Skip to main content
Glama

Subdomain Enum

subdomain_enum
Read-only

Discover subdomains by running all installed passive sources in parallel and merging deduplicated results filtered to the engagement scope.

Instructions

Enumerate subdomains from every installed passive source and merge them.

Runs whichever of subfinder / assetfinder / findomain / amass / theHarvester are present, in parallel, and returns the deduplicated union filtered through the engagement scope. Installing more sources widens coverage with no code change — the tool set is discovered, not hardcoded.

include_amass defaults off. On a real engagement amass ran the full 15 minutes and returned zero subdomains — its productive sources want API keys — while subfinder and assetfinder found 322 and 301. It also spawns an amass engine child that calls setsid itself, so it escapes the process-group kill on timeout and keeps running, unthrottled, after the engagement believes the tool stopped. Turn it on when amass is configured with datasource credentials; leave it off otherwise.

thorough adds slower sources (theHarvester, amass with more providers). Prefer bbot_scan when BBOT is available: it covers more sources than all of these combined.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
targetYes
thoroughNo
include_amassNo

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. First observedv2.1.0

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the readOnlyHint annotation by disclosing critical runtime behaviors: amass can run 15 minutes with zero results without API keys, it spawns an amass engine child that escapes the process-group kill and keeps running after timeout, and the tool set is discovered dynamically. These are important operational traits the agent must know.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Though slightly long, every sentence earns its place. The core purpose is front-loaded, then the source-discovery mechanism, the amass caveat, and the alternative recommendation. It is dense but not verbose, with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers tool behavior, performance characteristics (amass runtime), alternatives (bbot_scan), and parameter rationale. Since an output schema exists, the absence of return-format details is acceptable. The description is complete for an enumeration tool of this complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description must explain parameters. It fully explains include_amass (default off, why, when to enable) and thorough (adds slower sources like theHarvester and amass with more providers). target is self-evident from the tool name and description. This compensates well for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States the exact operation: 'Enumerate subdomains from every installed passive source and merge them.' It names specific tools (subfinder, assetfinder, findomain, amass, theHarvester) and clearly distinguishes itself from bbot_scan, which is called out as a more comprehensive alternative. The purpose is unambiguous and differentiated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly recommends using bbot_scan when available ('Prefer bbot_scan when BBOT is available'). It also provides conditions for enabling include_amass (only when amass has datasource credentials) and thorough (adds slower sources). This is clear when-to-use and when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/iamsecure1920/Cordon-AI'

If you have feedback or need assistance with the MCP directory API, please join our Discord server