vulnerability-exposure-mcp

Overview Schema Source Related Servers Discussions Admin

Subdomains from certificate logs

subdomains

Read-onlyIdempotent

Find hostnames under a domain from public certificate transparency logs to discover other hosts it may run, including ones that no longer exist. No API key required.

Instructions

Hostnames under a domain that have had TLS certificates, from public certificate transparency logs (crt.sh, or Cert Spotter if crt.sh is down). Use it to find other hosts a domain runs; they may no longer exist. No key needed.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "domain": "<domain>"
    },
    "name": "subdomains"
  }
}

Input Schema

Name	Required	Description	Default
`domain`	Yes	A domain name, e.g. 'example.com'.
`investigation_id`	No	The investigation_id from investigate_target. Pass it so the result counts toward that investigation's evidence, budget and key facts; without it the lookup runs on its own.

Schema Changelog

Changes observed during successful MCP inspections.

Changed2 schema fields changedv1.0.1Oct 29, 2026

addedInput schema / properties / domain / description

Added value: +"A domain name, e.g. 'example.com'."

addedInput schema / properties / investigation_id / description

Added value: +"The investigation_id from investigate_target. Pass it so the result counts toward that investigation's evidence, budget and key facts; without it the lookup runs on its own."

First observedv0.1.0Oct 25, 2026

TDQS

A4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, openWorldHint and destructiveHint=false, so the description only needs to add context — and it does: the upstream data sources, the automatic fallback when crt.sh is down, the staleness of results, and "No key needed" (an auth requirement). It omits rate limits and result shape, which keeps it at 4 rather than 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with what the tool returns and where the data comes from, then usage, then the auth note. Every clause carries information an agent needs; nothing is padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description does state what comes back (hostnames under the domain) and flags their unreliability, plus the auth and fallback behavior. It could say more about the returned shape (flat list, volume of results), but an agent has enough to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the schema itself explains both the domain format and the investigation_id linkage to investigate_target, including its budget/evidence effect. The description adds no parameter-level meaning beyond that, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the concrete resource (hostnames under a domain that have had TLS certificates) and its provenance (public certificate transparency logs, crt.sh with Cert Spotter fallback), which implicitly separates it from resolve_domain and shodan_search. It stops short of explicitly naming the sibling it replaces, so it lands just below the top band.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"Use it to find other hosts a domain runs" gives a clear triggering scenario, and the caveat "they may no longer exist" warns about result quality. There is no explicit when-not or named alternative (e.g. use resolve_domain for live DNS), so it is context without exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.