FrontierStack monitors and manages the servers, services and devices you run. Use one Mac to check health, control remote machines over SSH, review security, and fix problems without keeping a row of Terminal windows open. Its AI helps without ever seeing your passwords or keys.
Now availableFrontierStack 2.0 is here. Full macOS 27 support, with Apple Intelligence powering the AI Administrator. What's new →We check your domain, DNS, email security, HTTPS, web server and PHP, speed and SEO, live, and show how to get to 100%. Only check a site you own or run.
Apple notarized · Safe & secure · macOS 13 Ventura+
One plain-English request sets up a new website end to end: the Cloudflare zone, proxied DNS, an Apache virtual host and a live preview on localhost. Every script is shown before it runs.
FrontierStack starts with read-only checks, asks before it changes anything, and keeps credentials on your Mac. Every change is shown as the exact script that will run, not a summary, so you always know what you are approving. Monitors run on each host, so they keep watching while your Mac sleeps. Enfour has run production services on Apple hardware since 1992. That history is why the app is cautious about changes and fussy about receipts.
Ask a question in plain English. FrontierStack runs checks against live system state, explains what it found, and puts any repair behind an approval card. It works on this Mac and on linked servers over SSH. On macOS 27 you can run it entirely on Apple Intelligence; the on-device model needs no API key and never leaves your Mac. FrontierStack AI is free for now, and any cloud provider or local Ollama or LM Studio model works too.
AI is most useful when it can act on real servers, and that is exactly when a leaked key costs the most. FrontierStack keeps every password, key and token on your Mac and shows the AI only what it needs to do the job. This is the path every request to a cloud AI takes.
Server and sudo passwords, API tokens and service logins live in the macOS Keychain. Script Secrets sit in a private file only your account can read, and you can seal them with a hardware security key.
When a script needs a password, the AI writes $DB_PASSWORD. FrontierStack fills in the real value on your Mac at the moment the script runs, so it never appears in the conversation.
Every message to a cloud AI is checked against every value in your Keychain and against known key shapes (API keys, tokens, private-key blocks, connection strings). Anything that matches is replaced before it is sent. This is ordinary code, not a model, and it always runs.
In the AI Administrator, the Prompt Firewall adds a second check: a screening model reads each outgoing prompt for anything sensitive the patterns missed. Run it on Apple Intelligence or a local model so the check itself never leaves your Mac, or use Enfour's zero-retention screener. You choose whether it warns you, removes the flagged text or stops the send.
You can see it working. When something is redacted, a green shield appears in the conversation. When the AI wants to change something, the exact script waits on an approval card until you say yes.
Works with ChatGPT · Codex · Claude · Grok · Gemini · Cursor · OpenClaw · Hermes · Paperclip · Buzz · Amp · Xcode and any MCP client.
A coding agent or coordinator can request infrastructure work without receiving passwords or private keys. FrontierStack returns the relevant tools, applies local rules, asks you to approve changes, checks the outcome and records what happened.
Use MCP and the CLI today. A2A, MCP Tasks and CloudEvents are opt-in previews for coordinators that support them.
FrontierStack finds the permitted tools for the current job; it does not load hundreds of unrelated tools into the model context.
App Lock, caller scope, approvals, destructive-data protection and the audit trail remain local. A prompt, agent card or chat message cannot widen them.
FrontierStack in agent teams How it works with each platform Read the setup guide
The app keeps the measurements, alerts and repair history together, so you can see what happened before you act.
Each service gets a focused pane: live state at the top, the actions you need next to it, and the AI one click away.
A separate window holding only your servers and the devices that report live state. Tiles carry CPU, memory, disk, network, temperature, power and GPU with sparklines; select one for processes, services, containers, files, ports, a terminal and power control. Layouts fit a Mac fleet, a cluster, mining rigs, or the network and power gear. Everything is reachable from the keyboard.
One sheet, reached from the Docker pane or the Server Activity window, creates a container on this Mac or on a linked server over the SSH connection you already have. Presets cover plain images and every self-hostable service FrontierStack can run as a single container, so the same thing you install locally can be stood up on a server. Ports bind to localhost unless you say otherwise, secret values are hidden, and the exact docker run line is shown before anything happens.
nginx, PostgreSQL, MySQL, Redis and a throwaway shell, plus n8n, Vaultwarden, Checkmk and the rest of the single-container services.
Every published port starts bound to 127.0.0.1. Turn that off deliberately when a service should be reachable from the network.
The command is shown before it runs, secrets redacted, and the pull and run output comes back in the sheet.
New integrations let bots help with server work without handing them your server credentials.
FrontierStack detects Grok and can add its Keychain-backed MCP bridge. Local workflows start read-only; cloud bots need network access to be enabled deliberately.
Send alerts to Slack and export a credential-free Slack or Teams handoff recipe. FrontierStack keeps approvals and server credentials on the Mac.
