SA

Subdomain API

app.subdomain/subdomains

Find known subdomains of a domain. Passive data; may include historic entries. List or count.

Yes, your AI can use this right now.Answered a live MCP handshake in 550 ms with no sign-in needed and exposes 2 tools.

Connect it

Settings → Connectors → Add custom connector
URL: https://api.subdomain.app/mcp

2 tools, verified live

Pulled straight from the server with tools/list on 2026-10-17.
find_subdomainsread-only

List known subdomains (hostnames) of a root domain. Data is passive (not active scanning): results are historic observations and may include subdomains that no longer resolve or are no longer live. Results are a point-in-time snapshot that changes over time as new subdomains are observed — re-query rather than caching the result. Use for attack-surface mapping, security recon, asset inventory, o

count_subdomainsread-only

Return only the total number of distinct subdomains known for a domain — no list. Cheap and low-token. Use when the user asks "how many subdomains" or you only need the size of the attack surface. Count includes historic subdomains that may no longer be live. It is a point-in-time figure that changes over time, so treat it as current-as-of-query, not a fixed value.

Alternatives in Developer Tools

Compare →
Try “Notion”, “Stripe”, “create invoice”, “browser”