# dnstwist

Wires dnstwist into your agent so it enumerates domains that imitate yours and checks which ones are already taken.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 50
- Author: w0h1v
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/w0h1v/mcp-dnstwist
- Updated: 2026-10-13
- HTML: https://affpapa.org/en/nevibecode/mcp/dnstwist

## What it does

The server exposes a single tool called `fuzz_domain`. Hand it a domain and dnstwist generates variants: typos, homoglyphs, bit flips, other TLDs. Registered lookalikes come back by default; the rest can be filtered out.

Per hit you can ask for DNS records, WHOIS registration date and registrar, HTTP and SMTP banners, a check for mail servers that accept mail for any address, and a page-similarity score against your own site via ssdeep or TLSH. Which permutation algorithms run is your call, as is the number of parallel lookups.

Prerequisites are Node.js 20.3 or newer plus either a local dnstwist install or Docker. Missing both means the server will not start. The Docker runner wants access to the Docker daemon, which is root-equivalent on most machines; run locally or use the bundled image to avoid that. Point it only at domains you control or have permission to test. Anything up to 1.0.4 carries a command injection flaw, so install a newer release.

## Requirements
- Needs: Node.js (commands run via npx)
- Environment variables: `DNSTWIST_RUNNER`, `DNSTWIST_TIMEOUT_SECONDS` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env DNSTWIST_RUNNER=<DNSTWIST_RUNNER> --env DNSTWIST_TIMEOUT_SECONDS=<DNSTWIST_TIMEOUT_SECONDS> --transport stdio dnstwist -- npx -y @burtthecoder/mcp-dnstwist
```
Replace <…> with your own values

### Codex

**Platform CLI**
```bash
codex mcp add dnstwist --env DNSTWIST_RUNNER=<DNSTWIST_RUNNER> --env DNSTWIST_TIMEOUT_SECONDS=<DNSTWIST_TIMEOUT_SECONDS> -- npx -y @burtthecoder/mcp-dnstwist
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "dnstwist": {
            "command": "npx",
            "args": [
                "-y",
                "@burtthecoder/mcp-dnstwist"
            ],
            "env": {
                "DNSTWIST_RUNNER": "<DNSTWIST_RUNNER>",
                "DNSTWIST_TIMEOUT_SECONDS": "<DNSTWIST_TIMEOUT_SECONDS>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "dnstwist": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "@burtthecoder/mcp-dnstwist"
            ],
            "env": {
                "DNSTWIST_RUNNER": "<DNSTWIST_RUNNER>",
                "DNSTWIST_TIMEOUT_SECONDS": "<DNSTWIST_TIMEOUT_SECONDS>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e DNSTWIST_RUNNER=<DNSTWIST_RUNNER> -e DNSTWIST_TIMEOUT_SECONDS=<DNSTWIST_TIMEOUT_SECONDS> dnstwist npx -y @burtthecoder/mcp-dnstwist
```
Replace <…> with your own values

## When to use it
- list registered lookalikes of a domain you own
- see whether a lookalike's mail server could catch your mail
- compare a clone page against your original for similarity
- pull registration date and registrar for a suspicious domain
- run just one permutation algorithm instead of the full set

## Example prompts
- Run `fuzz_domain` with only the `homoglyph` and `bitsquatting` algorithms
- Score the lookalike pages against ours with `tlsh` and show the closest matches

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md