Skip to main content
Glama

BlackVeil DNS & Email Security Scanner

by com.blackveilsecurity
OverviewDiscussionsAdmin

discover_subdomains

Read-onlyIdempotent

Find subdomains of a domain using Certificate Transparency logs. Reveals shadow IT, forgotten services, and unauthorized certificate issuance. Returns a CT SAMPLE, not an asset inventory: the count is a lower bound, a host with no publicly-logged certificate never appears, and the result carries a per-source coverage record stating what was actually consulted. countBasis says whether totalSubdomains is the tool’s normal reach (sample) or a floor from a run whose recall was cut (then minSubdomainsObserved is present); concreteSubdomains excludes wildcard patterns.

Input Schema

NameRequiredDescriptionDefault
domainYesDomain to check (e.g., example.com)
formatNoOutput verbosity. Auto-detected if omitted.
force_refreshNoBypass cache and run a fresh check. Useful after DNS changes.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • addedInput schema / additionalProperties
      Added value: +false
  2. Changed1 schema field changed
    • addedInput schema / properties / force_refresh
      Added value: +{
+  "description": "Bypass cache and run a fresh check. Useful after DNS changes.",
+  "type": "boolean"
+}
  3. First observed

TDQS

A3.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations by disclosing the core limitation: results are a CT sample, not an inventory; the count is a lower bound; hosts without logged certificates are invisible; a per-source `coverage` record is returned. It also explains `countBasis`/`minSubdomainsObserved` fallback semantics and that `concreteSubdomains` excludes wildcards, which prevents misreading the output.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads purpose and then the most important caveat (sample, not inventory). The closing sentence about `countBasis` is dense and jargon-heavy, though it does earn its place by defining fields an agent would otherwise misread.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the burden of explaining return semantics and does so for counts, coverage, and wildcards. Minor gaps remain: no mention of pagination/size limits, auth or rate-limit constraints, or cache TTL that `force_refresh` interacts with.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents `domain`, `format`, and `force_refresh` including the cache-bypass rationale. The description adds no parameter-level detail, which meets the baseline but no more.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource — find subdomains of a domain via Certificate Transparency logs — plus the security value it delivers (shadow IT, forgotten services). It never names a sibling (e.g. check_subdomain_takeover or discover_brand_domains) to distinguish itself, so the agent must infer the boundary from the name alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Useful context is implied (reconnaissance of a domain's exposed attack surface), but there is no explicit when-to-use, when-not-to-use, or pointer to a neighboring tool. The agent gets no routing guidance for choosing this over check_shadow_domains or discover_brand_domains.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All BlackVeil DNS & Email Security Scanner toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources