Using subpoof from your AI assistant (MCP)

subpoof has a hosted MCP server. In plain terms: you connect your AI assistant (Claude Desktop, Claude Code, Cursor, and others) to subpoof once, and then you can just ask it, in normal language, to run scans and look things up. The assistant does the API calls for you; you read the answer.

You do not need to write any code or handle the API yourself. If you can install an app and click "sign in", you can use this.

What you can ask it to do

Once connected, try things like:

"Enumerate the subdomains of example.com and summarize anything interesting."
"What changed for example.com since the last scan?"
"Find newly-registered .com domains from the latest feed."
"Which subdomain labels have we seen on example.com?"
"Show the scan history for example.com over the last month."

What you need

A subpoof account. Sign up at dashboard.subpoof.com/signup.
An MCP-capable assistant (see the per-app steps below).

That is it. You can connect by signing in (recommended; no keys to manage), or with an API key if your app prefers one.

The one thing to copy

Your assistant will ask for a server URL. It is:

https://mcp.subpoof.com/mcp/

Keep the trailing slash. That is the only value you need for the sign-in method.

Set it up in your app

Pick the app you use. The menu names change between versions, so if a label is slightly different, look for the nearest equivalent ("connectors", "MCP servers", "integrations").

Claude Desktop (easiest, sign-in)

Open Claude Desktop and go to Settings.
Find Connectors (sometimes under "Integrations") and choose "Add custom connector".
Name it subpoof and paste the URL https://mcp.subpoof.com/mcp/. Leave any API-key/token field blank.
Save, then click Connect. A browser window opens.
Sign in to subpoof with your passkey, then click Authorize on the consent screen that says subpoof is granting access.
Back in Claude, start a chat and ask: "use subpoof to scan example.com".

Claude Code (terminal)

Add subpoof as a remote MCP server, then authorize on first use:

claude mcp add --transport http subpoof https://mcp.subpoof.com/mcp/

Run /mcp inside Claude Code and choose to authenticate; a browser opens for sign-in. To use an API key instead of signing in, add a header:

claude mcp add --transport http subpoof https://mcp.subpoof.com/mcp/ \
  --header "Authorization: Bearer YOUR_API_KEY"

Cursor

Open your MCP config (Settings -> MCP, or edit ~/.cursor/mcp.json) and add:

{
  "mcpServers": {
    "subpoof": {
      "url": "https://mcp.subpoof.com/mcp/"
    }
  }
}

Reload, then approve the sign-in when prompted. To use a key instead, add a headers block (see the generic config below).

Any other app (generic config)

Most apps accept a JSON block like this. Use it with a key, or drop the headers line to sign in instead (if the app supports remote sign-in):

{
  "mcpServers": {
    "subpoof": {
      "url": "https://mcp.subpoof.com/mcp/",
      "headers": { "Authorization": "Bearer YOUR_API_KEY" }
    }
  }
}

Apps that only run local servers

Some older apps can only launch a local command, not connect to a URL. Bridge to subpoof with mcp-remote:

npx -y mcp-remote https://mcp.subpoof.com/mcp/

That opens a browser to sign in. For an API key instead, append --header "Authorization: Bearer YOUR_API_KEY".

Where do I get an API key?

You do not need one if you sign in. If your app wants a key, open the dashboard Settings page, copy your API key, and paste it where the app asks for a token or "Authorization" header. Treat it like a password.

What it can do

Actions (tools)

Ask for ...	Tool
Start a scan of a domain	`submit_scan`
Check whether a scan is done	`get_scan_status`
Read a finished scan's results	`get_scan_results`
List your past scans	`list_scans`
Browse newly-registered domains	`list_registrations`
Search your subdomain-label dictionary	`query_dictionary`
See how a domain changed over time	`get_domain_history`
List your monitoring watches	`list_watches`
Set up a monitor (cert/domain expiry, lookalikes, changes, ...)	`create_watch`
Look at one watch	`get_watch`
Remove a watch	`delete_watch`
See or set up your outbound webhook	`get_webhook`, `set_webhook`
Rotate the webhook secret / send a test / remove it	`rotate_webhook_secret`, `send_test_webhook`, `delete_webhook`
Review webhook delivery attempts / retry a failed one	`list_webhook_deliveries`, `redeliver_webhook`
List / create / get / delete recurring scan schedules	`list_schedules`, `create_schedule`, `get_schedule`, `delete_schedule`
Pause or resume a schedule	`toggle_schedule`
Pin or unpin a dictionary label	`set_dictionary_monitor`
Check your plan and remaining quota	`get_account`
Re-run analysis or a blocklist check on a finished scan	`reanalyze_scan`, `rbl_check_scan`

Watches are standing monitors the service checks for you daily (for example "alert me before example.com's certificate expires" or "watch for typosquats of my brand"). Managing watches does not use a query credit.

The newly-registered-domain feed covers generic TLDs (.com, .org, .xyz, .app, ...) sourced from ICANN zone data. Country-code TLDs such as .io, .co, and .ai are not in this feed.

Ready-made prompts

Some apps show these as one-click starters:

Prompt	What it does
`investigate_domain`	Scan a domain and summarize the findings
`whats_changed`	Report what changed since the last scan
`triage_new_registrations`	Flag risky newly-registered domains

Attachable data (resources)

Apps that support it can pull these in as context: a completed scan (subpoof://scans/{job_id}), a domain's history (subpoof://domains/{domain}/history), or a docs page (subpoof://docs/{slug}).

Troubleshooting

It will not connect, or I get "401 / authentication required". Make sure the URL ends with a slash: https://mcp.subpoof.com/mcp/. If you are using a key, check the header is exactly Authorization: Bearer YOUR_API_KEY.
The sign-in browser window did not finish. Make sure you are signed in to subpoof first (sign in once at the dashboard), then retry connecting.
No tools show up. Reconnect or toggle the connector off and on; some apps need a reload to list the tools.
"Monthly query limit reached" (429). You have used your plan's monthly query quota; it resets on the 1st. See Pricing.
Still stuck. Email support@subpoof.com and tell us which app you are using and what you saw.

Limits and quota

MCP usage counts against the same monthly query quota as the API: a lookup that returns at least one result, and each new scan you start, uses one query. See Pricing for the per-plan amounts.

For developers

Both auth methods work on every request, and the server speaks Streamable HTTP. The OAuth authorization server is discoverable per RFC 9728 from a 401 at the endpoint. The same operations are available over the plain REST API. The endpoint is also reachable at https://api.subpoof.com/mcp/ (same server, either hostname).