FrontierStack joins a Buzz team as a server-admin agent you can @mention. Changes wait for your approval on the Mac. It can also install Buzz and monitor its relay.
Detect and configure Hermes Bot Mode, Amp and DeepSeek Harness Alpha, then see T3 Code workers, Rex servers and agent jobs across linked servers.
Progressive LAN discovery identifies Macs, Windows PCs, Apple TV, Android TV boxes, routers, printers and more. Focused fingerprinting can add LLDP/SNMP checks, preserve known names and flag AnyDesk or Tailscale support.
See Strix installation, version, API status, scan progress and findings alongside connected repositories, domains and CI providers; then launch or repeat scans from FrontierStack.
Inspect channel usage, filter crowded network lists, pin the connected network and keep location-aware device knowledge for faster, more accurate future scans.
Network Check and device discovery are free without pairing. A licensed desktop unlocks live fleet health, incidents, power recovery, direct helpers, SSH and administration.
See the last 30 checks, measured response time, honest 24-hour, 7-day and 30-day uptime, and every outage or recovery. Private iPhone and Lock Screen widgets keep the essentials visible without exposing credentials.
Added support for hardware key securing of FrontierStack. Compatible with YubiKey, Google Titan or FEITIAN FIDO2 key. Add up to three backup keys; compatible USB-C, Lightning and NFC models also work with the iPhone and iPad app. (Fleet license only)
Your SaaS plan may bill in dollars, your registrar in euros, and your licence in yen. FrontierStack records each amount as charged. It converts currencies only when you ask for a combined total.
Spend & Billing records AI plans, hosting, SaaS, domains and free-text costs such as "Acme server rentals, €20/month." Totals use editable, dated exchange rates that you can refresh from the ECB. Most service panes have a Plan & Cost row, so you can record a charge while looking at the service.
Set a monthly budget and FrontierStack raises an alert at 80% and 100%; covering every subscription, in any currency, even services with no API. Connected AI accounts carry their own monthly limits against auto-synced spend, and Apify's platform spend syncs the same way, day by day, with the Apify pane's token. DigitalOcean, Vultr and Linode report month-to-date charges with thresholds of their own, and a billing-health watcher flags failed payments before a service goes dark.
Sales Channels adds up today's payments from Square, Stripe, PayPal, Shopify and other providers. It keeps separate totals for each currency. Store Health converts revenue and ad spend only when it calculates net income and ROAS.
Use Network Check and local device discovery free without pairing. Pair with a licensed FrontierStack desktop for live health, incident alerts, smart reboots, power and UPS status, direct helper monitoring, SSH and administration; over LAN or Tailscale.
FrontierStack meets your infrastructure where it is; across generations, operating systems and the growing collection of devices around them.
Keep valuable Apple server hardware useful. Link an Xserve or an older Mac running macOS Server over SSH, then monitor services, inspect logs, run diagnostics and manage it from your current Mac.
Bring Macs, Windows PCs and servers, Linux and BSD hosts, Raspberry Pi systems and virtual machines into the same fleet. Discover them, identify what they are, then monitor and operate them over the best available connection.
Monitor and control SwitchBot, Zigbee and HomeKit-exposed devices, cameras, sensors, smart plugs, UPS units and network gear. Pin them to Places, automate responses and use remote power to recover a server that SSH cannot reach.
Two editions, one app; pick the side that sounds like you.
One Mac, your own stack.
Many machines, serious infrastructure.
From a single laptop to a fleet of macOS and Linux machines; provision, monitor, secure and automate.
Apache/Nginx, MySQL/Postgres, PHP, virtual hosts, TLS; create a site and DNS in one wizard.
Host a Magento Open Source or Adobe Commerce store on any Ubuntu or Debian server in one click; Nginx, PHP-FPM, MySQL, OpenSearch, Redis, Let's Encrypt and cron, set up stage by stage. Then run every store from one pane: health, security patches, indexers, cache, maintenance, deploy mode, upgrades and logs, with alerts when a storefront or its cron stops. Fix My Store (AI) reads the same health and logs, explains the cause and proposes fixes you approve.
Give any local site, Apache website, container or service a public HTTPS hostname through Cloudflare Tunnel; no open ports, and it survives reboots. Set where your sites belong once, then ask the AI for a site: it creates the folder, .env, brief and design skills, serves and publishes it, and builds the pages itself or hands them to Claude Code or Codex in a sandbox.
Hand a website to Claude Code or Codex with a site skill: one SKILL.md per domain with the project folder and git remote, how it is served, its Cloudflare zone and DNS records, certificate expiry and how to deploy. It is made when a site is created, offered when you link a folder to Apache, and kept current. The credentials stay in FrontierStack: the agent gets secret names and runs commands through frontierstack run, never seeing a value.
Create a Docker container on this Mac or on any linked server from one sheet; image, ports (localhost-only by default), volumes, environment with secret values, restart policy; with the exact docker run line shown before it runs. Presets cover plain images and every self-hostable service FrontierStack can run as a single container.
