Neura Market
BurtTheCoder/mcp-dnstwist logo

BurtTheCoder/mcp-dnstwist

Free

dnstwist MCP 服务器，强大的 DNS 模糊测试工具，帮助检测域名抢注、钓鱼和企业间谍活动。

FreeFree tier
Type
Open Source
Visit Website GitHub (40 stars)

About BurtTheCoder/mcp-dnstwist

mcp-dnstwist is a Model Context Protocol (MCP) server that wraps the powerful DNS fuzzing tool dnstwist, enabling detection of typosquatting, phishing, and corporate espionage through domain permutation analysis. It integrates seamlessly with MCP-compatible applications like Claude Desktop, providing tools to generate domain variations, check registrations, analyze DNS records (A, AAAA, MX, NS), capture HTTP banners, retrieve WHOIS data, and generate fuzzy hashes for phishing detection. The server supports configurable DNS servers, parallel processing, and multiple output formats (JSON, CSV, list). It is distributed as open-source software and can be installed via npm, Docker, or built from source.

Key Features

Domain fuzzing: Generate domain permutations using various algorithms
Registration check: Verify if permutated domains are registered
DNS analysis: Check A, AAAA, MX, and NS records
Web presence: Capture HTTP banner information
WHOIS data: Retrieve registration dates and registrar information
Phishing detection: Generate fuzzy hashes of web pages (ssdeep)
Configurable DNS servers and parallel processing with adjustable thread count
Multiple output formats: JSON, CSV, and list
Seamless integration with MCP-compatible apps like Claude Desktop
Installable via npm, Docker, or Smithery

Pros & Cons

Pros
  • Free and open source with a permissive license (MIT)
  • Easy to install via npm, Smithery, or Docker
  • Integrates directly with Claude Desktop and other MCP clients
  • Comprehensive DNS analysis including A, AAAA, MX, NS records and WHOIS
  • Supports multiple output formats (JSON, CSV, list) for flexible data handling
  • Configurable parallel processing and DNS servers for performance tuning
  • Includes phishing detection via ssdeep fuzzy hashing
Cons
  • Requires Node.js v18+ and Docker for full functionality (may increase setup complexity)
  • DNS rate limiting or being blocked by some servers is possible during large scans
  • May impact DNS infrastructure if used without caution (as warned in documentation)
  • Limited to domain permutations; does not cover other attack vectors
  • No built-in GUI; requires CLI or MCP client integration

Best For

Security researchers analyzing potential domain squatting or brand impersonationPhishing investigation and threat intelligence gatheringCorporate security teams monitoring for typosquatting attacksPenetration testers assessing DNS infrastructure weaknessesAutomating domain reconnaissance as part of MCP-based workflows

FAQ

What is required to run mcp-dnstwist?
You need Node.js v18 or later and Docker (for the dnstwist container). Alternatively, you can build from source without Docker but still need Node.js.
How can I install mcp-dnstwist?
You can install it globally via npm (`npm install -g mcp-dnstwist`), via Smithery (`npx -y @smithery/cli install @burtthecoder/mcp-dnstwist --client claude`), or build from source.
What is the purpose of the fuzz_domain tool?
The fuzz_domain tool generates and analyzes domain permutations to detect potential typosquatting, phishing, and brand impersonation. It accepts parameters like domain, nameservers, threads, output format, and various analysis options.
Can I use this tool without Docker?
Yes, you can build from source and run it with Node.js, but the recommended method uses Docker to containerize dnstwist dependencies.
What output formats are supported?
The tool supports JSON, CSV, and list output formats, configurable via the format parameter.