An AI firewall between your AI and your servers
AI harnesses are useful precisely because they can act. FrontierStack sits between the harness and the machines it can touch — so an assistant can restart a service, read a log or fix a site without ever holding your credentials, and without being able to run whatever it likes.
Why a layer here
Connect a capable model straight to a server and you have handed it your SSH keys and your judgement in one move. The usual answers are to give it nothing — losing most of the value — or to give it everything and hope. FrontierStack takes the third path: the harness gets to ask, and the credentials, the code and the final decision stay on your Mac.
What it enforces
Credentials never reach the AI
The harness asks for an outcome — “restart Apache on MAGI”. FrontierStack resolves the SSH key, sudo password or API token locally, at the moment of execution, and returns only the result. There is no tool that hands a stored secret to an external caller, at any permission level.
Capability classes, not one on/off switch
Every action that changes something is classified — service control, infrastructure change, secrets, shell, or self-administration. Reading a status is never gated; reading a credential is refused outright. An unclassified action fails closed to the strictest class, and a test blocks the build if one is ever added without a class.
Three classes an external tool can never reach
Credentials, arbitrary shell, and FrontierStack’s own settings are refused to any external caller at every level — including “allow everything”. Not a prompt you can click through: a denial. Self-administration is included because a caller that could widen its own limits has no limits.
You see the real action before it runs
Anything that changes a machine surfaces an approval card naming the caller and showing exactly what will happen — the actual script, not a summary. External requests time out closed: if nobody answers, nothing runs.
Scripts are written here, not sent in
An external harness cannot send code to run. It describes the outcome it needs; FrontierStack’s own local model writes the script, and you approve the result. Code arriving from the caller is refused rather than sanitised — approving someone else’s script means approving whatever it decides to do after the check passes.
Credential hunts are blocked twice
A request to find keys or passwords is refused before anything is written. A generated script that searches for a known key shape — an Anthropic, OpenAI, AWS, GitHub, GitLab, Slack or Google credential, or a private-key block — is blocked whatever path it points at, because a key hunt is a key hunt wherever it looks. Reading the files that are credentials counts too: .env, .netrc, .pgpass, wp-config.php and SSH private keys. Listing their names is allowed; dumping their contents is not.
Crypto keys get stricter treatment
A leaked API key can be revoked; a leaked wallet key or seed phrase cannot — the funds are simply gone. So wallet files (Bitcoin, Electrum, Ethereum keystores, Monero, MetaMask, hardware-wallet data), seed and recovery phrases, extended private keys and WIF keys are refused on the noun alone, without waiting for a recognised phrasing, and are stripped from anything sent to a cloud model. Checking that your node is running or how much disk the chain uses stays perfectly normal.
Secrets stripped on the way out
Everything returned to a cloud model or external tool is scrubbed: your stored values by exact match, and key-shaped strings by pattern — API keys, cloud access keys, source-control and chat tokens, OAuth secrets, JWTs and PEM private-key blocks. This runs as ordinary code, so it protects you whether or not you have a local model configured.
Every action is attributed
Each request records which harness or client asked, so a change can be traced back afterwards. An MCP client, a Shortcut and the in-app assistant are never mistaken for one another.
Works with the harness you already use
FrontierStack exposes its tools over the Model Context Protocol, so Claude Desktop, Claude Code, Cursor, Codex, Gemini CLI or your own agent can drive it. The protections above apply to every one of them identically — they are enforced at a single point inside the app, not configured per client. A plain CLI is included for shells that cannot speak MCP. MCP details
What we do not claim
Security pages that promise everything are the ones to distrust, so here is the honest edge of this feature:
- Key-shape detection is a list, and lists age. A brand-new provider’s key format is not recognised until we add it — which is why we keep it current rather than treating it as finished.
- A deliberately vague request can still reach the approval card. That is by design — the card is where a human judges intent — but it means the approval is doing real work, not decoration.
- Anything you approve, runs. The layer constrains what can be asked and shows you what was written; it cannot make a bad approval safe.
- This raises the cost of a mistake or a compromised harness. It is defence in depth, not a guarantee — treat it as one layer among your others.
Kept current
Key formats, prompt-injection patterns and the tricks used to talk an assistant into overreaching all move. We treat this layer as something to keep attacking and updating — new credential shapes, new refusal patterns and new malware and posture checks ship with the app rather than waiting for a major release.
Run it all from one Mac app.
FrontierStack installs, monitors and secures the whole stack — locally and across your fleet — from a single native macOS app.
Download FrontierStack