Every server and live device at a glance in its own window; tiles with CPU, memory, disk, network, temperature, power and GPU sparklines; layouts for Macs, clusters, mining rigs or network & power gear; and per-server tabs for processes, services, Docker, files, ports, logs, an in-window terminal, and power (reboot, plug/PDU/KVM, Wake-on-LAN). Reads Linux, macOS and FreeBSD servers natively, through the FrontierStack monitor where installed and plain SSH elsewhere.
Publish a separate public status page for any site or client. It lists only what you placed there; servers, Cloudflare zones, sites, certificates, domains, watches and databases; and an item shared with several clients appears on each of their pages.
NetScaler, F5 BIG-IP, FortiGate, Palo Alto, Ivanti, Cisco ASA, Kemp, SonicWall, and VPN concentrators from Check Point, WatchGuard, Zyxel, Array, OpenVPN Access Server, Juniper, Sophos and Barracuda, plus the whole Citrix estate (Console, SDX, XenServer, Virtual Apps and Desktops, ShareFile): the running version checked against vendor advisories; exploited-in-the-wild CVEs first, like CitrixBleed and the 2026 NetScaler zero-days; plus end-of-life branches, risky exposure, connected VPN users, HA and certificate health, and an optional read-only compromise scan. Between releases, Enfour's signed edge advisories add newly exploited flaws to the checks. Read-only accounts, pinned TLS.
With Full Fleet, watch a Windows estate from a Mac. Active Directory domain controllers are found in DNS and checked without an agent: ports, sync state, clock skew, LDAPS certificates and, with a plain domain user, replication and locked-out accounts. Microsoft Entra ID alerts when Entra Connect stops syncing, app secrets are about to expire or Microsoft 365 has an outage, and imports users. Veeam Backup & Replication, Backup for Microsoft 365 and the Service Provider Console alert on failed jobs and full repositories, and a self-signed Veeam certificate is never trusted until you approve its fingerprint.
Every linked macOS or Linux server gets two protections from its pane. File integrity fingerprints startup jobs, sudoers, SSH keys, cron, web server configuration and site PHP every night and alerts you when something changes, when the check stops running, or when someone replaces the record to hide a change. An admin-ports firewall keeps SSH, Screen Sharing, RDP, file sharing and database ports for private networks, Tailscale and you, and removes itself unless FrontierStack can still reach the server afterwards.
With Full Fleet, watch the servers that run your network's directory and addresses. DHCP Servers reads Windows Server DHCP, Kea, ISC DHCP and dnsmasq over SSH; scopes and how full they are, leases, reservations and failover; and alerts before a scope runs out. Group Policy & Trusts reads Windows and Samba AD domain controllers: GPO links, AD/SYSVOL version mismatches and FRS, failing trusts, and risky trust settings such as SID filtering off or TGT delegation.
The Permissions pane shows what you, the AI Administrator and every outside agent may do; read, control services, change infrastructure, run scripts; and lets you change it there. In a multi-agent harness (Grok Bot, Hermes, OpenClaw…) give the coordinator agent more room than the agents it hands work to, or keep one agent to reading. Give each agent its own key so its calls are attributed to it for certain, set per-tool allow and deny lists (names, globs or regular expressions), and require every agent to use its own key. No rule goes past the app-wide limit, rules keyed on a name only narrow, and loosening anything needs a real click.
Copy a website's files and MySQL database to a pinned server, a new server (pinned on the way), this Mac or a hosting account in four steps; or keep the database in sync as a MySQL replica, with the replication login and channel set up for you.
One Mac drives every linked server: run commands, audit, deploy, compare config drift across the fleet.
Fleet Run ▸ PHP versions & security fixes lists every PHP on every linked server; Homebrew, MacPorts, MAMP, Apple's own, distribution packages and OPNsense or pfSense firmware; shows which ones serve the web, and flags any behind php.net's latest security release or on a branch that no longer gets fixes. FrontierStack doesn't change PHP itself: Copy AI Prompt hands the update to Claude Code or the AI Administrator, one server at a time, asking before every change. Modernize Old Mac Server and Router Health warn when an old Mac server's or an OPNsense firewall's PHP falls behind.
A server can be powered on with its ports open and still let nobody in: SSH and Screen Sharing accept the connection, then never answer. Lockup reboot has the Host Monitor reboot the server itself when sshd stops greeting or the server loses its gateway for as long as you choose; at most once per interval, and only after the check has worked once. A root reboot sentinel backs it up through the kernel when the server can no longer start processes, and per-minute process counts with a 24-hour chart warn before the limit is reached.
When a linked server stops answering, its pane shows what FrontierStack last saw instead of blank fields: OS and hardware, IPv4, stable IPv6 and Tailscale addresses, DNS, connection, the services that were running, any reboot the OS was scheduled to make, and the monitor's settings; dimmed, with a clock and the time it was seen. The AI Administrator sees the same record. It stays on your Mac, holds no tokens, and is forgotten when you remove the server.
