@burtthecoder/mcp-dnstwist 1.0.4 → 1.0.6

package/README.md

@@ -17,7 +17,7 @@ This tool is designed for legitimate security research purposes. Please:
 
 ## Requirements
 
-- Node.js (v18 or later)
+- Node.js (v20 or later)
 - Docker
 - macOS, Linux, or Windows with Docker Desktop installed
 
@@ -38,7 +38,7 @@ npx -y @smithery/cli install @burtthecoder/mcp-dnstwist --client claude
 
 2. Install the server globally via npm:
 ```bash
-npm install -g mcp-dnstwist
+npm install -g @burtthecoder/mcp-dnstwist
 ```
 
 3. Add to your Claude Desktop configuration file:
@@ -100,8 +100,8 @@ npm run build
 - Description: Generate and analyze domain permutations to detect potential typosquatting, phishing, and brand impersonation
 - Parameters:
   * `domain` (required): Domain name to analyze (e.g., example.com)
-  * `nameservers` (optional, default: "1.1.1.1"): Comma-separated list of DNS servers
-  * `threads` (optional, default: 50): Number of threads for parallel processing
+  * `nameservers` (optional, default: "1.1.1.1"): Comma-separated DNS servers, up to 10. Each must be an IPv4 address or a DNS-over-HTTPS URL such as `https://cloudflare-dns.com/dns-query` (the forms dnstwist accepts). DNS-over-HTTPS is much slower: a DoH-only scan can take over 10 minutes, so include an IPv4 resolver unless you need DoH
+  * `threads` (optional, default: 50): Number of threads for parallel processing (1-100)
   * `format` (optional, default: "json"): Output format (json, csv, list)
   * `registered_only` (optional, default: true): Show only registered domains
   * `mxcheck` (optional, default: true): Check for MX records

