A guarded infrastructure layer for your AI agents

Connect Codex, Claude Code, Cursor, Gemini CLI, desktop assistants or a multi-agent coordinator to your real fleet without copying server credentials into the model, its memory or an MCP configuration file.

FrontierStack is not another model. It is the local server-administration authority between the model and your infrastructure. The agent can investigate and request work; FrontierStack decides what that caller may see or change, supplies credentials only at execution time, verifies the outcome and records the action.

See the complete workflow Review the security boundary

What an MCP call passes through

Authenticate the caller. Local clients use the owner-only Keychain bridge. Network clients must use FrontierStack’s explicitly enabled, signed and scoped access path.
Discover only relevant tools. A compact bootstrap catalog finds the tools that match the task and the caller’s current permission instead of loading the whole product into every prompt.
Apply infrastructure policy. Read-only defaults, App Lock, caller scope, destructive-data rules and approval cards still apply. An agent cannot grant itself more authority.
Execute and verify. FrontierStack runs the bounded operation on this Mac or a selected Linux, Windows or Mac host, then checks an observed postcondition and returns an attributable result.

Set up a local coding agent

Open the MCP Server pane. FrontierStack detects Grok, Codex, Cursor, Gemini CLI, Claude Code and Claude Desktop. Use Set Up Detected, enable setup at launch, or configure one client at a time; Claude Code receives its exact claude mcp add command and the others have an Add to… action. Generated configuration points at FrontierStack’s owner-only bridge, so it does not serialize the bearer token into an AI-readable file. Start read-only and confirm discovery and fleet health before enabling changes.

For another stdio MCP client, install the FrontierStack CLI and ask it for the credential-safe bridge command:

frontierstack mcp

For machine-readable discovery and task-filtered tool selection:

frontierstack discover
frontierstack call frontierstack_find_tools '{"query":"investigate certificate failures on web-02"}'

Local by default; network access is explicit

The MCP service binds to localhost by default. Grok Bot or another cloud worker cannot discover a private Mac merely because FrontierStack is installed. To use a coordinator on another device, explicitly enable the supported network path, pair and scope that caller, and use TLS through your LAN, Tailscale or a deliberately configured tunnel. Do not publish the local MCP port or place its bearer token in a URL, shell history, process argument, repository or agent memory.

Use the right workflow surface

Need	Use
Interactive investigation or a bounded change from an editor/terminal agent	MCP (recommended)
Work that needs progress, cancellation, input/approval pauses and a durable result	A2A or MCP Tasks preview (opt in)
A CI or incident signal that should begin evidence collection	Authenticated CloudEvents, read-only entry
A shell script or local automation that needs stable machine-readable calls	FrontierStack CLI

Protocol and open catalog data

Stateless MCP 2026-07-28 is the preferred HTTP mode. server/discover reports supported revisions, tools, prompts, resources and cache hints; compatibility remains available for clients using the older initialize flow. Separately, assistants that only need public product knowledge can read these files without connecting to the private control server:

/llms.txt — concise Markdown
/llms-full.txt — complete product text
/data/catalog.json — the service catalog as JSON

Run it all from one Mac app.

FrontierStack installs, monitors and secures the whole stack — locally and across your fleet — from a single native macOS app.

Download FrontierStack