Quickstart · Tool · Security · Troubleshooting · Docs
mcp-dnstwist is an MCP server that lets AI agents run dnstwist to find domains that imitate yours: typos, homoglyphs, bit flips, swapped TLDs and more. For each registered lookalike it can report DNS records, whether its mail server could intercept your email, WHOIS registration details, and how closely its web page copies yours.
Заметка
Independent project, not affiliated with dnstwist. Only scan domains you own or are authorized to assess.
Важно
Versions up to 1.0.4 have a command injection vulnerability (GHSA-p4jr-h3rj-2rw4) and are deprecated. Use 1.0.5 or later;
npx -y @burtthecoder/mcp-dnstwistalways fetches the latest.
Highlights
- Lookalike discovery. All of dnstwist's permutation algorithms, or only the ones you pick.
- Threat signals. DNS records, open mail relays that could intercept email (
mxcheck), WHOIS creation date and registrar, HTTP and SMTP banners, and web-page similarity (ssdeep or TLSH) to spot cloned phishing sites. - Runs your way. A local dnstwist install, the official dnstwist Docker image, or a self-contained mcp-dnstwist image.
- Hardened. No shell, strict input validation, and time limits that stop and clean up long scans.
- Tested. End-to-end tests with fake
dockeranddnstwistexecutables run in CI on Node 20, 22 and 24.






