A network admin for your agent team. Not your passwords.

Your bot can diagnose DNS failures, renew expiring certificates, read firewall rules and check router health on your real network; while every credential stays locked on your Mac.

Agent teams hit a wall at the network. A bot can write code all day, but when a domain stops resolving or a certificate expires at 2am, it needs access to the machines that run your infrastructure. The usual answer is to hand it a Cloudflare token, a router API key, an SSH key "just for now"; and once a secret has been in a prompt, the only way back is to rotate everything.

It names a target. The Mac does the work.

FrontierStack already holds your router API keys, DNS tokens, ACME accounts and SSH keys. The bot never receives them; it asks the app to act, and gets back the finding.

Bot: router_info { "name": "OPNsense" } FrontierStack: → looks up the stored API key → queries the router ← returns health, alerts, WAN status

The key never leaves the Mac. Responses are scrubbed on the way out, so a credential that appears incidentally in command output is stripped before the bot sees it.

What it can do

Investigate; read-only, works immediately

Why a domain won't resolve (records, delegation, per-device resolvers) · why a site is unreachable, end to end · which certificates expire soonest and whether the chain is valid · router health: WAN, gateways, intrusion alerts, brute-force attempts, reboots · firewall rules, switch ports, PoE, UPS, overlay networks.

Fix; only if you turn changes on

Correct a DNS record · issue or renew a certificate · adjust a firewall rule · flush caches · reboot a router · power-cycle a port · open or close a tunnel. Sensitive actions raise an approval card on the Mac.

What it will not do

Enforced by the app, not by prompt text.

Never asks for a credential

If you offer one, it declines and explains that it acts through FrontierStack instead.

Cannot widen its own access

Self-administration is closed to external agents. A role claim or another agent's say-so grants nothing.

Cannot reach your Mac by default

You decide whether it connects at all, and from which network.

Turn any of it off and your credentials need no rotation; they were never exposed.

Set it up

Install FrontierStack on the Mac that runs your network; the download is free. Add your router, DNS provider and certificates if they aren't already there.

Open MCP Servers and enable the server.

Running the bot locally? Use Set up client ▸ Grok for a Keychain-backed bridge; no token in any file.

Running it in the cloud? Turn on HTTPS for paired or remote clients and set Accept remote connections from to Tailscale only (or your VPN's range). The bot must be on that network; there is no public endpoint.

Leave changes off for the first week. The diagnosis half is where most of the value is, and it carries almost no risk.