Add C99 tool to docs

Signed-off-by: Víctor Mayoral Vilches <v.mayoralv@gmail.com>

docs/environment_variables.md

@@ -36,6 +36,7 @@ This comprehensive guide documents all environment variables available in CAI, i
 | CAI_GCTR_NITERATIONS | Number of tool interactions before triggering GCTR (Generative Cut-The-Rope) analysis in bug_bounter_gctr agent. Only applies when using gctr-enabled agents | 5 |
 | CAI_ACTIVE_CONTAINER | Docker container ID where commands should be executed. When set, shell commands and tools execute inside the specified container instead of the host. Automatically set when CTF challenges start (if CTF_INSIDE=true) or when switching containers via /virtualization command | - |
 | CAI_TOOL_TIMEOUT | Override the default timeout for tool command executions in seconds. When set, this value overrides all default timeouts for shell commands and tool executions | varies (10s for interactive, 100s for regular) |
+| C99_API_KEY | API key for C99.nl subdomain discovery service. Required for using the C99 reconnaissance tool for DNS enumeration and subdomain discovery. Obtain from [C99.nl](https://c99.nl) | - |
 
 ---
 
@@ -89,6 +90,28 @@ CTF_INSIDE="true"                     # Run agent inside container
 
 ---
 
+### 🔍 Reconnaissance & OSINT
+
+For reconnaissance tasks using external tools:
+
+```bash
+# C99.nl subdomain discovery
+C99_API_KEY="your-c99-api-key"        # Enable C99 reconnaissance tool
+
+# Agent configuration for recon
+CAI_AGENT_TYPE="redteam_agent"        # Or create custom recon agent
+```
+
+**Reconnaissance Tools:**
+- **C99 Tool**: Subdomain discovery and DNS enumeration via C99.nl API
+- Configure `C99_API_KEY` to enable the C99 reconnaissance tool
+- See [Tools Documentation](tools.md) for usage examples
+
+**Related Documentation:**
+- [Tools Documentation](tools.md#c99-tool)
+
+---
+
 ### 🧠 Memory & State Management
 
 For maintaining context across sessions and learning from past interactions:
@@ -312,6 +335,7 @@ OPENAI_API_KEY="sk-..."              # Required (can use "sk-123" as placeholder
 ANTHROPIC_API_KEY="sk-ant-..."       # For Claude models
 ALIAS_API_KEY="sk-..."               # For alias1 (CAI PRO)
 OLLAMA_API_BASE="http://localhost:11434/v1"  # For local models
+C99_API_KEY="your-api-key"           # For C99.nl subdomain discovery tool
 ```
 
 See the [Configuration Guide](cai/getting-started/configuration.md) for more details.

docs/tools.md

@@ -18,6 +18,48 @@ CAI offers a few built-in tools when using the [`OpenAIResponsesModel`][cai.sdk.
 5. Data exfiltration - *exfiltration*
 6. Command and control - *control*
 
+### C99 Tool
+
+CAI includes integration with the C99.nl API for subdomain discovery and DNS enumeration. This tool is particularly useful for reconnaissance during security assessments.
+
+#### Configuration
+
+To use the C99 tool, you need to set up your API key:
+
+```bash
+# In your .env file
+C99_API_KEY="your-c99-api-key-here"
+```
+
+You can obtain an API key by registering at [C99.nl](https://c99.nl).
+
+#### Usage Example
+
+```python
+from cai.sdk.agents import Agent, Runner, OpenAIChatCompletionsModel
+from cai.tools.reconnaissance.c99_tool import c99_subdomain_finder
+from openai import AsyncOpenAI
+
+recon_agent = Agent(
+    name="Recon Agent",
+    description="Agent specialized in subdomain discovery",
+    instructions="You are a reconnaissance expert focused on DNS enumeration.",
+    tools=[
+        c99_subdomain_finder,
+    ],
+    model=OpenAIChatCompletionsModel(
+        model="qwen2.5:14b",
+        openai_client=AsyncOpenAI(),
+    )
+)
+
+async def main():
+    result = await Runner.run(recon_agent, "Find all subdomains for example.com")
+    print(result.final_output)
+```
+
+The C99 tool provides comprehensive subdomain enumeration capabilities, making it valuable for the reconnaissance phase of security assessments.
+
 ```python
 from cai.sdk.agents import Agent, Runner, OpenAIChatCompletionsModel
 from cai.tools.reconnaissance.generic_linux_command import generic_linux_command