package/build/index.js

@@ -2,32 +2,16 @@
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { CallToolRequestSchema, ErrorCode, ListToolsRequestSchema, McpError, } from '@modelcontextprotocol/sdk/types.js';
-import { exec } from 'child_process';
+import { execFile } from 'child_process';
 import { promisify } from 'util';
-const execAsync = promisify(exec);
+import { validateFuzzArgs } from './validate.js';
+// execFile runs docker directly with an argument array. No shell is involved,
+// so tool input can never be interpreted as shell syntax (CWE-78, issue #13).
+const execFileAsync = promisify(execFile);
 const DOCKER_IMAGE = 'elceef/dnstwist';
-function isFuzzDomainArgs(args) {
-    if (!args || typeof args !== 'object')
-        return false;
-    const a = args;
-    return typeof a.domain === 'string' &&
-        (a.nameservers === undefined || typeof a.nameservers === 'string') &&
-        (a.threads === undefined || typeof a.threads === 'number') &&
-        (a.format === undefined || ['json', 'csv', 'list'].includes(a.format)) &&
-        (a.registered_only === undefined || typeof a.registered_only === 'boolean') &&
-        (a.mxcheck === undefined || typeof a.mxcheck === 'boolean') &&
-        (a.ssdeep === undefined || typeof a.ssdeep === 'boolean') &&
-        (a.banners === undefined || typeof a.banners === 'boolean');
-}
 class DnstwistServer {
     constructor() {
-        this.server = new Server({
-            name: 'dnstwist-server',
-            version: '0.1.0',
-            capabilities: {
-                tools: {}
-            }
-        });
+        this.server = new Server({ name: 'dnstwist-server', version: '0.1.0' }, { capabilities: { tools: {} } });
         this.setupToolHandlers();
         this.server.onerror = (error) => console.error('[MCP Error]', error);
         process.on('SIGINT', async () => {
@@ -40,10 +24,10 @@ class DnstwistServer {
             process.exit(1);
         });
     }
-    async execCommand(command) {
-        console.error('Executing command:', command);
+    async execCommand(file, args) {
+        console.error('Executing:', file, JSON.stringify(args));
         try {
-            const result = await execAsync(command, {
+            const result = await execFileAsync(file, args, {
                 maxBuffer: 10 * 1024 * 1024
             });
             console.error('Command output:', result.stdout);
@@ -60,19 +44,19 @@ class DnstwistServer {
         try {
             console.error('Checking Docker...');
             try {
-                await this.execCommand('docker --version');
+                await this.execCommand('docker', ['--version']);
             }
             catch (error) {
                 throw new Error('Docker is not installed or not running. Please install Docker and try again.');
             }
             console.error('Checking if dnstwist image exists...');
             try {
-                await this.execCommand(`docker image inspect ${DOCKER_IMAGE}`);
+                await this.execCommand('docker', ['image', 'inspect', DOCKER_IMAGE]);
                 console.error('Dnstwist image found');
             }
             catch (error) {
                 console.error('Dnstwist image not found, pulling...');
-                await this.execCommand(`docker pull ${DOCKER_IMAGE}`);
+                await this.execCommand('docker', ['pull', DOCKER_IMAGE]);
                 console.error('Dnstwist image pulled successfully');
             }
         }
@@ -96,7 +80,7 @@ class DnstwistServer {
                             },
                             nameservers: {
                                 type: 'string',
-                                description: 'Comma-separated list of DNS servers to use (default: 1.1.1.1)',
+                                description: 'Comma-separated DNS servers: IPv4 addresses or DNS-over-HTTPS URLs such as https://cloudflare-dns.com/dns-query (default: 1.1.1.1)',
                                 default: '1.1.1.1'
                             },
                             threads: {
@@ -144,10 +128,7 @@ class DnstwistServer {
                 if (request.params.name !== 'fuzz_domain') {
                     throw new McpError(ErrorCode.MethodNotFound, `Unknown tool: ${request.params.name}`);
                 }
-                if (!isFuzzDomainArgs(request.params.arguments)) {
-                    throw new McpError(ErrorCode.InvalidParams, 'Invalid arguments for fuzz_domain');
-                }
-                const { domain, nameservers = '1.1.1.1', threads = 50, format = 'json', registered_only = true, mxcheck = true, ssdeep = false, banners = true } = request.params.arguments;
+                const { domain, nameservers, threads, format, registered_only, mxcheck, ssdeep, banners } = validateFuzzArgs(request.params.arguments);
                 // Build command arguments
                 const args = [
                     domain,
@@ -166,7 +147,11 @@ class DnstwistServer {
                 if (banners)
                     args.push('-b');
                 // Run dnstwist in Docker
-                const { stdout, stderr } = await this.execCommand(`docker run --rm ${DOCKER_IMAGE} ${args.join(' ')}`);
+                const { stdout } = await this.execCommand('docker', ['run', '--rm', DOCKER_IMAGE, ...args]);
+                // csv and list output are returned as dnstwist printed them.
+                if (format !== 'json') {
+                    return { content: [{ type: 'text', text: stdout }] };
+                }
                 let results;
                 try {
                     results = JSON.parse(stdout);

