◎
Agent inventory
Known and custom candidates, separate Codex App and CLI surfaces, confidence, scope, paths, and ownership.
Native macOS Agent intelligence
Know what your local
AI agents are doing.
FrostMI brings Agent inventory, MCP and Skill discovery, live process attribution, file activity, network destinations, and runtime evidence into one local-first Mac app.
No accountNo-exec MCP discoveryBounded local storageApple Silicon
Useful endpoint evidence
See the Agent, then follow the signal.
FrostMI connects static local assets to observable runtime behavior without claiming sensors the build does not have.
◉
Runtime attribution
Process snapshots and macOS running-app metadata joined back to Agent profiles and active sessions.
⌁
File activity
Root-filtered, batched FSEvents with path-based Agent attribution and five-minute coalescing.
↗
Network destinations
Lightweight established TCP snapshots with PID, remote endpoint, provider recognition, and capture metadata.
◇
MCP and Skills
No-exec JSON/TOML MCP discovery, Skill pre-scan, and optional transparent MCP stdio capture.
⌘
Local evidence store
Bounded SQLite records, searchable timeline, Session Graph reconstruction, and portable JSONL export.
Three working views
Start broad. Drill down only when needed.
The app opens on Agent-level status and keeps runtime and static evidence one click away.
Agent Analysis
Separate running and inactive Agents, then sort by evidence-backed activity. Timestamp labels distinguish live runtime, historical runtime, local file activity, and discovery time.
- Agent Command Center
- Linked MCP, Skill, context, memory, and process evidence
- Stable numeric dates: yyyy.MM.dd. HH:mm
Runtime Monitor
Track live processes, event volume, sensor health, refresh duration, and review-worthy evidence. Filter by time and signal family, search the retained trail, then inspect one event or Session Graph.
- 60-minute trend and signal mix
- Process, file, network, MCP, tool, memory, and permission events
- Persisted pause and resume preference
Static Scan
Inventory the local Agent surface with bounded reads and no-exec MCP parsing. Open evidence paths in Finder or export the complete record as JSONL.
- Known and custom Agent candidates
- MCP, Skills, context, Memory, and permission state
- Visible scan scope and confidence
Bounded by design
A timeline that remains readable.
Coalescing and explicit quotas preserve current behavior and short-term trends without turning every refresh into another permanent row.
1 minprocess observation bucket
5 minfile and network bucket
1,600maximum retained runtime events
320maximum nodes per Session Graph
Privacy and sensor boundary
Local-first, and explicit about what is missing.
Current v0.2 behavior
- Local SQLite storage and JSONL export
- Sanitized process arguments
- Bounded files and directory traversal
- No-exec MCP discovery
- Real entitlement and sensor status
Not claimed by this build
- Endpoint Security authentication events
- Network Extension enforcement or packet detail
- Full Disk Access to unrelated app data
- Prompt blocking or automatic remediation
- Cloud telemetry or remote control plane
Questions
FrostMI, in plain terms.
What is FrostMI?
A native local AI Agent monitor and inventory app for Apple Silicon Macs. It joins Agent, MCP, Skill, context, and memory discovery to observable process, file, network, and tool evidence.
Does FrostMI upload prompts or telemetry?
No server or account is required. The discovery database stays local. FrostMI records only information visible to enabled local sensors or the optional transparent MCP wrapper.
Can FrostMI monitor several Agent products at once?
Yes. Known fingerprints include Codex, Claude, Cursor, Gemini, Windsurf, Trae, Cline/Roo Code, Continue, OpenClaw, Aider, and bounded custom candidates. Ownership remains evidence-dependent.
Is FrostMI an EDR?
No. FrostMI is Agent-focused endpoint intelligence with a security-oriented evidence foundation. Entitlement-backed prevention and response remain future work.
FrostMI v0.2
Build it locally. Inspect the evidence yourself.
Apple Silicon · macOS 14+ · Swift 6