Beyond one domain

Explore the index itself

Per-apex search is open to everyone. These four surfaces read across the whole index, and they sit in closed beta behind a bearer token. The panels below are wired up and ready — they will answer the moment a token is available.

Search one domainAPI reference
GET /v1/find?q=
closed beta

Find names containing a string

Sweeps every indexed hostname for a substring — useful for spotting a naming convention across many organisations at once, rather than within one apex.

GET /v1/stream

Watch names arrive

A Server-Sent Events stream of newly indexed names. Point EventSource at it to react to a hostname the moment it first shows up in a log.

sse
curl -N "https://<api-host>/v1/stream"
event: name
data: {"apex":"example.com","sub":"staging.example.com"}
POST /mcp

Give an agent the same tool

The free MCP interface exposes the search tool: hand it an apex domain, get back the indexed subdomains. Drop this into an MCP client config.

mcp config
{
  "mcpServers": {
    "subdomains": {
      "type": "http",
      "url": "https://<api-host>/mcp"
    }
  }
}

Everything here reads a public index of names that have appeared in certificate transparency logs and other public sources. Nothing is probed from this app. Names are never removed from the index, so a result is a record of an observation, not proof that a host is live.