Log inSubmit server
MCP Dnstwist logo

MCP Dnstwist

by BurtTheCoder

Runs dnstwist through MCP to find domain permutations, DNS records, registration status, banners, and fuzzy hashes.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install MCP Dnstwist

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "burtthecoder-mcp-dnstwist": {
      "command": "npx",
      "args": [
        "-y",
        "@burtthecoder/mcp-dnstwist"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Install not yet sandbox-tested— we haven't run this command through our automated sandbox yet. Not a red flag; we're working through the catalog.

Overview

BurtTheCoder/mcp-dnstwist MCP server exposes dnstwist through MCP for generating and analyzing domain permutations. Its `fuzz_domain` tool can check registration status, DNS records, MX records, HTTP banners, and optional fuzzy hashes, with configurable DNS servers, threads, and output formats. It runs through Docker and can be installed as an npm package or built from source. Reach for it when investigating typosquatting, phishing, brand impersonation, or related domain activity on domains you own or are authorized to test.

Use cases

  • Generate permutations of an owned domain for typosquatting reviews
  • Check registered lookalike domains for DNS and MX records
  • Inspect HTTP banners on potentially impersonating domains
  • Compare web-page responses with optional ssdeep hashes

Key features

  • Domain permutation analysis
  • Registered-domain filtering
  • DNS, MX, and nameserver checks
  • HTTP banner collection
  • Optional ssdeep web-page hashes
  • JSON, CSV, and list output

Tools9

What MCP Dnstwist lets your agent do. Expand a tool for its parameters.

Self-reported~19 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 2d ago

Recent health check succeeded.

19/19 checks healthy over the last 80d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 13d ago via OSV.dev · @burtthecoder/mcp-dnstwist (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars50Stargazers on the source repository.
npm downloads195Package downloads in the last 30 days.
Last commit15d agoMost recent push to the default branch.
Tools exposed9Callable tools this server registers over MCP.
Directory activity3 viewsConfig copies, upvotes, and views on AllMCPs.

How MCP Dnstwist works

What BurtTheCoder/mcp-dnstwist MCP server does

BurtTheCoder/mcp-dnstwist MCP server connects MCP-compatible applications to dnstwist, a DNS fuzzing tool for examining permutations of a domain name. It is intended for security research involving typosquatting, phishing, and brand impersonation. The server exposes one MCP operation, fuzz_domain, which generates candidate domains and returns analysis results.

The tool can limit results to registered domains, inspect DNS information, check MX records, capture HTTP banner data, and optionally generate ssdeep fuzzy hashes for web pages. Results can be requested as JSON, CSV, or a list. These capabilities make it suitable for reviewing possible lookalike domains associated with an organization or service.

Use the server only for domains you own or have permission to assess. Automated DNS and web requests can affect infrastructure, and DNS providers may rate-limit or block scans.

How it works

The MCP client sends a domain and optional scan settings to fuzz_domain. The domain parameter is required; the other exposed parameters control how dnstwist performs and formats the analysis:

  • nameservers selects DNS servers, with 1.1.1.1 as the documented default.
  • threads controls parallel processing and defaults to 50.
  • format accepts json, csv, or list, defaulting to JSON.
  • registered_only defaults to true and filters for registered permutations.
  • mxcheck defaults to true for MX record checks.
  • ssdeep defaults to false and enables fuzzy hashes when selected.
  • banners defaults to true for HTTP banner collection.

The server runs dnstwist in Docker and passes the resulting output back through MCP. DNS resolution depends on the configured nameservers, while banner and fuzzy-hash checks depend on reachable web services.

Setup and configuration

BurtTheCoder/mcp-dnstwist MCP server requires Node.js 18 or later and Docker. Docker Desktop is documented for macOS and Windows; Linux users can install Docker Engine. The npm installation path is:

Terminal
npm install -g mcp-dnstwist

After installation, add a server entry to Claude Desktop using mcp-dnstwist as the command, then restart the application. The documented configuration files are under the Claude application data directory on macOS and Windows.

The repository also supports a source-based setup. Clone the project, run npm install, build with npm run build, and configure Claude Desktop to launch node with the built build/index.js file. No environment variables are documented as required.

Tools and capabilities

The server exposes fuzz_domain. Its inputs cover the target domain, DNS servers, concurrency, output format, registration filtering, MX checks, fuzzy hashing, and HTTP banners.

Limitations and notes

BurtTheCoder/mcp-dnstwist MCP server depends on a working Docker installation and permissions to run Docker commands. DNS resolution failures can result from inaccessible nameservers, rate limits, or blocking. Higher thread counts can increase network load and should be adjusted for system capacity, bandwidth, latency, and DNS-server policies.

Invalid domains or unexpected dnstwist output can cause parsing or execution errors. If Docker is unavailable, the daemon is stopped, or permissions are insufficient, the scan will not run. The project is licensed under MIT.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about MCP Dnstwist

BurtTheCoder/mcp-dnstwist is an MCP server that connects MCP-compatible clients to dnstwist through Docker. Its main tool, `fuzz_domain`, generates domain permutations and can check registration status, DNS and MX records, HTTP banners, and optional ssdeep fuzzy hashes in JSON, CSV, or list formats.

Install Node.js 18 or later and Docker, then run `npm install -g mcp-dnstwist` and add `mcp-dnstwist` as a command in the Claude Desktop MCP configuration. Restart Claude Desktop afterward. You can also clone the repository, build it, and launch its generated `build/index.js` file.

Check that the configured DNS servers are accessible and not rate-limiting requests.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewMCP Dnstwist AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/burtthecoder-mcp-dnstwist?style=directory)](https://allmcps.com/mcp/burtthecoder-mcp-dnstwist)
HTML Embed
<a href="https://allmcps.com/mcp/burtthecoder-mcp-dnstwist"><img src="https://allmcps.com/api/badge/burtthecoder-mcp-dnstwist?style=directory" alt="MCP Dnstwist on AllMCPs" /></a>