@burtthecoder/mcp-dnstwist 1.0.5 → 1.0.6

package/README.md

@@ -17,7 +17,7 @@ This tool is designed for legitimate security research purposes. Please:
 
 ## Requirements
 
-- Node.js (v18 or later)
+- Node.js (v20 or later)
 - Docker
 - macOS, Linux, or Windows with Docker Desktop installed
 
@@ -100,8 +100,8 @@ npm run build
 - Description: Generate and analyze domain permutations to detect potential typosquatting, phishing, and brand impersonation
 - Parameters:
   * `domain` (required): Domain name to analyze (e.g., example.com)
-  * `nameservers` (optional, default: "1.1.1.1"): Comma-separated list of DNS servers
-  * `threads` (optional, default: 50): Number of threads for parallel processing
+  * `nameservers` (optional, default: "1.1.1.1"): Comma-separated DNS servers, up to 10. Each must be an IPv4 address or a DNS-over-HTTPS URL such as `https://cloudflare-dns.com/dns-query` (the forms dnstwist accepts). DNS-over-HTTPS is much slower: a DoH-only scan can take over 10 minutes, so include an IPv4 resolver unless you need DoH
+  * `threads` (optional, default: 50): Number of threads for parallel processing (1-100)
   * `format` (optional, default: "json"): Output format (json, csv, list)
   * `registered_only` (optional, default: true): Show only registered domains
   * `mxcheck` (optional, default: true): Check for MX records

package/build/index.js

@@ -80,7 +80,7 @@ class DnstwistServer {
                             },
                             nameservers: {
                                 type: 'string',
-                                description: 'Comma-separated list of DNS servers to use (default: 1.1.1.1)',
+                                description: 'Comma-separated DNS servers: IPv4 addresses or DNS-over-HTTPS URLs such as https://cloudflare-dns.com/dns-query (default: 1.1.1.1)',
                                 default: '1.1.1.1'
                             },
                             threads: {

package/build/validate.js

@@ -7,6 +7,8 @@ import { domainToASCII } from 'url';
 const HOSTNAME = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+(?:[a-z]{2,63}|xn--[a-z0-9-]{1,59})$/i;
 const FORMATS = ['json', 'csv', 'list'];
 const MAX_NAMESERVERS = 10;
+// The DNS-over-HTTPS form dnstwist accepts (dnstwist.py --nameservers parsing).
+const DOH = /^https:\/\/([a-z0-9.-]{4,253})\/dns-query$/;
 function invalid(message) {
     throw new McpError(ErrorCode.InvalidParams, `Invalid arguments for fuzz_domain: ${message}`);
 }
@@ -42,12 +44,18 @@ export function validateFuzzArgs(args) {
     const rawNameservers = a.nameservers === undefined ? '1.1.1.1' : a.nameservers;
     if (typeof rawNameservers !== 'string')
         invalid('nameservers must be a string');
+    // dnstwist only accepts IPv4 addresses and https://<host>/dns-query URLs, so
+    // anything else would fail inside the container anyway.
     const servers = rawNameservers.split(',').map((ns) => {
         const trimmed = ns.trim();
-        return isIP(trimmed) !== 0 ? trimmed : asciiHostname(trimmed);
+        if (isIP(trimmed) === 4)
+            return trimmed;
+        const doh = trimmed.match(DOH);
+        return doh && (isIP(doh[1]) === 4 || HOSTNAME.test(doh[1])) ? trimmed : null;
     });
     if (servers.length > MAX_NAMESERVERS || servers.some((ns) => !ns)) {
-        invalid(`nameservers must be up to ${MAX_NAMESERVERS} comma-separated IP addresses or hostnames`);
+        invalid(`nameservers must be up to ${MAX_NAMESERVERS} comma-separated IPv4 addresses ` +
+            'or DNS-over-HTTPS URLs like https://cloudflare-dns.com/dns-query');
     }
     const threads = a.threads === undefined ? 50 : a.threads;
     if (typeof threads !== 'number' || !Number.isInteger(threads) || threads < 1 || threads > 100) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burtthecoder/mcp-dnstwist",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "description": "MCP server for dnstwist - DNS fuzzing to detect typosquatting, phishing and corporate espionage",
   "main": "build/index.js",
   "type": "module",