Perimeter Watch
Passive domain-perimeter checks — cert expiry, subdomain takeover, lookalikes — as agent tools
Open source Repository Open in the app JSON README (API)
About
Passive domain-perimeter checks — cert expiry, subdomain takeover, lookalikes — as agent tools
Details
- Kind
- MCP servers
- Topic
- No topic detected
- Publisher
- entradox
- Origin
- official
- Category
- ferramentas
- Transport
- http
- Version
- 1.0.0
- Last push
- 2026-09-07T18:36:37Z
- Repository state
- ativo
- Language
- Python
- License
- MIT
- Added
- 2026-09-03 23:00:53
- Updated
- 2026-09-03 23:00:53
- Origin id
io.github.entradox/perimeter-watch-scanner
README
# Perimeter Watch Scanner
Passive external-perimeter checks for the domains you own or manage. This is the
scanner engine behind [Perimeter Watch](https://entradox.github.io/perimeter-watch-site/) —
open-sourced so you can verify exactly what it does and run it yourself.
**The hosted version is here: https://entradox.github.io/perimeter-watch-site/**
($9/mo for 3 domains, $19/mo for 10 — weekly briefs with evidence, zero maintenance).
Self-hosting this repo gets you the scanner only: you build the cron, the diffing,
the delivery, and the retention archive yourself.
## What it checks (all passive, public data only)
1. **TLS certificate expiry** — read from public Certificate Transparency logs (crt.sh);
direct-connect fallback; alert window <14 days
2. **Domain registration expiry** — whois with RDAP fallback (rdap.org); alert window <21 days
3. **Dangling DNS / subdomain takeover** — 50 common subdomains checked via DNS;
CNAME targets fingerprint-matched against the can-i-take-over-xyz list (Heroku, S3,
Azure, GitHub Pages, Netlify, Shopify, etc.). A fingerprint CNAME whose target no
longer resolves = takeable = RED
4. **Lookalike domains** — hyphen/plural/suffix variants queried in CT logs (info-only;
content-verification is planned as Phase 2)
**What it never does:** port scans, crawling, active testing, credential access,
takedowns, or fixes. If it can't reach a source, it says `COVERAGE_GAP` in the output —
it never guesses.
## Quick start
```bash
# requirements: python 3.10+, dig (bind-utils/dnsutils), whois (optional — RDAP fallback exists)
python3 perimeter_scan.py --domain example.com --state state.json --brief --evidence-dir ./evidence
```
Output: full JSON (stdout + state file), a rendered one-page brief, and an append-only
evidence line in `evidence/<domain>.jsonl`.
Sample run (real output):
```
# Perimeter Watch Brief — example-site.com
**Rating: GREEN** | Scan window: 2026-09-03T15:54 → 15:54
## COVERAGE
- tls: OK — cert expires in 93 days
- domain_lifecycle: OK — 294 days remaining
- dangling_dns: OK — 50 subdomains checked, zero takeable records
- lookalikes: OK — 4 variants queried, 0 registered
```
## Weekly cron
```bash
# crontab -e — Mondays 03:00, every domain in domains_authorized.txt
0 3 * * 1 cd /path/to/repo && for d in $(cat domains_authorized.txt); do python3 perimeter_scan.py --domain "$d" --state "state_${d}.json" --evidence-dir evidence >> briefs/weekly_log.md 2>&1; done
```
## Rules baked into the code
- **Authority before scan.** Only scan domains you own or are authorized to manage.
- **Passive only.** Public records: CT logs, whois/RDAP, DNS resolution. No probing, ever.
- **Honest failure.** Unreachable sources produce `COVERAGE_GAP`, never a fake GREEN.
- **No takedowns, no fixes.** Detection and evidence only.
## License
MIT. Attribution appreciated, not required.
## Don't want to run cron yourself?
The hosted service does all of this weekly, delivers the brief with evidence to your
inbox, and supports agency-resell terms: **https://entradox.github.io/perimeter-watch-site/**
Contact: entradox@icloud.com