Running a newer macOS on an old Intel Mac via OCLP? FrontierStack detects it, checks the boot chain (firmware → OpenCore → macOS → root patches), backs up the EFI, and answers "Safe to update macOS?"; so a remote Mac never gets stranded at a boot picker. The AI Administrator knows too, and won't install a macOS update there until it is safe.
With Full Fleet, give a Mac you already manage the Build Mac role and your Xcode projects build, test and archive there over SSH. It watches the Xcode versions, licence, free disk, DerivedData and simulator space, and code-signing certificates before they expire. It also sets up a Gitea Actions runner (runs-on: macos-xcode) and Xcode 27's headless MCP server.
One App Store Connect API key shows every app's review state, its newest TestFlight build and Xcode Cloud's latest run. You get an alert when a version is rejected, a build fails processing or an Xcode Cloud workflow goes red. Read-only.
Still on Apple's Server.app (macOS 10.13 era)? FrontierStack first checks what the server actually runs, then brings it up to date in place: PHP 8.5 (8.5.12 or later) on PHP-FPM with every site checked before and after (and an automatic switch back), PHP 8 code fixes with the AI for the rest, a guard for Server.app's web proxy, DKIM signing, TLS 1.2+ and a Let's Encrypt mail certificate, DMARC and TLS-RPT, spam filtering, password-guessing blocks for mail, SSH and websites, and Open Directory checks and nightly backups. Nothing Apple ships is replaced, and every change can be undone.
Point FrontierStack at the mailbox your DMARC rua= address delivers to and it reads the daily reports from Gmail, Microsoft, Yahoo and the rest: each domain's pass rate, every server sending as it, and which of your own servers fail on some of their mail. You get an alert when they do, or when the reports stop arriving. It can also import from Suped. Check it before moving to p=reject.
A serial terminal built in for when the network, SSH or the web UI is gone. Plug in a USB-to-serial adapter or a device's own USB console port and it appears with its chip named; pick Cisco, Juniper, Aruba, Fortinet, MikroTik, pfSense/OPNsense and other vendor settings, or any speed, parity and flow control. Send Break for ROMMON password recovery, pace a pasted configuration line by line, and keep session logs. Console servers (Lantronix, Opengear, Digi, ser2net) connect by telnet, raw TCP or SSH.
Reinstall a server without a USB stick. Keep installer ISOs in one library and mount one as a virtual CD through Redfish (Dell iDRAC, HPE iLO, Lenovo XClarity, Supermicro), a PiKVM, or a Proxmox VE VM's CD drive, then boot it once and restart. A built-in media server answers only private and Tailscale addresses, at unguessable URLs, and switches itself off. There is an iPXE network-boot menu, and a built-in PXE server (ProxyDHCP + TFTP) that boots BIOS, UEFI and ARM64 machines into it without touching your router's DHCP; controllers without Redfish use IPMI to boot once from the network. For Macs, which can't boot an ISO, FrontierStack downloads Apple's full installer over SSH, runs an upgrade or erase-install, and can turn on Content Caching.
Install on boxes with no screen; appliances, UP Squared boards, servers wired only to a console port. Pick the port and speed (9600 to 115200, up to 921600 where the UART can do it) once: the iPXE menu passes the console to every netboot.xyz Linux installer, Boot Media shows the exact boot-menu edit for Ubuntu, Debian, Rocky/RHEL, Proxmox VE, pfSense/OPNsense and Windows EMS, and a console window opens at the same speed. UP boards are recognised by model, with their debug UART and its ttyS name.
Watch WAN optimization and SD-WAN gear like the rest of the fleet. Point FrontierStack at a SteelCentral Controller and every SteelHead it manages appears with its health and connection, alerting when one degrades; single SteelHeads report model, RiOS version and optimization-service state over REST, with health by SNMP. SD-WAN that Riverbed no longer sells is covered too: SteelConnect CX gateways, switches and APs and SteelHead SD through SteelConnect Manager (online state per appliance and site), and SteelConnect EX through Versa Director; reachability, services, sync and critical alarms, with the Director checked against CISA's exploited list.
DNS resolves but the site won't load? The Connection Probe finds where the connection dies and whose it is: your DNS against public resolvers, a connection and HTTP test, a route with every hop's network named, and the same request from probes worldwide, on your own ISP and from your linked servers. It tells a site that's down for everyone from one that has blocked your public address, names the network's contact, and on OPNsense can route around the block with an outbound NAT rule it tests and rolls back if it doesn't help.
Sites built with STUDIO, Wix, Webflow or Framer are recognised in Domain Health. When the builder is breached; like STUDIO in October 2026, which exposed the API keys customers had saved in it; the affected domains are flagged, an alert stays on until you've dealt with it, and the vendor's checklist keeps your progress. KeyRotate records which keys you pasted into which service, flags those not replaced since the breach and rotates them in one go.
