Front Sentinel MCP server

• Registry namecom.frontsentinel/domain-securityverified in the MCP registry

The registry name sits under frontsentinel.com. The registry only lets a publisher use that namespace after proving control of the domain through DNS or HTTP.

• Stateanswerschecked 2026-10-29
• Tools4
• Server calls itselffront-sentinel
• Server version1.0.0
• Protocol version2025-06-18

On 2026-10-29 the server answered initialize and tools/list without a sign-in. First answer in 499 ms.

• Whether its tools do the product's job has not been judged yet.
• Checked on 6 of the 7 days it takes to judge reliability.

Said by rules from the measurements above. The likely first call is a model's pick from the tool list; read its description before relying on it.

• INITE MCP scoreafter a weeka score needs 7 daily checks: 6 so far
• Answeredmeasuring6 of the 7 daily checks it takes to print a share
• Median first answer478 ms
• Space in an agent's context≈ 530 tokensthe definitions of all its tools (4), which an agent carries on every turn
• Tool definitionsA · 100 of 100
• Typed results0 of 4 toolsdeclared outputSchema: results come typed, read once

• Every tool passes all six checks.

A program checks the server once a day: initialize and tools/list, no model. Tokens are the definitions' length at about four characters a token. The grade averages six checks of every tool's name, description, schema and annotations; it says how well the tools are described, not whether they work. The score weighs what was measured and nothing else: answering (25%), doing the product's job (25%), definitions (20%), context (10%), use (10%) and how readily a client connects (10%). A part that was not measured is left out, and a hidden instruction caps the score at 40. The state of vendors' MCP servers: method and numbers →

• scan_domain

  Scores how well a dApp or website domain is protected against hijacking: registrar transfer/update locks, registry lock, DNSSEC, CAA, expiry, nameserver consistency across resolvers, SRI on third-party scripts and the…

• check_registry_lock

  Reads the domain's EPP status codes from RDAP and tells whether registry lock (serverUpdateProhibited + serverTransferProhibited) is on, partly on or off, and which registrar-level locks are set.

• check_sri

  Loads a public page and lists every script, stylesheet and preload it pulls in. For third-party files, checks whether an integrity= hash is present and matches, and returns a ready sha384 hash for files that have none.

• check_seal_dns_registrar

  Goes through the 16 controls of the SEAL Security Frameworks certification for DNS & Registrar and marks what public data shows for each: ok, partial, gap, not visible from outside, or a process control the team has to document itself…