Subdomain API

Find subdomains

find_subdomains

Read-onlyIdempotent

List known subdomains (hostnames) of a root domain. Data is passive (not active scanning): results are historic observations and may include subdomains that no longer resolve or are no longer live. Results are a point-in-time snapshot that changes over time as new subdomains are observed — re-query rather than caching the result. Use for attack-surface mapping, security recon, asset inventory, or SEO host discovery. Hostnames are returned most-recently-seen first. The response always reports total (full distinct count known) and a truncated flag, so you can tell when more exist beyond limit.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`limit`	No	Max subdomains to return (1-1000, default 200). `total` always reports the full count regardless of this cap.
`domain`	Yes	Root (registrable) domain as a bare hostname, e.g. "example.com". No scheme, path, port, or leading "www." — these are stripped.

Output Schema

TableJSON Schema

Name	Required	Description
`total`	Yes	Total distinct subdomains known.
`domain`	Yes
`returned`	Yes	Number in `subdomains`.
`truncated`	Yes	True if more exist beyond `limit`.
`subdomains`	Yes

TDQS

A4.5/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes beyond the annotations by explaining several important behavioral traits: results are passive/historic, may be stale, represent a point-in-time snapshot that changes, and should be re-queried rather than cached. It also discloses ordering (most-recently-seen first) and the presence of total and truncated flags, which are not covered by readOnlyHint, openWorldHint, or idempotentHint.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise yet information-dense, with each sentence adding meaningful context: purpose, data nature, use cases, ordering, and response metadata. There is no redundancy and the most important information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description does not need to explain return values. It adequately covers the tool's key context for correct use: passive data characteristics, time-sensitivity, ordering, and the total/truncated response fields. This is sufficient for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides detailed descriptions for both parameters (domain and limit), covering 100% of them. The description does not add significantly to parameter semantics beyond what the schema already states; it mentions the limit in relation to total and truncated only as an example of response behavior, not as a parameter explanation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists known subdomains of a root domain, using a specific verb and resource. It distinguishes from the sibling tool 'count_subdomains' by emphasizing 'List' and by describing response fields like total and truncated, which a count tool would not return.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly identifies several use cases (attack-surface mapping, security recon, asset inventory, SEO host discovery) that indicate when to use this tool. It does not explicitly mention when not to use it or name alternatives, but the provided context is clear enough for an agent to make an appropriate choice.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Subdomain API tools Inspect

Try in Browser

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.6/5.0

Disambiguation5/5

The two tools have clearly distinct purposes: one returns a count, the other returns a list. The descriptions explicitly highlight when to use each (e.g., 'how many subdomains' vs 'list them'), eliminating ambiguity.

Naming Consistency5/5

Both tools follow the same verb_noun pattern with snake_case: count_subdomains and find_subdomains. The naming is consistent, predictable, and aligns with the server's domain.

Tool Count4/5

With only two tools, the set is minimal but well-suited to the narrow purpose of passive subdomain enumeration. While it falls below the typical 3-15 range, the scope is so focused that two tools adequately cover the core functionality.

Completeness5/5

The tool set covers both main operations for the domain: getting a count and listing subdomains. The descriptions mention pagination/truncation for the list, but no other obvious operations are missing for the stated use cases (recon, inventory, etc.).

Resources

Need Help?