MCP server for dnstwist: detect typosquatting, phishing and brand impersonation domains.
Connect Runs on your machine
claude mcp add dnstwist -e DNSTWIST_RUNNER=<DNSTWIST_RUNNER> -e DNSTWIST_TIMEOUT_SECONDS=<DNSTWIST_TIMEOUT_SECONDS> -- npx -y @burtthecoder/[email protected]
{
"mcpServers": {
"dnstwist": {
"command": "npx",
"args": [
"-y",
"@burtthecoder/[email protected]"
],
"env": {
"DNSTWIST_RUNNER": "<DNSTWIST_RUNNER>",
"DNSTWIST_TIMEOUT_SECONDS": "<DNSTWIST_TIMEOUT_SECONDS>"
}
}
}
}
{
"mcpServers": {
"dnstwist": {
"command": "npx",
"args": [
"-y",
"@burtthecoder/[email protected]"
],
"env": {
"DNSTWIST_RUNNER": "<DNSTWIST_RUNNER>",
"DNSTWIST_TIMEOUT_SECONDS": "<DNSTWIST_TIMEOUT_SECONDS>"
}
}
}
}
{
"servers": {
"dnstwist": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@burtthecoder/[email protected]"
],
"env": {
"DNSTWIST_RUNNER": "<DNSTWIST_RUNNER>",
"DNSTWIST_TIMEOUT_SECONDS": "<DNSTWIST_TIMEOUT_SECONDS>"
}
}
}
}
Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.
Tools
This server runs locally, so its tools are listed by your MCP client once it starts.
Environment variables
| Name | Description |
|---|---|
DNSTWIST_RUNNEROptional | How to run dnstwist: docker, local, or auto (default: a dnstwist on PATH, else Docker) |
DNSTWIST_TIMEOUT_SECONDSOptional | Maximum seconds a scan may run before it is stopped (default 600) |
Details
| Package | @burtthecoder/[email protected] (NPM, stdio) |
| First published | 4 Nov 2026 |
| Last updated | 4 Nov 2026 |
| Registry name | io.github.w0h1v/dnstwist |
More other servers See all
Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.