STUDIO has no export, so leaving it usually means rebuilding by hand. Type the site's address and FrontierStack reads what it shows every visitor; no STUDIO sign-in; then adds the pages, the CMS items (as posts, with dates, cover images, categories and tags) and the images to a WordPress site on your Mac, with redirects from the old addresses and a checklist of what to redo by hand. Pancake Stack has the same import.
See every server's waiting security fixes, with the ones attackers are already exploiting (CISA KEV) and releases that no longer get fixes shown first. Opt a server in and FrontierStack installs security updates only inside a maintenance window you set; never a reboot, never a firewall appliance. Enfour's signed patch advisories cover the urgent ones.
If the aws CLI has credentials, the Server Activity window finds every EC2 and Lightsail instance in every profile and every enabled Region; CloudWatch CPU and network on each tile, start/stop/reboot, the console link, and Add to Servers with the login and key pair AWS set it up with. GovCloud and China work too.
When an EC2 server's root disk passes the alert threshold, FrontierStack works out the grow; new size and extra monthly cost; and asks, or grows it automatically within a cap you set: an optional snapshot, the EBS volume, then the partition and filesystem over SSH, with no reboot.
When FrontierStack creates a project; a site the AI builds, a Laravel or Symfony project, a Vite app, a Devbox project; it offers to encrypt the .env with dotenvx (secrets encrypted in place, settings left readable, the private key kept out of git and out of any web root) and to add it to KeyRotate as a target, even while it's empty. Servers FrontierStack starts get the real values; the first key you add goes straight in, encrypted.
Keep the long-term Bedrock API key (ABSK…) in AWS › Amazon Bedrock: test it in any Region, see the models your account can call there, and set up Claude Code on Bedrock. The key syncs with KeyRotate, which can rotate it.
A payment monitor running on a test-mode or sandbox key (Stripe sk_test_, Paddle sandbox, PAY.JP, KOMOJU, Mollie, PayPal, Braintree, Square) is labelled TEST and never added to the Sales Channels totals; test charges are not revenue.
Connect T3 Code with a read-only token and see every coding-agent thread that is waiting for you, working or failed; Codex, Claude Code, Cursor, Grok Build, OpenCode; with today's tokens and estimated cost by model and the CPU and memory of every agent it runs. Waiting threads reach your iPhone, and the Server Activity window's new AI Agents board charts T3 Code beside OpenClaw, Hermes, Paperclip, Octop and your other agent runtimes.
Rex, Superlogical's terminal multiplexer built on libghostty, gets its own pane: sessions, the programs that report they are waiting for you, working or failed, and the CPU and memory of the agents under each server, on this Mac and your Linux and FreeBSD servers. FrontierStack reads session labels and what programs report about themselves, never what's on screen, and checking never starts a server.
List tmux, GNU screen, Zellij and Rex sessions on this Mac and your servers, start and end them, rename and detach tmux sessions, and install tmux with the server's own package manager where it's missing. FrontierStack doesn't read scrollback, commands, environments or history.
Open commands in Ghostty, reuse its theme in the in-app console, and install its terminal type on your servers, which fixes the "missing or unsuitable terminal" error that tmux and vim show over SSH.
Connect a Proxmox VE cluster or node with an API token and see quorum, every node's CPU, memory, disk and uptime, every VM and container, and storage usage. Start, shut down or reboot guests (hard stop and reset after confirmation). Nodes appear as tiles in the Server Activity window, and Alerts warns when the API stops answering, a node goes offline, quorum is lost or storage passes 90%.
Install Deno and see the Deno servers running on your Mac; watch Deno Deploy apps and alert when a build fails or a custom domain can't get a certificate. Run Cloudflare Workers and Durable Objects on your own machines with celld: start celld dev on a Worker project, add fleet nodes, and see resident and owned cells, memory pressure and health as tiles in the Server Activity window, with alerts when a node stops answering or needs capacity.
macOS firewall, pf, fail2ban, open-ports watch, third-party scanners (ClamAV, YARA, VirusTotal lookups) beside Apple's XProtect, EDR fleet, a sandboxed AI Security Audit (exploitable-only, code or infrastructure), daily email-breach alerts from Have I Been Pwned, and Key Usage Watch for API keys used in ways you can't account for.
Credential Leaks looks up your team's email addresses on Have I Been Pwned every day, with your own key, and alerts you when one turns up in a new breach: what leaked, and what to do next. KeyRotate's Guard does the same for the addresses you add there. Our free website score also warns when your site writes out addresses for harvesters to collect.
Alerts reach you on Telegram, LINE, Slack, email, SMS and more. With Contacts & Escalation, they reach other people too. Email the supervisor, text and phone the on-site technician, and escalate to a manager only if the problem is still there and nobody pressed Acknowledge. Route by category, location or a single device; everyone told it broke is told when it's fixed.
