Front Sentinel

com.frontsentinelPublished by frontsentinel.comOfficial publisherv1.0.0Updated Oct 26, 2026

Read-only security checks for dApp domains: registry lock, DNSSEC, CAA, SRI, SEAL DNS controls

VerifiedStreamable HTTPWeb executableWeb Search & ScrapingSecurity & Monitoring

Overview

AI-generated overview

Read-only domain security checks for dApps and websites: hijacking score, registry lock, SRI and SEAL DNS/registrar controls.

What you can do
  • Score a domain's hijacking protection from 0-100, covering registrar locks, registry lock, DNSSEC, CAA, expiry, nameserver consistency, SRI and Content-Security-Policy
  • Read a domain's EPP status codes via RDAP to tell whether registry lock is on, partial or off, and which registrar-level locks are set
  • Inspect a public page's scripts, stylesheets and preloads, check integrity hashes on third-party files and get a ready sha384 hash for files lacking one
  • Walk the 16 SEAL DNS & Registrar certification controls and mark each as ok, partial, gap, not visible from outside, or a process control the team must document
When to use it
Useful when reviewing the security posture of a dApp or website domain before launch or an audit, or when preparing evidence for SEAL DNS & Registrar certification and needing to know which controls public data already satisfies.
Requirements
Remote streamable HTTP endpoint at frontsentinel.com; no packages, environment variables or headers declared. The checks read public data (RDAP, DNS, page content), so the target domain and page must be publicly reachable.
Before you install
Checks are read-only and report on public data only; results cannot confirm internal process controls, which the team must document itself. Page inspection fetches the target site's public content, so only point it at sites you are authorized to examine.

Installation

In SourceWeft

  1. Open Front Sentinel in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.frontsentinel%2Fdomain-security/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "front-sentinel": {
      "type": "http",
      "url": "https://frontsentinel.com/mcp"
    }
  }
}

Tools

4

scan_domain

Domain and frontend security scan

Scores how well a dApp or website domain is protected against hijacking: registrar transfer/update locks, registry lock, DNSSEC, CAA, expiry, nameserver consistency across resolvers, SRI on third-party scripts and the Content-Security-Policy header. Returns a 0-100 score, each check with pass/fail/unknown and advice. Results are cached for an hour.

Parametersdomainrequired

check_registry_lock

Registry lock check

Reads the domain's EPP status codes from RDAP and tells whether registry lock (serverUpdateProhibited + serverTransferProhibited) is on, partly on or off, and which registrar-level locks are set.

Parametersdomainrequired

check_sri

Subresource Integrity check

Loads a public page and lists every script, stylesheet and preload it pulls in. For third-party files, checks whether an integrity= hash is present and matches, and returns a ready sha384 hash for files that have none.

Parametersurlrequired

check_seal_dns_registrar

SEAL DNS & Registrar self-check

Goes through the 16 controls of the SEAL Security Frameworks certification for DNS & Registrar and marks what public data shows for each: ok, partial, gap, not visible from outside, or a process control the team has to document itself. Includes DNSSEC, CAA, SPF/DMARC/MTA-STS, locks, expiry and security.txt.

Parametersdomainrequired

Version history

1
  1. v1.0.0LatestOct 23, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.