Recon Toolkit — Subdomain Enumeration & Live Host Detection
DeprecatedPricing
from $100.00 / 1,000 recon scans
Recon toolkit for bug bounty hunters. Enumerates subdomains (subfinder), probes live hosts, fingerprints technologies. Input: domain + depth. Output: JSON dataset of subdomains, live hosts, tech stack. Quick scan ~90s.
You can access the Recon Toolkit — Subdomain Enumeration & Live Host Detection programmatically from your own applications by using the Apify API. You can also choose the language preference from below. To use the Apify API, you’ll need an Apify account and your API token, found in API & Integrations in Apify Console.
{ "mcpServers": { "apify": { "type": "http", "url": "https://mcp.apify.com/?tools=fetch-actor-details,jokeso/jokeso1-recon-toolkit" } }}The configuration above connects to the hosted Apify MCP server with the Subdomain & Recon Toolkit for Bug Bounty Actor already loaded. It uses OAuth, so your client opens a browser window to sign you in to Apify on first use. No API token is needed. Clients without OAuth support can authenticate with an Authorization: Bearer header carrying an API token from API & Integrations in Apify Console.
Get a ready-to-use configuration for your MCP client with the Subdomain & Recon Toolkit for Bug Bounty Actor preconfigured at https://mcp.apify.com/?tools=fetch-actor-details,jokeso/jokeso1-recon-toolkit.
You can connect to the Apify MCP Server using clients like Tester MCP Client, or any other MCP client of your choice.
If you want to learn more about our Apify MCP implementation, check out our MCP documentation. To learn more about the Model Context Protocol in general, refer to the official MCP documentation or read our blog post.