app.subdomain/subdomains
name:app.subdomain/subdomains
Find known subdomains of a domain. Passive data; may include historic entries. List or count.
- transport:
- remote
- credential class:
- self-provisionable
Owner verification
Not yet verified. Verifying proves you control this server and is free, permanently — it never changes a published score.
Start verification →Tools
- count_subdomainsshallow
Return only the total number of distinct subdomains known for a domain — no list. Cheap and low-token. Use when the user asks "how many subdomains" or you only need the size of the attack surface. Count includes historic subdomains that may no longer be live. It is a point-in-time figure that changes over time, so treat it as current-as-of-query, not a fixed value.
- find_subdomainsshallow
List known subdomains (hostnames) of a root domain. Data is passive (not active scanning): results are historic observations and may include subdomains that no longer resolve or are no longer live. Results are a point-in-time snapshot that changes over time as new subdomains are observed — re-query rather than caching the result. Use for attack-surface mapping, security recon, asset inventory, or SEO host discovery. Hostnames are returned most-recently-seen first. The response always reports `total` (full distinct count known) and a `truncated` flag, so you can tell when more exist beyond `limit`.
Embed this server’s score
Tool count and median score across every tool in this server’s corpus — honest in a way a single cherry-picked tool’s badge wouldn’t be.
[](https://vouch.tools/servers/f832fbe1-fd0b-4702-aeb8-3118946a2c5b)