subdomain_enumerationDiscover subdomains by querying certificate-transparency logs, then optionally resolve a bounded candidate list for reconnaissance.
Query certificate-transparency logs and optionally resolve a bounded candidate list.
| Name | Required | Description | Default |
|---|---|---|---|
| active | No | ||
| domain | Yes | ||
| candidates | No |
| Name | Required | Description | Default |
|---|---|---|---|
| count | Yes | ||
| domain | Yes | ||
| subdomains | Yes |
Changes observed during successful MCP inspections.
v2.2.0Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnlyHint, idempotentHint, destructiveHint=false, openWorldHint), so the description only needs to add operating context. It does add two useful facts: the primary source is passive CT logs, and an optional active DNS resolution step exists. It stops short of explaining what the active mode costs, what it returns, or any rate/timeout constraints on live resolution.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the passive-then-optional-active structure is easy to parse. It is arguably over-terse for a tool with an entirely undocumented schema, but nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no explanation, and rich annotations cover safety semantics. The remaining gaps are sibling differentiation and candidate/active mechanics, which push this below a definitively complete definition but leave it serviceable for a 3-parameter discovery tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry the semantics, and it only partially maps to the three parameters: 'certificate-transparency logs' ties to domain, 'optionally resolve' ties to active, and 'bounded candidate list' gestures at candidates. It never explains that candidates are DNS names to resolve, what the bound actually is (schema enforces maxItems 100), or the default of active=false, leaving important details to the schema's raw constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The verb 'query certificate-transparency logs' plus the resource (subdomains/candidate list) makes the mechanism clear, and 'optionally resolve' hints at the active mode. However, with siblings like subfinder_discovery, amass_passive_discovery, assetfinder_discovery and dns_enumeration, the description never says how this differs from those overlapping subdomain-discovery tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use or when-not-to-use guidance, no mention of prerequisites (e.g. a domain that participates in CT), and no routing to any of the four sibling subdomain-discovery tools that an agent must choose between. The only implied usage is 'you want subdomains', which the siblings also satisfy.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.