launch-detector-mcp
launch-detector-mcp
See what a company is building before they announce it. Every website needs a TLS certificate, and every certificate is published in public certificate transparency logs, usually weeks before a new subdomain goes live. This MCP server reads those logs through crt.sh and surfaces new product-like subdomains, so Claude (or any MCP client) can tell you what a competitor might be about to launch.
No API keys. One line to install.
You: Anything new brewing at Linear?
Claude: [launch_signals(domain="linear.app", days=365)]
• "orbit" is the strongest new name: orbit.linear.app and *.orbit.linear.app
first got certificates on 2026-08-24. A wildcard under it suggests
something that hosts many sub-sites.
• "checkout" (2026-06-29) and "asks" (2026-02-10) are also new.
These are hints from certificate logs, not announcements.Summarized from real tool output, 1 Oct 2026.

Why
You want to know | Without it | With launch-detector |
What a competitor is building | Wait for the press release |
|
Whether a rumored product is real | Guess |
|
When a company got busy | Nothing |
|
What changed across 5 rivals this month | Check each by hand |
|
Related MCP server: ctscout
How it works
flowchart LR
C[Claude / MCP client] -->|tool call| S[launch-detector-mcp]
S --> T[crt.sh: every certificate for *.domain]
T --> N[Hostnames with first/last seen dates]
N --> K["Stem: stt-a100.titanium.api.x.com → titanium<br/>drop regions, numbered nodes, mail/cdn/www"]
K --> R[Score: new + several hostnames + staging/beta/preview + product words]
R -->|ranked names with evidence| CStaging, beta, preview and sandbox variants are kept as signals, not dropped: a product that gets a staging host first is often close to launch. Results are cached for a day on disk (~/.cache/launch-detector).
Install
Requires uv.
Claude Code
claude mcp add launch-detector -- uvx launch-detector-mcpClaude Desktop / Cursor (claude_desktop_config.json / .cursor/mcp.json)
{
"mcpServers": {
"launch-detector": {
"command": "uvx",
"args": ["launch-detector-mcp"]
}
}
}Tools
Tool | What it does |
| New product-like names under a domain in the window, ranked, with the reasons and example hostnames |
| Raw evidence: every hostname first seen in the window, with its name and environment words |
| New hostnames per month and which product-like names appeared each month |
| Radar over 2–8 competitors: new hostnames and top signals per company |
| First/last certificate, count and issuers for one hostname |
Prompts: whats_coming (one company), competitor_radar (several companies).
Try these
"What might Stripe launch next? Use the last 6 months."
"Run a launch radar on openai.com, anthropic.com and mistral.ai for the last 30 days."
"When did Linear's certificate activity spike this year?"
Limits (read these)
Hints, not proof. A new hostname can be an internal tool, a test, a vendor integration or a renamed service.
Companies that use wildcard certificates (
*.example.com) for everything reveal less.crt.sh is a free community service: it is slow (20–60 s for big domains) and often busy; the server retries and caches, but sometimes you will need to try again.
Only public certificate data is used. Please use it for market research, not to probe systems.
Part of the keyless MCP series
Open-source MCP servers that answer one market question each, with public data and no API keys.
Server | Question it answers |
What do users hate about competitor apps and games? (App Store + Steam reviews) | |
How did a SaaS pricing page change over the years? (Wayback Machine) | |
Which skills are tech companies hiring for, and which are rising? (HN Who is hiring) | |
What does each LLM cost, and did it get cheaper? (OpenRouter + price history) | |
launch-detector-mcp (this one) | What is a company about to launch? (certificate transparency logs) |
Development
uv sync --extra dev
uv run pytest # offline tests with a mocked crt.sh
uv run python scripts/smoke_live.py # live check against crt.sh (a few minutes)
uv run --with rich python scripts/demo.py linear.app # terminal demo (vhs docs/demo.tape records the GIF)MIT © Ali Altunar
Available Tools
5 toolshostname_historyBRead-onlyIdempotent
When one hostname first and last got a certificate, how many, and from which issuers.
