An AI firewall between your AI and your servers
AI harnesses are useful precisely because they can act. FrontierStack sits between the harness and the machines it can touch; so an assistant can restart a service, read a log or fix a site without ever holding your credentials, and without being able to run whatever it likes.
Why a layer here
Connect a capable model straight to a server and you have handed it your SSH keys and your judgement in one move. The usual answers are to give it nothing; losing most of the value; or to give it everything and hope. FrontierStack takes the third path: the harness gets to ask, and the credentials, the code and the final decision stay on your Mac.
What it enforces
Credentials never reach the AI
The harness asks for an outcome; "restart Apache on MAGI". FrontierStack resolves the SSH key, sudo password or API token locally, at the moment of execution, and returns only the result. There is no tool that hands a stored secret to an external caller, at any permission level.
Capability classes, not one on/off switch
Every action that changes something is classified; service control, infrastructure change, secrets, shell, or self-administration. Reading a status is never gated; reading a credential is refused outright. An unclassified action fails closed to the strictest class, and a test blocks the build if one is ever added without a class.
Three classes an external tool can never reach
Credentials, arbitrary shell, and FrontierStack's own settings are refused to any external caller at every level; including "allow everything". Not a prompt you can click through: a denial. Self-administration is included because a caller that could widen its own limits has no limits.
You see the real action before it runs
Anything that changes a machine surfaces an approval card naming the caller and showing exactly what will happen; the actual script, not a summary. External requests time out closed: if nobody answers, nothing runs.
Scripts are written here, not sent in
An external harness cannot send code to run. It describes the outcome it needs; FrontierStack's own local model writes the script, and you approve the result. Code arriving from the caller is refused rather than sanitised; approving someone else's script means approving whatever it decides to do after the check passes.
Credential hunts are blocked twice
A request to find keys or passwords is refused before anything is written. A generated script that searches for a known key shape; an Anthropic, OpenAI, AWS, GitHub, GitLab, Slack or Google credential, or a private-key block; is blocked whatever path it points at, because a key hunt is a key hunt wherever it looks. Reading the files that are credentials counts too: .env, .netrc, .pgpass, wp-config.php and SSH private keys. Listing their names is allowed; dumping their contents is not.
Crypto keys get stricter treatment
A leaked API key can be revoked; a leaked wallet key or seed phrase cannot; the funds are simply gone. So wallet files (Bitcoin, Electrum, Ethereum keystores, Monero, MetaMask, hardware-wallet data), seed and recovery phrases, extended private keys and WIF keys are refused on the noun alone, without waiting for a recognised phrasing, and are stripped from anything sent to a cloud model. Checking that your node is running or how much disk the chain uses stays perfectly normal.
Your keys stay in your Keychain
Server and sudo passwords, API tokens and service logins are stored in the macOS Keychain on your Mac. Script Secrets sit in a private file only your account can read, and can be sealed with a hardware security key. The AI is shown secret names only; a script refers to $DB_PASSWORD and the value is filled in on your Mac when it runs.
The Prompt Firewall reads every outgoing prompt
In the AI Administrator, the Prompt Firewall puts a screening model in front of the cloud AI. It reads each prompt for sensitive content the pattern scrub cannot recognise (a customer list, an internal hostname, a password typed in passing) and, depending on the mode you pick, warns you, removes the flagged text or blocks the send. Run it on Apple Intelligence or a local Ollama or LM Studio model so the check never leaves your Mac, or choose Enfour's zero-retention screener, which only ever receives text that has already been scrubbed.
Secrets stripped on the way out
Everything returned to a cloud model or external tool is scrubbed: your stored values by exact match, and key-shaped strings by pattern; API keys, cloud access keys, source-control and chat tokens, OAuth secrets, JWTs and PEM private-key blocks. This runs as ordinary code, so it protects you whether or not you have a local model configured.
Every action is attributed
Each request records which harness or client asked, so a change can be traced back afterwards. An MCP client, a Shortcut and the in-app assistant are never mistaken for one another.
Works with the harness you already use
FrontierStack exposes its tools over the Model Context Protocol, so Claude Desktop, Claude Code, Cursor, Codex, Gemini CLI or your own agent can drive it. The protections above apply to every one of them identically; they are enforced at a single point inside the app, not configured per client. A plain CLI is included for shells that cannot speak MCP. MCP details
Apple Intelligence
On macOS 27, the AI Administrator can run on Apple Intelligence. The on-device Apple foundation model never sends a prompt anywhere, so the network question does not arise; it answers and runs a small set of read-only diagnostics locally.
What we do not claim
Security pages that promise everything are the ones to distrust, so here is the honest edge of this feature:
- Key-shape detection is a list, and lists age. A brand-new provider's key format is not recognised until we add it; which is why we keep it current rather than treating it as finished.
- The Prompt Firewall is a model, and models miss things. That is why it sits on top of the deterministic scrub, never instead of it. When the AI engine is itself FrontierStack AI's zero-retention service, the extra pass is skipped rather than sending the same text twice, and the app says so.
- A deliberately vague request can still reach the approval card. That is by design; the card is where a human judges intent; but it means the approval is doing real work, not decoration.
- Anything you approve, runs. The layer constrains what can be asked and shows you what was written; it cannot make a bad approval safe.
- This raises the cost of a mistake or a compromised harness. It is defence in depth, not a guarantee; treat it as one layer among your others.
Kept current
Key formats, prompt-injection patterns and the tricks used to talk an assistant into overreaching all move. We treat this layer as something to keep attacking and updating; new credential shapes, new refusal patterns and new malware and posture checks ship with the app rather than waiting for a major release.
Run it from your Mac.
FrontierStack installs, monitors and secures services on this Mac and on linked servers; and keeps your passwords and keys out of any AI's sight.
Download FrontierStackApple notarized · Safe & secure · macOS 13 Ventura+