DNSTwist MCP

---
name: dnstwist-mcp
category: osint-technical-infrastructure
cost: free
api_key_required: no
repo: https://github.com/BurtTheCoder/mcp-dnstwist
paired_skills: ["seed-discovery-from-domain", "domain-and-whois-research", "cdn-and-origin-discovery", "corporate-extortion-and-virtual-kidnap-response"]
capabilities: ["typosquatting", "domain-permutation", "phishing-detection"]
---

# DNSTwist MCP — typosquatting and homoglyph domain detection

Generates and resolves typosquat permutations of a target domain to find active phishing infrastructure or brand-abuse registrations.

## Install

```
uvx mcp-dnstwist
```

## Configuration

```json
{
  "mcpServers": {
    "dnstwist": {
      "command": "uvx",
      "args": ["mcp-dnstwist"]
    }
  }
}
```

## What it adds

Claude generates character-swap, addition, deletion, and homoglyph permutations of the target domain, resolves which are actively registered, and flags those pointing at live infrastructure — finding phishing campaigns, brand squatters, and BEC pretext domains before they're used. Also valuable in EP work for detecting typosquat domains used in virtual-kidnap and corporate extortion pretexts.

## Pairs with skills

- 006 `seed-discovery-from-domain`
- 041 `domain-and-whois-research`
- 045 `cdn-and-origin-discovery`
- 631 `corporate-extortion-and-virtual-kidnap-response` (EP — BEC/pretext domain detection)

## Cost

Free. No API key required.