| Name | Required | Description | Default |
|---|---|---|---|
| hostname | Yes | A full hostname, e.g. 'console.anthropic.com'. | |
| response_format | No | 'markdown' (default) or 'json'. | markdown |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, openWorldHint, and destructiveHint=false, so the safety profile is fully covered. The description adds useful scope by stating what data is retrieved, but does not disclose auth needs, rate limits, or error behavior beyond what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single short sentence with no wasted words, and the key information is front-loaded. However, it is a grammatical fragment rather than a complete sentence, which slightly reduces structural clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With a complete input schema, rich annotations, and an output schema, the description only needs to establish purpose and scope. It does that adequately for a simple lookup tool, though it could better situate itself among the related sibling tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the hostname and response_format parameters are already well documented by the input schema. The description adds no additional meaning about parameter usage or formatting, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the resource (one hostname's certificate history) and the data returned: first/last issuance, count, and issuers. It is more specific than a tautology, but lacks an explicit verb and does not distinguish itself from sibling tools like subdomain_timeline or watch_domains.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description offers no when-to-use guidance, no exclusions, and no mention of alternatives among the sibling tools. An agent must infer the appropriate context solely from the stated purpose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
launch_signalsBRead-onlyIdempotent
Product-like names that first appeared under a domain in the window, ranked by how much they look like an upcoming launch (new, several hostnames, staging/beta/preview variants, product words).
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | ||
| days | No | Look-back window in days. | |
| domain | Yes | Company domain, e.g. 'anthropic.com' or 'stripe.com'. | |
| response_format | No | 'markdown' (default) or 'json'. | markdown |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, openWorld and non-destructive, so safety is covered. The description adds value by revealing the ranking heuristic and that results are scoped to a look-back window, but it says nothing about cost, rate limits, or result ordering guarantees.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that puts the returned entity first and the ranking factors after. Dense but every clause carries information; no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value structure need not be explained, and the ranking logic is described. However, for a heuristic/analytical tool with four siblings in the same domain-history space, the definition omits any routing guidance or caveats about false positives, leaving a gap in how to deploy it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 75% – days, domain and response_format are documented in the schema, only 'top' lacks a description. The description gestures at the time window ('in the window') but adds no format, default, or constraint detail beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb-like result ('product-like names that first appeared under a domain') and enumerates the ranking signals (newness, several hostnames, staging/beta/preview variants, product words), so an agent knows what comes back. It does not distinguish this from siblings like new_subdomains or subdomain_timeline, which return adjacent data, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use statement, no exclusions, and no mention of the sibling tools that cover overlapping data (new_subdomains, subdomain_timeline, hostname_history). The use case can be inferred from 'upcoming launch' but the agent is left to guess when this beats the alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
new_subdomainsBRead-onlyIdempotent
Raw evidence: every hostname whose first certificate appeared in the window, newest first, with its product-like name and environment words.
| Name | Required | Description | Default |
|---|---|---|---|
| days | No | Look-back window in days. | |
| limit | No | ||
| domain | Yes | Company domain, e.g. 'anthropic.com' or 'stripe.com'. | |
| response_format | No | 'markdown' (default) or 'json'. | markdown |
| include_infrastructure | No | Also list hostnames that look like plumbing (numbered nodes, regions, mail...). |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, openWorldHint, and destructiveHint=false, so safety is covered. The description adds valuable behavioral context beyond annotations: the ordering (newest first), the data provenance (first certificate appearance in the window), and the enrichment fields (product-like name and environment words).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single efficient sentence with no wasted words. The front-loaded phrase 'Raw evidence' is somewhat vague, but the sentence remains compact and informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema and annotations, the description need not explain return values or safety. However, the tool has four closely related siblings and the description provides no routing guidance, which is a meaningful contextual gap for selection among subdomain-related tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 80%, which is high, so the baseline is 3 even though the description adds no parameter semantics. The description does not explain domain, days, limit, response_format, or include_infrastructure, but the schema already documents most of these.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific resource and filtering criterion: hostnames whose first certificate appeared in the given window, ordered newest first. It does not explicitly differentiate this from sibling tools like subdomain_timeline or hostname_history, and it lacks an action verb, so it falls short of a perfect 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description offers no guidance on when to use this tool versus alternatives. It does not mention the sibling tools or the conditions under which raw new-subdomain evidence is preferred over a timeline or history view.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
subdomain_timelineBRead-onlyIdempotent
New hostnames per month and the product-like names that first appeared each month. Bursts often line up with launches, rebrands or new regions.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Company domain, e.g. 'anthropic.com' or 'stripe.com'. | |
| months | No | ||
| response_format | No | 'markdown' (default) or 'json'. | markdown |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint, so the safety profile is fully covered. The description adds interpretive framing about what bursts mean, but says nothing about downstream behavior (resolution, whether empty months appear, data sources). Modest added value against rich annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with what the tool returns. The second sentence is interpretive rather than structural but still earns its place as usage framing. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-shape explanation is not required, and annotations carry the safety profile. However the underexplained 'months' parameter and the lack of any differentiation from the overlapping sibling tools leave an agent with real gaps when choosing between them.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
At 67% schema description coverage, the description is expected to compensate for gaps. The 'months' parameter has no schema description and the description never mentions it; response_format is likewise untouched. Only 'domain' is well documented, and that comes from the schema itself, not the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource and scope: 'New hostnames per month and the product-like names that first appeared each month.' An agent can tell it produces a time-bucketed subdomain inventory. It does not differentiate itself from siblings like new_subdomains or hostname_history, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Bursts often line up with launches, rebrands or new regions' implies the tool is for detecting launch/rebrand activity, which is useful context. But there is no explicit when-to-use statement, no prerequisites, and no routing to the sibling tools that overlap in this space.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
watch_domainsBRead-onlyIdempotent
A radar over 2-8 competitors: new hostnames in the window and each one's top launch signals.
