MCP.Market

Dnstwist MCP server

by w0h1v·io.github.w0h1v/dnstwist·v1.1.1·51 stars
No reviews yet

MCP server for dnstwist: detect typosquatting, phishing and brand impersonation domains.

A92/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A92/100

full report

Adoption
Growing

51 stars33 downloads/wk

Reviews

Write one

Nobody has reviewed Dnstwist yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Dnstwist tools (1)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • fuzz_domain

    Generate and analyze domain permutations to detect potential typosquatting, phishing, and brand impersonation

Public scan report

scanner v0.1.10 · 2026-10-13 · same rubric, same numbers if you re-run it

no findings
  • Code scan3 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 0 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 92/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Dnstwist compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
92/100
higher than 95% of 48,255 servers
Tools
1
the typical server has 7
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
51
more than 94% of 28,688 servers
Downloads a week
33
more than 22% of 12,191 servers with a package

What its tools let an agent do: 1 read

Install Dnstwist in Claude Code, Cursor or VS Code

Runs npx -y @burtthecoder/mcp-dnstwist on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add dnstwist -- npx -y @burtthecoder/mcp-dnstwist
Add to Cursor

What the publisher says

From the Dnstwist repository's README, as published. We do not edit it. Read it on GitHub

Quickstart · Tool · Security · Troubleshooting · Docs

mcp-dnstwist is an MCP server that lets AI agents run dnstwist to find domains that imitate yours: typos, homoglyphs, bit flips, swapped TLDs and more. For each registered lookalike it can report DNS records, whether its mail server could intercept your email, WHOIS registration details, and how closely its web page copies yours.

[!NOTE]

Independent project, not affiliated with dnstwist. Only scan domains you own or are authorized to assess.

[!IMPORTANT]

Versions up to 1.0.4 have a command injection vulnerability (GHSA-p4jr-h3rj-2rw4) and are deprecated. Use 1.0.5 or later; npx -y @burtthecoder/mcp-dnstwist always fetches the latest.

Highlights

  • Lookalike discovery. All of dnstwist's permutation algorithms, or only the ones you pick.
  • Threat signals. DNS records, open mail relays that could intercept email (mxcheck), WHOIS creation date and registrar, HTTP and SMTP banners, and web-page similarity (ssdeep or TLSH) to spot cloned phishing sites.
  • Runs your way. A local dnstwist install, the official dnstwist Docker image, or a self-contained mcp-dnstwist image.
  • Hardened. No shell, strict input validation, and time limits that stop and clean up long scans.
  • Tested. End-to-end tests with fake docker and dnstwist executables run in CI on Node 20, 22 and 24.

How it works

flowchart LR
    A["AI agent<br/>(Claude, Codex, Gemini, VS Code)"] -->|"MCP over stdio"| S["mcp-dnstwist"]
    S -->|"validated argv, no shell,<br/>time limit"| D["dnstwist<br/>(local or Docker)"]
    D -->|"DNS, WHOIS, HTTP, SMTP"| I["Lookalike domains"]
    D -->|"JSON"| S
    S -->|"results"| A

Quickstart

Requirements: Node.js 20.3 or newer, and either dnstwist (pipx install "dnstwist[full]") or Docker. No API key.

# Claude Code
claude mcp add --transport stdio dnstwist -- npx -y @burtthecoder/mcp-dnstwist

# Codex CLI
codex mcp add dnstwist -- npx -y @burtthecoder/mcp-dnstwist

# Gemini CLI
gemini mcp add dnstwist npx -y @burtthecoder/mcp-dnstwist

For Claude Desktop, VS Code, Docker, Smithery and running from source, see Connect a client.

Then ask your agent: "Which lookalike domains of example.com are registered, and could any of them intercept email?" More prompts are in example workflows.

The tool

One tool, fuzz_domain. Full parameters and real sample output are in the tool reference.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Dnstwist: common questions

Is Dnstwist MCP server safe?
Yes, by our scan: it is graded A (92/100). Read the Dnstwist safety report
How do I install Dnstwist?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Dnstwist need an API key?
No secret keys are declared. It reads 2 settings from the environment.
Is Dnstwist maintained?
The last commit was 22 days ago (2026-10-13). The latest release is v1.1.1.
How does Dnstwist compare with other MCP servers?
safety score 92/100 (higher than 95% of 48,255 servers); tools 1 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.