Ask FrontierStack's built-in AI to inspect a problem, or connect Grok, Codex, Claude Code, Cursor and other MCP clients. FrontierStack keeps credentials on the Mac, limits what each caller can do, asks for approval, and records the result. See agent workflows.
Passwords, keys and tokens stay in the Keychain on your Mac. The AI works with secret names; real values are filled in only when a script runs, everything sent to a cloud AI is scrubbed first, and the Prompt Firewall can screen each prompt on Apple Intelligence or a local model before it leaves. How it works.
Every recurring charge you have; AI plans, cloud and hosting, SaaS tools, domains and certificates; as weekly, monthly or annual, grouped by category with monthly and annual totals. Presets cover the common services and you can type any name, so a subscription with no API is tracked exactly like one FrontierStack can query. It also watches your paid services for failed payments and warns you before one stops working.
See worker health, detected runtimes, active jobs and persistent terminal sessions. The iOS app shows limited agent activity without copying prompts, transcripts, terminal contents or credentials to the phone.
Your self-hosted and SaaS services together; install local ones or connect cloud accounts, 500+ in all, in one sidebar tailored to your use-case.
Network Check and Bonjour device discovery are free without pairing. Pair with a licensed FrontierStack desktop for fleet health, incidents, power recovery, direct helpers, notifications, SSH and controls over LAN or Tailscale. Learn more.
A Channel Manager for vacation rentals; connect Hostaway, Lodgify, Guesty, Cloudbeds, Beds24 and more (or a custom AppSheet app) for live reservations, revenue and occupancy, sync OTAs (Airbnb, Booking.com, Vrbo, Expedia…) by iCal, and schedule cleanings with Turno.
Access points, cameras and door controllers have no power button; their switch port is it. See every PoE port's state, class and draw, watch the switch's power budget, and power-cycle a port to reboot a wedged device without a trip to the cabinet. Works with any managed switch supporting the standard PoE MIB (RFC 3621).
One pane for everything Nix: see which Nix you run (upstream, Determinate or Lix), whether its daemon is up, and repair the shell set-up a macOS update breaks. Search nixpkgs and manage your profile, run Devbox projects and their services, or start PostgreSQL, MySQL, Redis or Nginx in one click without Docker. Home Manager, nix-darwin and the store have their own tabs, and servers with Nix or NixOS get a Nix tab in the Server Activity window.
mise (mise-en-place) gives each project the right Node, Python, Ruby, Go or Terraform version, its environment variables and its tasks. See what is installed and which config asks for it, upgrade outdated tools, fix a shell that never activated mise, trust project configs and run their tasks; with the kinds of secrets each project uses (age, SOPS, fnox) shown but never decrypted. Servers with mise get their own tab in the Server Activity window.
Spectrum switches on Onyx or Cumulus Linux, Quantum InfiniBand on MLNX-OS, UFM, BlueField DPUs and the ConnectX NICs in your servers in one pane. Watched ports alert when a link drops; even one that flapped and recovered between checks; and failed power supplies, fans, hot sensors, a stopped subnet manager or a Critical UFM alarm raise an alert. Read-only, with pinned certificates and read-only accounts.
SLZB-06, SLZB-07 and SLZB-MR coordinators can't run an agent, so FrontierStack reads them over your LAN: model, firmware, radio role, temperatures and uptime. The alert that matters most is the quiet one; Zigbee2MQTT, ZHA or your Thread border router has lost its connection to the radio, so every sensor in the house is about to go unavailable while the box itself looks fine.
See your network the way it is segmented. The Subnets pane groups every subnet by VLAN and draws a VLAN layout: routers and switches on the 802.1Q trunk, then one column per VLAN with its subnets, gateways, tagged and untagged switch ports and the devices on it. VLANs come from OPNsense, pfSense, MikroTik and UniFi APIs, your Mac's own VLAN interfaces, managed switches over SNMP (Q-BRIDGE-MIB); or simply your own assignment.
FrontierStack listens to the show network and sums it up in a sentence: "14 Art-Net nodes, 73 universes in use, 2 sACN sources and 1 NDI video source on en5." A dashboard shows each CDJ by player number, the DJM, rekordbox, live BPM, Resolume, NDI, Art-Net and sACN, timecode, LED systems and OSC/RTP-MIDI/TCNet control. Press Arm Show and anything that drops off raises an alert. Discovery is listen-only (Pro DJ Link, StageLinQ, Ableton Link, TCNet, sACN, NDI, MIDI Time Code) and steps aside while rekordbox, QLab or Resolume run on the same Mac; WLED, Falcon Player, OLA, QLC+ and LED-processor web UIs are checked as Show Servers.
