Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@subsweep-recon Run full recon on example.com and find leads"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
SubSweep is an all-in-one OSINT reconnaissance suite, perimeter port scanner, technology stack fingerprinter, and B2B decision-maker lead intelligence engine.
Designed for security researchers, DevSecOps teams, and B2B growth operators, SubSweep pairs a high-performance Python engine with a Google Material 3 Light Mode Studio UI and native Model Context Protocol (MCP) tool servers for AI assistants (Claude, Cursor, Cline, Zed).
Related MCP server: osint-mcp-server
🌐 Multi-Source Subdomain Reconnaissance:
Passive Certificate Transparency (CT) log mining (crt.sh, AlienVault OTX, CertSpotter).
DNS record aggregation (A, AAAA, MX, TXT, SPF, DKIM, DMARC) with wildcard resolution detection.
🏢 B2B Lead Harvester & Decision Maker Qualification:
Extracts executive contacts (CISO, CTO, VP of Eng, Directors) with deliverable business emails.
Computes a mathematical Lead Quality Score (0–100) evaluating deliverability, seniority, phone availability, and social footprints.
🔬 Deep Technology Stack Fingerprinting:
Detects frontend frameworks (React, Next.js, Vue, Angular), cloud CDNs (Cloudflare, Fastly, CloudFront), and CMS engines (WordPress, Webflow, Shopify).
Audits essential HTTP security headers (HSTS, CSP, X-Frame-Options).
🔌 Perimeter Port & Service Matrix:
Rapid, non-intrusive TCP port auditing (22, 80, 443, 3306, 5432, 8443) with service banner grabbing and risk classifications.
🤖 Native Model Context Protocol (MCP) Server:
Zero-configuration stdio tool server empowering AI agents to run live reconnaissance and lead research directly from chat.
🎨 Google Material 3 Recon Studio UI:
100% offline-ready, single-file browser app (public/index.html) with zero tracking, dynamic score dials, interactive tree visualizer, and 1-click CSV/JSON/Markdown exports.
flowchart TD
Target["Target Domain\n(e.g., acme-cloud.io)"] --> Engine["SubSweep Core Engine"]
subgraph Discovery ["OSINT & Recon Discovery"]
Engine --> CT["Certificate Transparency & Passive DNS"]
Engine --> Ports["Perimeter Port Matrix & Banners"]
Engine --> Tech["Tech Fingerprinter & Security Headers"]
Engine --> Leads["Business Lead & Contact Harvester"]
end
Discovery --> Merge["Normalization & Scoring Framework"]
subgraph Interfaces ["Multi-Channel Interfaces"]
Merge --> CLI["CLI Terminal Engine\n(subsweep recon)"]
Merge --> MCP["MCP AI Agent Server\n(Claude / Cursor / Zed)"]
Merge --> UI["Google Material 3 Studio\n(public/index.html)"]
Merge --> Exporters["Executive Intelligence Bundles\n(CSV / JSON / Markdown)"]
endpip install subsweep-lead-scannergit clone https://github.com/subsweep-lead-scanner/subsweep-lead-scanner.git
cd subsweep-lead-scanner
pip install -e .# Run full recon and print formatted console tables
subsweep recon acme-cloud.io
# Export full reconnaissance data to JSON
subsweep recon acme-cloud.io --output audit_report.json --format json# Harvest leads with minimum score 80 and export to CSV
subsweep leads acme-cloud.io --min-score 80 --export leads.csv
# Filter for C-Suite and VP executives only
subsweep leads acme-cloud.io --exec-only --format jsonOpen public/index.html in any web browser:
# Linux
xdg-open public/index.html
# macOS
open public/index.html
# Windows
start public/index.htmlConnect SubSweep directly to Claude Desktop, Cursor IDE, Cline, or Zed.
Add to your claude_desktop_config.json:
{
"mcpServers": {
"subsweep-recon": {
"command": "python",
"args": ["-m", "subsweep_lead_scanner.mcp_server"],
"env": {
"SUBSWEEP_RATE_LIMIT": "50",
"SUBSWEEP_TIMEOUT": "10"
}
}
}
}See docs/MCP_GUIDE.md for Cursor, Cline, and Zed configurations.
SubSweep ranks prospects on a 0–100 scale using multi-factor heuristics:
$$\text{Score} = \min(100, W_{\text{email}} + W_{\text{seniority}} + W_{\text{social}} + W_{\text{phone}} + W_{\text{tech}})$$
Factor | Weight | Evaluation Criteria |
Deliverable Email |
| Active MX record, RFC syntax valid, $\ge 95%$ deliverability confidence. |
Executive Seniority |
| CISO, CTO, CEO, VP of Engineering, Head of Security. |
Social Footprint |
| Verified LinkedIn profile, Twitter/X handle, GitHub profile. |
Direct Phone Reachability |
| Direct office dial or mobile number. |
Tech Stack Fit |
| Cloud-native modern infrastructure (AWS, GCP, Kubernetes, Next.js). |
See docs/LEAD_SCORING_METHODOLOGY.md for full details.
subsweep-lead-scanner/
├── .github/
│ └── workflows/
│ ├── ci.yml # 15-job CI test matrix (Ubuntu/macOS/Win, Py 3.9-3.13)
│ └── release.yml # Automated release & SHA-256 packaging
├── docs/
│ ├── OSINT_RECON_GUIDE.md # In-depth OSINT discovery architecture
│ ├── LEAD_SCORING_METHODOLOGY.md # 0-100 mathematical lead scoring guide
│ └── MCP_GUIDE.md # Model Context Protocol setup for AI agents
├── examples/
│ ├── domain-recon-audit/ # Domain recon reference script & JSON report
│ ├── lead-generation-pipeline/# Lead scoring exporter & sample CSV
│ ├── mcp-clients/ # Claude, Cursor, Cline, Zed JSON configs
│ └── README.md # Examples index & quickstart
├── public/
│ └── index.html # Google Material 3 Light Mode Recon Studio UI
├── src/
│ └── subsweep_lead_scanner/ # Core Python package engine
├── tests/
│ └── test_examples.py # Unit tests covering all examples, UI, and configs
└── README.md # Project READMERun the test suite with pytest:
PYTHONPATH=src pytest tests/ -vReleased under the MIT License. Built with privacy-first principles.
This server cannot be deployed
Search companies, enrich contacts, and reveal emails and phones from your AI agent.
Domain intel for AI agents: RDAP registration, DNS, email deliverability, tech stack.
Domain intel for AI agents: RDAP registration, DNS, email deliverability, tech stack.
Give AI agents the LinkedIn tools to find, qualify, engage, and follow up with prospects.
