▸ MCP server

Plug dnsniffer into Claude, Cursor, or any Model Context Protocol client. Give your agent a search-tool view of every domain on the internet.

endpoint:https://dnsniffer.com/mcp

# connect

claude-code.cli

Add the server with one command:

claude mcp add --transport http dnsniffer https://dnsniffer.com/mcp

# then in your repo just ask: "use dnsniffer to find lookalikes of acme.com"

claude-desktop.json

Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or the equivalent on your platform:

{
  "mcpServers": {
    "dnsniffer": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://dnsniffer.com/mcp"]
    }
  }
}

# mcp-remote bridges the stdio client to our HTTP endpoint.

inspector.cli

Or poke the server directly with the official MCP inspector:

npx @modelcontextprotocol/inspector https://dnsniffer.com/mcp

# tools

search_domains

Substring / TLD / issuer / has-SSL search over 100M+ domains.

query?, tld?, cert_issuer?, has_ssl?, limit?

get_stats

Corpus totals: domains, subdomains, TLDs, cert issuers.

(no args)

list_zones

TLDs with domain counts.

limit?

list_subdomains

Subdomains discovered for a parent domain (CT logs + zone files).

domain, limit?

list_datasets

CSV export templates with download URLs (per-TLD, newly-detected, etc.).

category?, limit?

list_monitors

key

List your brand monitors with match counts.

(no args)

create_monitor

key

Add a new monitor. Daily email digest of new matching domains.

term

list_monitor_matches

key

Recent matches for a monitor (newest first), with domain names.

monitor_id, limit?, before?

pause_monitor

key

Pause or resume a monitor.

monitor_id, paused

delete_monitor

key

Delete a monitor and its matches.

monitor_id

# authentication

auth.md

Public read tools (search_domains, get_stats, list_zones, list_subdomains, list_datasets) work without authentication. Per-user tools - anything marked key above - require an API key from your dashboard.

claude-code (header is set automatically)

claude mcp add --transport http dnsniffer https://dnsniffer.com/mcp \
  --header "Authorization=Bearer dnsk_..."

claude desktop (mcp-remote)

{
  "mcpServers": {
    "dnsniffer": {
      "command": "npx",
      "args": [
        "-y", "mcp-remote",
        "https://dnsniffer.com/mcp",
        "--header", "Authorization: Bearer dnsk_..."
      ]
    }
  }
}

query string (handy for quick tests)

https://dnsniffer.com/mcp?api_key=dnsk_...

# specs

mcp.md

transport: Streamable HTTP (MCP)

endpoint: /mcp

session: stateless

auth: Bearer API key (optional)

tool count: 10

price: free

Same data as the REST API and the WebSocket feed, exposed as structured tools your agent can call. Use the REST API for HTTP clients, the WebSocket for live streams, and MCP when an agent is doing the searching.

learn about MCP