Security & firewall
Watch open ports, manage the macOS Application Firewall and pf, and run fail2ban/CrowdSec, with alerts when something changes.
How FrontierStack itself is hardened
A tool that holds the keys to your servers has to be worth that trust. FrontierStack has undergone nearly 100 hours of 5.6 Sol (High) security auditing and ships with 900+ automated security and policy tests that run on every change.
What that buys in practice: the app is loopback-first — a fresh install accepts no network connections at all, and remote access requires an explicitly paired device. Every external request is cryptographically signed (Ed25519) and checked against a default-deny route policy, so a route that hasn’t been reviewed simply doesn’t answer. Credentials live in the Keychain, never in preferences or logs. Anything sent to a cloud AI passes a redaction guard first, and an optional local model can screen it as well, so secrets and internal hostnames don’t leave the machine. Untrusted work — agent jobs, security audits — runs inside a deny-by-default sandbox with no access to your normal credentials.
Firewalls & intrusion prevention
- The macOS Application Firewall and pf (packet filter), managed with app-owned rules
- fail2ban and CrowdSec intrusion prevention
- An open-ports watch that alerts on new listeners, plus a remote-access exposure check
Routers & firewalls we integrate with
Read live status and drive configuration on OPNsense (REST API), pfSense, OpenWrt, DD-WRT, MikroTik RouterOS, Ubiquiti UniFi / EdgeOS, ASUSWRT, FRITZ!Box and TP-Link Omada — by API where available, or over SSH.
Opening a port to the internet
- UPnP IGD (miniupnpc) and NAT-PMP / PCP (libnatpmp) to ask the router for a port mapping
- OPNsense perimeter rules through its API
- Cloudflare Tunnel and Tailscale Funnel to reach a service from outside with no inbound port at all
Dynamic DNS (DDNS)
Keep a hostname pointed at a changing home IP — Cloudflare DDNS (an A record that follows your current public IP) and a generic interval-based DDNS updater for other providers.
Mesh, VPN & zero-trust (ZTNA)
WireGuard, Tailscale (including exit nodes and subnet routers — set up over SSH or the OPNsense API), Headscale, NetBird, Nebula and ZeroTier.
Headscale vs Tailscale for remote monitoring & the mobile app: they’re interchangeable for reaching your Mac. Headscale only replaces Tailscale’s control plane — the data path is still the official Tailscale clients, so the Mac app and the iPhone/iPad app connect over the same tailnet address either way. Point clients at your server with tailscale up --login-server (on iOS, set the Tailscale app’s “Alternate Coordination server”). The one exception is Tailscale Funnel (one-click public exposure), which relies on Tailscale’s cloud and isn’t available on Headscale — Tailscale Serve (private), LAN and Cloudflare Tunnel still cover public reach.
Transport & certificates
Trusted HTTPS / TLS via mkcert (local) and Let’s Encrypt (public), key-based SSH for the fleet, and TLS-pinned agent connections (TOFU SHA-256).
Device & request authentication
The control and MCP servers add an FS1 signed-request layer — a per-device Ed25519 key on top of bearer tokens and TLS — with per-device scopes (read-only → full) and one-tap revoke. It’s how the iOS app pairs.
Credential storage & password managers
By default every secret FrontierStack holds — SSH/sudo passwords, SaaS API keys, router/registrar secrets, AI provider keys — lives in the encrypted macOS Keychain, never in plain files. With Vault Links you can instead source any of these from your own password manager / secrets vault: Bitwarden & self-hosted Vaultwarden, 1Password, HashiCorp Vault, Infisical, Doppler or Keeper. Link an app credential to an item in your vault and FrontierStack fetches it on demand via the vendor’s CLI (cached and non-blocking, so it never stalls the UI) — every existing feature keeps working, just reading from your vault instead of the Keychain. You can also generate a strong secret and store it straight into the vault from the app, then link to it in one step. Whichever store you use, secret values are still scrubbed from anything sent to a cloud AI or any external surface — see the AI Administrator.
auth.md — automated, password-free login
FrontierStack supports auth.md, the open (WorkOS-originated) spec a service can publish at /auth.md to tell AI agents how to sign in. In a service’s Connect ▸ Automate login (auth.md) box, enter the domain and FrontierStack fetches and summarises the supported flows (agent-verified / user-claimed), scopes and OAuth endpoints — the grant happens at the service and issues a short-lived, revocable scoped token, so no long-lived password is stored.
Malware & integrity
The Malware Audit reads Gatekeeper / SIP / FileVault / XProtect, hunts persistence, and runs ClamAV, YARA and VirusTotal lookups, alongside an EDR Fleet board and deeper tooling (Volatility 3, capa, CAPE/Cuckoo).
This is the web edition of FrontierStack’s in-app Help. Open the same topic inside the app for live, clickable controls.
Run it all from one Mac app.
FrontierStack installs, monitors and secures the whole stack — locally and across your fleet — from a single native macOS app.
Download FrontierStack