Watch the generators powering a concert, festival or outdoor event. Read each set's own controller over Modbus on the site network every few seconds; Deep Sea Electronics, ComAp InteliLite 4, DEIF AGC 150, CRE GENSYS Compact and Datakom; with no cloud subscription or mobile signal, or follow sets through ComAp WebSupervisor or Trackunit, Atlas Copco FleetLink and other AEMP 2.0 telematics. See state, kW and load, fuel with the hours left, volts and amps per phase, frequency and the controller's alarms by name. Press Arm running sets when doors open: a set that stops, trips, loses a phase or runs low on fuel raises an alert and can flash the show's warning lights.
A Wi-Fi password leaked? Give that network a new password on every router and access point that broadcasts it in one pass; OpenWrt, MikroTik RouterOS and UniFi consoles directly, everything else as a checklist with its Web UI link. Only that network changes; shared profiles are refused, the password is never stored, and a join QR code is ready for staff. Full Fleet.
Run your own ZeroTier controller instead of ZeroTier Central; FrontierStack is the local admin UI it doesn't ship with: member approval queue, routes and IP pools, a flow-rule editor with its own compiler, security audit, Prometheus metrics and a warm standby. Administered over SSH against the controller's loopback API, so nothing is exposed.
Run your own Tailscale DERP relay or RustDesk server and FrontierStack watches it without credentials; DERP probe, STUN and certificate expiry; a real rendezvous with RustDesk's ID server plus its relay; and alerts when one stops answering. It shows which peers this Mac is reaching through DERP and whether its RustDesk client is still on the public servers, and generates the derpMap and Headscale snippets, client config strings and a Linux Docker compose file with hbbr -k _.
Control SwitchBot (several accounts, including homes shared with you), Zigbee and HomeKit-exposed devices, watch them on the Places board with camera motion shown as last-active times, and link a SwitchBot Smart Plug to a server to power it on/off; or power-cycle a hung machine when SSH won't answer. When a wedged server's database is still reachable, FrontierStack can even flush and cleanly shut it down over its own connection first, so a power reset is safe.
Meross MSS110, MSS210, MSS305, MSS310 and MSS315 plugs and MSS420, MSS425 and MSS620 power strips join Power Control: on, off and power-cycle a linked server, watts on metering models, one outlet or a whole strip, and an alert when a plug stops answering. Commands go straight to the plug on your LAN; the Meross cloud is used once to fetch the device key, the password is never saved and the key stays in Keychain. Device Discovery recognises Meross plugs and adds them in one click.
Shelly relays, plugs, power strips and meters; Gen 1 to Gen 4, Plus, Pro, Mini, Plug S, Plug US, Power Strip and Pro 3EM; join Power Control: on, off, watts, and a power-cycle that arms the device's own flip-back timer, so power returns even when the outlet feeds your router. Password-protected devices work (Gen 2+ authenticate without sending the password), Find channels names each output, and a Shelly that is also in Apple Home through Matter keeps working in both. Device Discovery recognises Shellys and adds them in one click; nothing goes through the Shelly Cloud.
Paste one Seam API key and every lock it connects shows up: ASSA ABLOY's Yale, August, Aperio and TESA locks and its Vostio and Visionline hotel systems, plus Salto, dormakaba, Schlage, igloohome and more. Each lock shows its online state, locked state and battery; alerts fire when a lock goes offline, a battery gets low or almost dead, a hotel access system reports an error, or a lock account disconnects. Remote lock and unlock are confirmed, need a real press and are audited. The same two-step battery alerts cover SwitchBot locks, keypads and sensors, Nuki locks and keypads, and Zigbee devices.
The LAN Compromise Check reads your router's connection table and flags devices that act compromised or like a botnet or proxy node: checking in with the same address on a timer, connecting to addresses with no name, talking to hosts on public threat lists, accepting connections from the internet you didn't expect, or scanning other devices. Each one gets a worry score, a plain-language explanation and the exact steps for your router (OPNsense, pfSense, MikroTik, OpenWrt, UniFi) to cut its internet or move it to a quarantine VLAN without disturbing anything else; and the AI Administrator can rank and explain them.
Run a privacy & security audit on any network printer: does it hand out the names of documents you printed, keep stored jobs or received faxes, ask for a password on its settings pages, run Telnet, FTP or raw PJL printing, answer from the internet, or use a maker's cloud service; and which known vulnerabilities mention its model. Every exposing setting is listed by risk, with click-by-click steps for HP, Brother, Epson and Canon to set a password, wipe stored jobs, close remote access and turn off what you don't use. FrontierStack only asks; it never changes the printer.
Apple Home runs each home from one hub and keeps the others on standby, switching by itself when a hub restarts, updates or drops off the network. FrontierStack marks the active home hub on the HomePod or Apple TV in Device Discovery, shows Standby and not-responding hubs, and lists every home's hubs in the Apple Home pane, read-only from this Mac's own Home data.
Use any local Markdown folder as the source of truth, with Obsidian as an optional editor. Perplexity works as a cited web-research provider, while Projects and Brain receive a separate redacted export that you review and opt into.
