# BurtTheCoder/mcp-dnstwist [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/BurtTheCoder/mcp-dnstwist  
**GitHub Stars:** 50  
**npm Downloads (last month):** 195  
**Views:** 3  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/burtthecoder-mcp-dnstwist

## Description
MCP server for dnstwist, a powerful DNS fuzzing tool that helps detect typosquatting, phishing, and corporate espionage.

## Tools
Capabilities this server exposes over MCP:

- **fuzz_domain**
- **domain**
- **nameservers**
- **threads**
- **format**
- **registered_only**
- **mxcheck**
- **ssdeep**
- **banners**

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "mcp-dnstwist": {
    "command": "npx",
    "args": ["-y","@burtthecoder/mcp-dnstwist"]
  }
}
```

## Documentation

## What BurtTheCoder/mcp-dnstwist MCP server does

BurtTheCoder/mcp-dnstwist MCP server connects MCP-compatible applications to dnstwist, a DNS fuzzing tool for examining permutations of a domain name. It is intended for security research involving typosquatting, phishing, and brand impersonation. The server exposes one MCP operation, `fuzz_domain`, which generates candidate domains and returns analysis results.

The tool can limit results to registered domains, inspect DNS information, check MX records, capture HTTP banner data, and optionally generate ssdeep fuzzy hashes for web pages. Results can be requested as JSON, CSV, or a list. These capabilities make it suitable for reviewing possible lookalike domains associated with an organization or service.

Use the server only for domains you own or have permission to assess. Automated DNS and web requests can affect infrastructure, and DNS providers may rate-limit or block scans.

## How it works

The MCP client sends a domain and optional scan settings to `fuzz_domain`. The `domain` parameter is required; the other exposed parameters control how dnstwist performs and formats the analysis:

- `nameservers` selects DNS servers, with `1.1.1.1` as the documented default.
- `threads` controls parallel processing and defaults to 50.
- `format` accepts `json`, `csv`, or `list`, defaulting to JSON.
- `registered_only` defaults to true and filters for registered permutations.
- `mxcheck` defaults to true for MX record checks.
- `ssdeep` defaults to false and enables fuzzy hashes when selected.
- `banners` defaults to true for HTTP banner collection.

The server runs dnstwist in Docker and passes the resulting output back through MCP. DNS resolution depends on the configured nameservers, while banner and fuzzy-hash checks depend on reachable web services.

## Setup and configuration

BurtTheCoder/mcp-dnstwist MCP server requires Node.js 18 or later and Docker. Docker Desktop is documented for macOS and Windows; Linux users can install Docker Engine. The npm installation path is:

```bash
npm install -g mcp-dnstwist
```

After installation, add a server entry to Claude Desktop using `mcp-dnstwist` as the command, then restart the application. The documented configuration files are under the Claude application data directory on macOS and Windows.

The repository also supports a source-based setup. Clone the project, run `npm install`, build with `npm run build`, and configure Claude Desktop to launch `node` with the built `build/index.js` file. No environment variables are documented as required.

## Tools and capabilities

The server exposes `fuzz_domain`. Its inputs cover the target domain, DNS servers, concurrency, output format, registration filtering, MX checks, fuzzy hashing, and HTTP banners.

## Limitations and notes

BurtTheCoder/mcp-dnstwist MCP server depends on a working Docker installation and permissions to run Docker commands. DNS resolution failures can result from inaccessible nameservers, rate limits, or blocking. Higher thread counts can increase network load and should be adjusted for system capacity, bandwidth, latency, and DNS-server policies.

Invalid domains or unexpected dnstwist output can cause parsing or execution errors. If Docker is unavailable, the daemon is stopped, or permissions are insufficient, the scan will not run. The project is licensed under MIT.

_Full upstream README: https://allmcps.com/mcp/burtthecoder-mcp-dnstwist/readme_