No user-submitted related servers found.
Scored across 4 tools
Each tool has a distinct core action (enumerate, resolve, certificate lookup, triage summary), but find_subdomains and summarize_attack_surface both read the same certificate transparency sources for a domain and differ mainly in output presentation. find_subdomains' resolve=true flag also overlaps with resolve_subdomains, so an agent may pick the wrong entry point for a simple DNS check.
All four tools follow a clean verb_noun snake_case pattern (find_, resolve_, get_, summarize_) with the resource as the noun. No mixed conventions or vague verbs.
Four tools is on the lean side but each covers a genuinely different stage of the recon workflow (enumerate, resolve, inspect certs, triage). Nothing feels redundant enough to remove, though the surface is close to thin.
The toolset covers a coherent end-to-end passive recon lifecycle: discovery, DNS liveness/takeover detection, certificate history, and grouped reporting. Minor gaps remain, such as no export/save of results and no way to feed discovered names directly into history lookups in bulk, but core workflows are covered.