| Name | Required | Description | Default |
|---|---|---|---|
| days | No | Look-back window in days. | |
| domains | Yes | Competitor domains, e.g. ['openai.com', 'anthropic.com']. | |
| response_format | No | 'markdown' (default) or 'json'. | markdown |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, openWorldHint, and destructiveHint=false, so the safety profile is covered. The description adds that results are scoped to a time window and combine two signal types, but says nothing about rate limits, cost, or data limitations that would matter for a multi-domain sweep.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with no filler, and the competitor-scope constraint leads. It is a fragment rather than a full clause ('A radar over...'), which is slightly terse but not wasteful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values needn't be spelled out, and annotations carry the safety profile. Still, for a tool that merges two signal sources across multiple domains, one sentence leaves gaps around result granularity and how the two signal types interact.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so 'days', 'domains' (with the 2-8 bound), and 'response_format' are already fully documented in the schema. The description restates the 2-8 competitor limit and the window concept but adds no syntax or format detail beyond the schema, making the baseline 3 correct.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a concrete capability (monitoring new hostnames across 2-8 competitor domains) and the payload it returns ('top launch signals'). It's clear what the tool does but never distinguishes itself from siblings like new_subdomains or launch_signals, which appear to cover overlapping ground.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: the '2-8 competitors' and 'window' framing suggests a competitive-monitoring scenario, but there is no explicit when-to-use, when-not-to-use, or pointer to an alternative sibling. An agent must infer the choice from names alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v0.1.0- First observed
hostname_history - First observed
launch_signals - First observed
new_subdomains - First observed
subdomain_timeline - First observed
watch_domains
TDQS
Scored across 5 tools
Each tool targets a distinct aspect: ranked signals, raw hostname evidence, temporal aggregation, multi-domain radar, and single-hostname history. However, launch_signals and new_subdomains overlap in output (product-like names with environment words), differing mainly in ranking vs raw framing, so minor confusion is possible.
All tools use lower_snake_case with two-word names (launch_signals, new_subdomains, subdomain_timeline, hostname_history); watch_domains is the only verb-led name but still follows the same delimiter style. No mixing of conventions.
5 tools is well-scoped for a focused launch-detection service. Each tool covers a distinct analytical angle without redundancy or thinness.
Covers signal detection, raw evidence, timeline, competitor watch, and hostname history—core workflows for the domain. Minor gaps: no tool to list all current subdomains for a domain (only new ones in a window) or to search product names across multiple domains, but these are workable.
Maintenance
Related MCP Connectors
Certificate Transparency search: subdomains, certificate history and hostname keyword search.
New and pre-launch Shopify stores from public CT logs: RDAP date, niche, country. No PII.
Passive domain-perimeter checks — cert expiry, subdomain takeover, lookalikes — as agent tools
Discover exposed assets, leaked secrets, APIs & client-side vulns across your attack surface
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceEnables SSL/TLS certificate search and analysis using crt.sh data, supporting domain certificate discovery, subdomain enumeration, and security auditing through Cloudflare Workers deployment.-
- AlicenseAqualityAmaintenanceEnables named-entity attribution from Certificate Transparency logs (OV/EV only) for mapping legal-entity digital footprints and domain discovery via LLM-driven workflows.726 npmMIT
- AlicenseNot gradedqualityAmaintenancePassive external attack-surface mapping server that discovers subdomains, DNS records, TLS posture, HTTP headers, and registration data via public sources like CT logs, Shodan, and RDAP/WHOIS, enabling security reconnaissance without active scanning.267 npm1Apache 2.0
- AlicenseAqualityDmaintenanceEnables LLMs to query Certificate Transparency logs via CertIndex API, allowing searches for TLS certificates, subdomains, and certificate metadata.642 PyPIMIT