theHarvester Cloud - Email & Subdomain Finder MCP server

theHarvester Cloud - Email & Subdomain Finder

Find the emails and subdomains tied to any domain. We harvest emails, subdomains, IPs, URLs and ASNs from 54+ public sources in one call - cloud-hosted theHarvester, no install.

Available as an Apify Actor. Pay only per record found. The upstream tool is free; you pay Apify compute plus a small per-record fee.

What does it do?

Enter a domain and get back the emails and subdomains connected to it, plus IPs, URLs and ASNs, pulled from 54+ public sources in parallel: crt.sh, HackerTarget, RapidDNS, CertSpotter, Shodan, Censys, VirusTotal, SecurityTrails, GitHub, DuckDuckGo and more. We auto-clean the domain you paste (so a full URL still works), normalize the output across sources, and return one clean dataset row per finding - ready for a CRM, a spreadsheet, or an OSINT pipeline.

How is it different from running theHarvester CLI locally?

Wraps theHarvester by laramies (11,000+ GitHub stars, the canonical OSINT recon tool in PTES and OWASP Testing Guide).

When should I use it?

• Sales and lead gen - find the real email addresses behind a company domain
• Recruiting - surface a company's people and contact addresses from its domain
• Due diligence - profile a company's external footprint before a deal or partnership
• Fraud and trust teams - map the subdomains and emails tied to a suspect site
• Security and bug bounty - first-call attack-surface and subdomain mapping for a target

What does it cost?

Pay-per-event:

Typical scan costs

• Small domain (50 findings): $0.15
• Mid domain (300 findings): $0.90
• Large domain (1500 findings): $4.50

Which inputs does it take?

What does the output look like?

Each dataset record:

{
  "recordType": "host",
  "domain": "example.com",
  "host": "api.example.com",
  "ip": "93.184.216.34",
  "raw": "api.example.com:93.184.216.34",
  "timestamp": "2026-06-29T14:00:00Z"
}

Common questions

Q: Does this scan actively? No. theHarvester is purely passive - it queries public data sources. Active scanning (DNS bruteforce, port scans) requires sibling actors nmap-scanner or active-mode tools.

Q: Which sources require API keys? The four defaults (crt.sh, HackerTarget, RapidDNS, CertSpotter) and 15+ other public sources are free. Premium sources like Shodan, Censys, SecurityTrails and Hunter need your own API key, added in the API keys section.

Q: Source missing? DM LinkedIn (linkedin.com/in/anshumanatrey). Custom source additions ship within 1-2 hours.

Shortened. The full README is on GitHub.