Front Sentinel

Read-only security checks for dApp domains: registry lock, DNSSEC, CAA, SRI, SEAL DNS controls

Install

Remote server: your requests and data go to frontsentinel.com. Claude Code: claude mcp add --transport http front-sentinel https://frontsentinel.com/mcp · Claude app: Settings → Connectors → Add custom connector.

What it can do

The tools this server listed when we connected to it, in its own words.

• scan_domain — Scores how well a dApp or website domain is protected against hijacking: registrar transfer/update locks, registry lock, DNSSEC, CAA, expiry
• check_registry_lock — Reads the domain's EPP status codes from RDAP and tells whether registry lock (serverUpdateProhibited + serverTransferProhibited) is on, par
• check_sri — Loads a public page and lists every script, stylesheet and preload it pulls in. For third-party files, checks whether an integrity= hash is
• check_seal_dns_registrar — Goes through the 16 controls of the SEAL Security Frameworks certification for DNS & Registrar and marks what public data shows for each: ok

KitScout test notes

Not tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.

Similar tools

• ponytail-audit 190,451 ★
  Quality audit of the whole repo: bugs, security, real load, missing tests, speed, and what to delete. Most imp
• ponytail-debt 190,451 ★
  Harvest every shortcut: comment into one debt ledger, so deferrals get tracked instead of forgotten. One-shot
• security-and-hardening 117,221 ★
  Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling us
• deal-with-security-advisory 113,505 ★
  Handle confidential GitHub Security Advisory response for Paperclip. Use when coordinating advisory triage, pr
• html-ppt-knowledge-arch-blueprint