Press release ·
Enfour launches FrontierStack: let AI run your servers without ever seeing your passwords
The Mac app from a company that has run production services on Apple hardware since 1992 also hunts down leaked API keys, keeps retired Mac servers working, and moves costly SaaS subscriptions onto hardware you already own.
Enfour, Inc. today announced FrontierStack, a native macOS app that turns a single Mac into the control room for every server, service and network device a team runs. Its built-in AI Administrator diagnoses problems on live systems and proposes fixes, but it never receives a password, API key or private key. Every change appears as the exact script that will run, and nothing runs until a person approves it.
FrontierStack is free to download. Paid licences start at US$49 a year for customers who subscribe by 31 December 2026.
Why now
AI agents can now log in to real servers and change them, and the credentials they handle have become the weak point. GitGuardian's State of Secrets Sprawl 2026 report counted 1,275,105 AI-service API keys and tokens leaked to public GitHub in 2025, up 81% on the year before. Keys pasted into coding agents also sit in plain text in those tools' local logs, where credential thieves look first.
Small teams face two other pressures. Subscription bills in several currencies keep growing, one tool at a time. Meanwhile capable Mac servers sit idle because their operating system or PHP version went out of support, and Apple's own server tools have been scaled back.
FrontierStack is Enfour's answer to all three: let AI do the operations work, keep secrets out of its reach, and get more years out of the hardware already on the desk.
What FrontierStack does
FrontierStack sits between an AI model and real infrastructure, and decides what the AI may see and do. It installs and monitors Apache, PHP, MySQL, PostgreSQL and Nginx; manages macOS, Linux, BSD and Windows servers over SSH; and watches routers, switches and UPS units. It covers more than 500 self-hosted and SaaS services from one window.
AI that works on real systems, with your approval
Ask the AI Administrator what broke, in plain English. It starts with read-only checks against live system state, explains what it found, and puts any repair on an approval card showing the exact script. Customers choose the engine: on macOS 27 it can run entirely on Apple Intelligence, so nothing leaves the Mac. It also works with OpenAI, Anthropic Claude, Google Gemini, xAI Grok, DeepSeek, local Ollama and LM Studio models, and FrontierStack AI, which is free for now. ChatGPT, Claude, Cursor and other MCP clients can request work too, without being given a server password.
Passwords and keys stay on the Mac
Server passwords and API tokens live in the macOS Keychain. The AI only ever sees a name such as $DB_PASSWORD; the real value is filled in on the Mac at the moment the script runs. Every message to a cloud AI is checked against the Keychain and known key formats and scrubbed before it is sent, and a Prompt Firewall screens it a second time. Full Fleet customers can lock the app behind a YubiKey, Google Titan or FEITIAN FIDO2 key.
Finds keys that were left lying around
Every paid licence includes a year of KeyRotate, Enfour's API-key manager. Together they scan the places leaked keys usually hide:
- conversation logs from Claude Code, Codex, Gemini CLI and other AI tools, using Gitleaks rules
- every branch and tag of GitHub, GitLab and Gitea repositories
- web roots that serve
.envfiles or SQL dumps to anyone who asks - usage patterns, flagging unfamiliar API calls or a sudden switch to an expensive model
A found key can be rotated in place, updating the .env and config files that use it. Email addresses are checked daily against Have I Been Pwned.
Another decade for older Mac servers
Xserves, Intel Mac minis and Macs still running macOS Server can stay in service. One run upgrades Apple's bundled PHP 7.1 to PHP 8.5, checks every site's PHP files for compatibility first, and rolls back automatically on failure. FrontierStack then hardens the machine with file-integrity monitoring, a firewall on admin ports, automatic blocking of password-guessing attacks, and correct DKIM and TLS for mail.
Fewer subscriptions, self-hosted properly
Spend & Billing totals every recurring charge, from AI plans to domains, in its own currency, and alerts at 80% and 100% of a monthly budget. Workflow tools such as CRM, help desk, wiki, file sharing and uptime monitoring can move to a single Mac mini. Installers set up WordPress, JavaScript, Python and Rails stacks, and run n8n or Vaultwarden in Docker with safe defaults. Firewall, ClamAV and YARA virus scans, TLS certificates, backups and uptime checks are built in, so self-hosted services run to production standards. Services that carry real risk, such as payments and accounting, stay where they are and are monitored through their APIs.
Availability and pricing
FrontierStack is available now from frontierstack.app and requires macOS 13 Ventura or later. It is notarized by Apple, native on Apple silicon, and supports macOS 27. The download is free; paid licences are listed below.
| Plan | Price | Includes |
|---|---|---|
| Standard, annual | US$49/year if subscribed by 31 December 2026 (then US$99/year) | Up to 3 Macs and 10 servers, AI diagnosis, audit log, email support |
| Standard, one-time | US$299 | The same as annual Standard, with no recurring bill |
| Full Fleet | US$299/year | No device limits, fleet-wide actions, hardware security keys, priority support |
| 10-pack add-on | US$49/year | Doubles every Standard device limit and adds one Mac |
Customers who subscribe to Standard in 2026 keep the US$49 price for as long as the subscription stays active. Every paid licence includes a year of KeyRotate, worth about US$24, and every purchase or renewal carries a 14-day money-back guarantee. Sales tax or VAT may be added at checkout. Full details are on the pricing page.
About Enfour
Enfour, Inc. was founded in 1992 at Apple's request and has run public services on Apple hardware ever since. It makes FrontierStack, a Mac app for running servers, devices and services, and KeyRotate, which keeps developers' API keys encrypted on Mac, Windows and Linux and replaces them everywhere they are used. Our story
Media contact
Enfour, Inc. · support at frontierstack dot app
More from Frontier News
· KeyRotate
KeyRotate is now available for Mac, Windows and Linux, with companion apps for iPhone and Android
Enfour's API key manager now runs on Mac, Windows and Linux. Free companion apps for iPhone, Apple Watch and Android show its leak alarms and let people ask their computer to rotate a key from anywhere. The phone never holds a key's value.
· FrontierStack, KeyRotate
Enfour publishes its signed breach advisories on the FrontierStack website
Leak news, the advisories FrontierStack and KeyRotate receive when a service or server software their users rely on is breached, is now on frontierstack.app in English, Japanese and Korean.