BurtTheCoder/mcp-dnstwist

Tool ·
Security ·
Troubleshooting ·
Docs
**mcp-dnstwist** is an MCP server that lets AI agents run dnstwist to find domains that imitate yours: typos, homoglyphs, bit flips, swapped TLDs and more. For each registered lookalike it can report DNS records, whether its mail server could intercept your email, WHOIS registration details, and how closely its web page copies yours.
> [!NOTE]
> Independent project, not affiliated with dnstwist. Only scan domains you own or are authorized to assess.
> [!IMPORTANT]
> Versions up to 1.0.4 have a command injection vulnerability (GHSA-p4jr-h3rj-2rw4) and are deprecated. Use 1.0.5 or later; npx -y @burtthecoder/mcp-dnstwist always fetches the latest.
Highlights
- **Lookalike discovery.** All of dnstwist's permutation algorithms, or only the ones you pick.
- **Threat signals.** DNS records, open mail relays that could intercept email (mxcheck), WHOIS creation date and registrar, HTTP and SMTP banners, and web-page similarity (ssdeep or TLSH) to spot cloned phishing sites.
- **Runs your way.** A local dnstwist install, the official dnstwist Docker image, or a self-contained mcp-dnstwist image.
- **Hardened.** No shell, strict input validation, and time limits that stop and clean up long scans.
- **Tested.** End-to-end tests with fake docker and dnstwist executables run in CI on Node 20, 22 and 24.
How it works
Quickstart
**Requirements:** Node.js 20.3 or newer, and either dnstwist (pipx install "dnstwist[full]") or Docker. No API key.
For Claude Desktop, VS Code, Docker, Smithery and running from source, see Connect a client.
Then ask your agent: *"Which lookalike domains of example.com are registered, and could any of them intercept email?"* More prompts are in example workflows.
The tool
One tool, fuzz_domain. Full parameters and real sample output are in the tool reference.
| Parameter | Default | What it does |
|---|---|---|
| domain | *(required)* | The domain to imitate, for example example.com |
| registered_only | true | Only return lookalikes that exist |
| fuzzers | all | Limit to some algorithms, for example ["homoglyph", "bitsquatting"] |
| mxcheck | true | Flag mail servers that would accept email for any address |
| banners | true | Capture HTTP and SMTP banners |
| whois | false | Registration date and registrar |
| lsh | off | Web-page similarity to the original: ssdeep or tlsh |
| all_records | false | All DNS records, not only the first of each type |
| nameservers | 1.1.1.1 | Up to 10 IPv4 addresses or https:// /dns-query URLs |
| threads | 50 | Parallel lookups, 1 to 100 |
| format | json | json, csv or list |
Settings
| Variable | Default | Description |
|---|---|---|
| DNSTWIST_RUNNER | auto | local (dnstwist on PATH), docker (the elceef/dnstwist image), or auto (local if available) |
| DNSTWIST_TIMEOUT_SECONDS | 600 | Longest a scan may run. On timeout, cancellation or shutdown the scan is stopped and cleaned up |