dnstwist — Claude Code MCP server: find lookalike domains
Wires dnstwist into your agent so it enumerates domains that imitate yours and checks which ones are already taken.
claude mcp add --env DNSTWIST_RUNNER=<DNSTWIST_RUNNER> --env DNSTWIST_TIMEOUT_SECONDS=<DNSTWIST_TIMEOUT_SECONDS> --transport stdio dnstwist -- npx -y @burtthecoder/mcp-dnstwistWhat dnstwist does
The server exposes a single tool called fuzz_domain. Hand it a domain and dnstwist generates variants: typos, homoglyphs, bit flips, other TLDs. Registered lookalikes come back by default; the rest can be filtered out.
Per hit you can ask for DNS records, WHOIS registration date and registrar, HTTP and SMTP banners, a check for mail servers that accept mail for any address, and a page-similarity score against your own site via ssdeep or TLSH. Which permutation algorithms run is your call, as is the number of parallel lookups.
Prerequisites are Node.js 20.3 or newer plus either a local dnstwist install or Docker. Missing both means the server will not start. The Docker runner wants access to the Docker daemon, which is root-equivalent on most machines; run locally or use the bundled image to avoid that. Point it only at domains you control or have permission to test. Anything up to 1.0.4 carries a command injection flaw, so install a newer release.
What it helps with
- list registered lookalikes of a domain you own
- see whether a lookalike's mail server could catch your mail
- compare a clone page against your original for similarity
- pull registration date and registrar for a suspicious domain
- run just one permutation algorithm instead of the full set
Example prompts for the agent
- Run
fuzz_domainwith only thehomoglyphandbitsquattingalgorithms - Score the lookalike pages against ours with
tlshand show the closest matches
How to install dnstwist
Platform CLI
claude mcp add --env DNSTWIST_RUNNER=<DNSTWIST_RUNNER> --env DNSTWIST_TIMEOUT_SECONDS=<DNSTWIST_TIMEOUT_SECONDS> --transport stdio dnstwist -- npx -y @burtthecoder/mcp-dnstwistReplace <…> with your own values
Platform CLI
codex mcp add dnstwist --env DNSTWIST_RUNNER=<DNSTWIST_RUNNER> --env DNSTWIST_TIMEOUT_SECONDS=<DNSTWIST_TIMEOUT_SECONDS> -- npx -y @burtthecoder/mcp-dnstwistReplace <…> with your own values
Config file
{
"mcpServers": {
"dnstwist": {
"command": "npx",
"args": [
"-y",
"@burtthecoder/mcp-dnstwist"
],
"env": {
"DNSTWIST_RUNNER": "<DNSTWIST_RUNNER>",
"DNSTWIST_TIMEOUT_SECONDS": "<DNSTWIST_TIMEOUT_SECONDS>"
}
}
}
}Replace <…> with your own values
Config file
{
"servers": {
"dnstwist": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@burtthecoder/mcp-dnstwist"
],
"env": {
"DNSTWIST_RUNNER": "<DNSTWIST_RUNNER>",
"DNSTWIST_TIMEOUT_SECONDS": "<DNSTWIST_TIMEOUT_SECONDS>"
}
}
}
}Replace <…> with your own values
Platform CLI
gemini mcp add -e DNSTWIST_RUNNER=<DNSTWIST_RUNNER> -e DNSTWIST_TIMEOUT_SECONDS=<DNSTWIST_TIMEOUT_SECONDS> dnstwist npx -y @burtthecoder/mcp-dnstwistReplace <…> with your own values
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about dnstwist
How do I install dnstwist in Claude Code?
Run claude mcp add dnstwist -- npx -y @burtthecoder/mcp-dnstwist. To pass environment variables, use the longer form: `claude mcp add --env DNSTWIST_RUNNER=<DNSTWIST_RUNNER> --env DNSTWIST_TIMEOUT_SECONDS=<DNSTWIST_TIMEOUT_SECONDS> --transport stdio dnstwist -- npx -y @burtthecoder/mcp-dnstwist`.
What does dnstwist do?
It builds variations of a domain that could be used to impersonate it: misspellings, lookalike characters, different zones. For each registered variant the server can report DNS data, WHOIS details and how similar its web page is to yours.
What does the server need to run?
Node.js 20.3 or newer and either dnstwist on PATH or Docker. DNSTWIST_RUNNER picks the mode: local, docker or auto.