package/build/validate.js

@@ -0,0 +1,78 @@
+import { ErrorCode, McpError } from '@modelcontextprotocol/sdk/types.js';
+import { isIP } from 'net';
+import { domainToASCII } from 'url';
+// A hostname: dot-separated labels of letters, digits and inner hyphens, ending
+// in an alphabetic or punycode TLD. It can't start with "-", so it can't be
+// mistaken for a dnstwist option either.
+const HOSTNAME = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+(?:[a-z]{2,63}|xn--[a-z0-9-]{1,59})$/i;
+const FORMATS = ['json', 'csv', 'list'];
+const MAX_NAMESERVERS = 10;
+// The DNS-over-HTTPS form dnstwist accepts (dnstwist.py --nameservers parsing).
+const DOH = /^https:\/\/([a-z0-9.-]{4,253})\/dns-query$/;
+function invalid(message) {
+    throw new McpError(ErrorCode.InvalidParams, `Invalid arguments for fuzz_domain: ${message}`);
+}
+/** Lowercase ASCII (punycode) form of a hostname, or null if it isn't one. */
+function asciiHostname(value) {
+    const trimmed = value.trim();
+    // domainToASCII silently drops inner tabs and newlines ("a.com\nb" becomes
+    // "a.comb"), so reject whitespace and control characters first.
+    if (/[\s\x00-\x1f\x7f]/.test(trimmed))
+        return null;
+    // Handles Unicode (IDN) names; returns '' for invalid input.
+    const ascii = domainToASCII(trimmed.replace(/\.$/, ''));
+    return HOSTNAME.test(ascii) ? ascii : null;
+}
+function optionalBoolean(a, key, fallback) {
+    if (a[key] === undefined)
+        return fallback;
+    if (typeof a[key] !== 'boolean')
+        invalid(`${key} must be a boolean`);
+    return a[key];
+}
+/**
+ * Validate and normalise fuzz_domain arguments. Everything returned is safe to
+ * pass to dnstwist as a separate argv entry: no value can start with "-".
+ */
+export function validateFuzzArgs(args) {
+    if (!args || typeof args !== 'object')
+        invalid('arguments must be an object');
+    const a = args;
+    const domain = typeof a.domain === 'string' ? asciiHostname(a.domain) : null;
+    if (!domain)
+        invalid('domain must be a domain name such as example.com');
+    const rawNameservers = a.nameservers === undefined ? '1.1.1.1' : a.nameservers;
+    if (typeof rawNameservers !== 'string')
+        invalid('nameservers must be a string');
+    // dnstwist only accepts IPv4 addresses and https://<host>/dns-query URLs, so
+    // anything else would fail inside the container anyway.
+    const servers = rawNameservers.split(',').map((ns) => {
+        const trimmed = ns.trim();
+        if (isIP(trimmed) === 4)
+            return trimmed;
+        const doh = trimmed.match(DOH);
+        return doh && (isIP(doh[1]) === 4 || HOSTNAME.test(doh[1])) ? trimmed : null;
+    });
+    if (servers.length > MAX_NAMESERVERS || servers.some((ns) => !ns)) {
+        invalid(`nameservers must be up to ${MAX_NAMESERVERS} comma-separated IPv4 addresses ` +
+            'or DNS-over-HTTPS URLs like https://cloudflare-dns.com/dns-query');
+    }
+    const threads = a.threads === undefined ? 50 : a.threads;
+    if (typeof threads !== 'number' || !Number.isInteger(threads) || threads < 1 || threads > 100) {
+        invalid('threads must be an integer from 1 to 100');
+    }
+    const format = a.format === undefined ? 'json' : a.format;
+    if (!FORMATS.includes(format)) {
+        invalid(`format must be one of ${FORMATS.join(', ')}`);
+    }
+    return {
+        domain: domain,
+        nameservers: servers.join(','),
+        threads: threads,
+        format: format,
+        registered_only: optionalBoolean(a, 'registered_only', true),
+        mxcheck: optionalBoolean(a, 'mxcheck', true),
+        ssdeep: optionalBoolean(a, 'ssdeep', false),
+        banners: optionalBoolean(a, 'banners', true),
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burtthecoder/mcp-dnstwist",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "description": "MCP server for dnstwist - DNS fuzzing to detect typosquatting, phishing and corporate espionage",
   "main": "build/index.js",
   "type": "module",
@@ -14,18 +14,19 @@
   ],
   "scripts": {
     "build": "tsc && chmod +x build/index.js",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run build",
+    "test": "npm run build && node --test tests/*.test.mjs"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^0.4.0"
+    "@modelcontextprotocol/sdk": "^1.32.1"
   },
   "devDependencies": {
-    "@types/node": "^20.0.0",
-    "typescript": "^5.0.0"
+    "@types/node": "^20.19.43",
+    "typescript": "^5.9.3"
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/burtthecoder/mcp-dnstwist.git"
+    "url": "git+https://github.com/w0h1v/mcp-dnstwist.git"
   },
   "keywords": [
     "mcp",
@@ -41,6 +42,6 @@
   "author": "burtmacklin",
   "license": "MIT",
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   }
 }