomain.app/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: subdomains
Remote MCP server URL: https://api.subdomain.app/mcp

Cursor

{
  "mcpServers": {
    "subdomains": {
      "url": "https://api.subdomain.app/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"subdomains","type":"http","url":"https://api.subdomain.app/mcp"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

2 tools

Tools of Subdomain API
	Description		Read-only	Idempotent	Open world
`count_subdomains`Return only the total number of distinct subdomains known for a domain — no list. Cheap and low-token. Use when the user asks "how many subdomains" or you only need the size of the attack surface. Count includes historic subdomains that may no longer be live. It is a point-in-time figure that changes over time, so treat it as current-as-of-query, not a fixed value.	Return only the total number of distinct subdomains known for a domain — no list. Cheap and low-token. Use when the user asks "how many subdomains" or you only need the size of the attack surface. Count includes historic subdomains that may no longer be live. It is a point-in-time figure that changes over time, so treat it as current-as-of-query, not a fixed value.	Not declared	Yes	Yes	Yes
`find_subdomains`List known subdomains (hostnames) of a root domain. Data is passive (not active scanning): results are historic observations and may include subdomains that no longer resolve or are no longer live. Results are a point-in-time snapshot that changes over time as new subdomains are observed — re-query rather than caching the result. Use for attack-surface mapping, security recon, asset inventory, or SEO host discovery. Hostnames are returned most-recently-seen first. The response always reports `total` (full distinct count known) and a `truncated` flag, so you can tell when more exist beyond `limit`.	List known subdomains (hostnames) of a root domain. Data is passive (not active scanning): results are historic observations and may include subdomains that no longer resolve or are no longer live. Results are a point-in-time snapshot that changes over time as new subdomains are observed — re-query rather than caching the result. Use for attack-surface mapping, security recon, asset inventory, or SEO host discovery. Hostnames are returned most-recently-seen first. The response always reports `total` (full distinct count known) and a `truncated` flag, so you can tell when more exist beyond `limit`.	Not declared	Yes	Yes	Yes

Details

Registry status: Active
Published: Jun 26, 2026
Updated: Jun 26, 2026
Website: https://subdomain.app/⁠ (opens in a new tab)
Repository: Not given
Categories: Uncategorized
GDPR: Not declared

Are you the operator? Claim this listing