See who each Cloudflare zone is really registered with, and watch that registrar or DNS host's uptime; status page, website/API and nameservers; with warning dots in the sidebar and alerts when it goes down. Switch nameservers to Cloudflare at the registrar in one click, or walk through a transfer to Cloudflare Registrar.
An I'm Being Attacked button on every pinned zone turns on Under Attack Mode in one click (and Stand Down restores the previous level). Create and manage Turnstile CAPTCHA widgets, put a Cloudflare Access sign-in in front of a named tunnel and get alerted if it goes down, check Email Routing and Email Service health, read real-visitor Core Web Vitals (LCP, INP, CLS), and let the AI Administrator use Cloudflare's official MCP server; read-only unless you allow approved API calls.
One place for every domain; from local & remote Apache vhosts, Cloudflare zones and the registrar monitor. Check DNS, HTTP, SSL/expiry, see which server serves it and whether it's a Cloudflare zone, and run an AI SEO audit (score + fixes) on any site. Each site also shows whether Search Console, Google Analytics and Ahrefs are on, with alerts when Google can't index the home page, a sitemap has errors, GA4 stops receiving data or a Cloudflare rule blocks Googlebot or Ahrefs.
Monitor APC, Eaton, CyberPower and Vertiv UPS devices over macOS USB, NUT or apcupsd. See runtime, load, watts and voltage, set charge, runtime and load warnings, and detect battery-service or communication faults.
Query any OID or apply a generic SNMP template (System, Interfaces, Host Resources, Printer, UPS, Synology, QNAP, APC) on any device; read switches, NAS, printers, UPS and more.
S.M.A.R.T. drive monitoring (with deep smartctl attributes; temperature, reallocated/pending sectors, predicted failure), AppleRAID set health with degraded/rebuild alerts, per-volume free space, and Time Machine freshness; all wired into the alerts engine.
On-host health checks for MySQL & PostgreSQL; liveness (won't-start / wedged), replication, and a corruption early-warning that flags trouble before a table goes bad; plus AI-assisted recovery and alerts that keep working even when your Mac is asleep or offline.
Run the local Supabase stack, watch hosted projects and Supabase's security advisors with alerts (such as a public table without row-level security), and let the AI Administrator use Supabase's official MCP server. It is scoped to one project and read-only by default, and every change needs your approval.
Temporarily expose a local dev server (localhost:PORT) for a debug or preview session; via a Cloudflare Quick Tunnel (public, no account), Tailscale serve/funnel, or a LAN forwarder; with an auto-expiry. The AI Administrator can open and close sessions too, over MCP.
Pick a preset and the app shapes itself to how you work.
A reviewed, step-by-step path through hardware, macOS, networking, remote access, backups, security and monitoring. Mac mini server guide →
Spin up many local sites without juggling multiple Terminal windows, save & schedule your scripts, and target Docker or cloud. Web dev on a Mac →
An AWS control panel on your desktop; S3, EC2, RDS, Route 53, budgets and IAM keys, plus your EC2 boxes over SSH. AWS dev on a Mac →
Manage containers and Compose projects; start/stop, logs, exec, prune; on Docker, OrbStack or Apple's runtime, local or remote. Docker on a Mac →
Move sites, databases, PHP settings and WordPress onto a modern Homebrew stack. See migration guides →
Replace a stack of subscriptions with services you own, can fix and can customise; instead of waiting on a support chatbot. How it works →
Sourcing, POD, shipping, inventory and profit tools for commerce on a Mac. Drop-shipping →
POS, CRM, e-commerce, mail and accounting on hardware you control. Small business →
AV, media servers, cameras, IoT and the network behind the show. Venues →
One Mac, many servers: audits, deploys and drift detection over SSH. Fleet →
FrontierStack installs, monitors and secures services on this Mac and on linked servers; and keeps your passwords and keys out of any AI's sight.
Download FrontierStackApple notarized · Safe & secure · macOS 13 Ventura+
A full, searchable web Help center; plus 100+ Q&A pages on Mac server management, security and migration.
Open Help & Docs Browse the FAQA separate Mac app for the credentials behind all of this; the API keys and AI subscriptions your servers and scripts depend on.
Where a vendor's API can issue a replacement, KeyRotate asks for one, verifies it before saving, then updates every .env, config file and app that held the old value.
Every value is a macOS Keychain item behind Touch ID. No account, no KeyRotate server, and nothing you store is sent to us.
Spend, usage and expiry per key and per account, with a warning before a credential stops working; and account switching for teams that juggle several subscriptions.
Included with FrontierStack. Every FrontierStack licence includes one year of KeyRotate, our API-key manager for Mac, at no extra cost; worth about US$24. Your App Store code comes with your licence email and stays on your account page.
Get release news, security tips and Mac-admin guides. No spam; unsubscribe anytime.