Know what your local AI agents are doing.
Native macOS intelligence for local Agents, MCP servers, Skills, context, memory, processes, files, network destinations, and runtime evidence.
FrostMI is a native SwiftUI app for seeing which AI agents are present on a Mac, which ones are running, what local assets they own, and what behavior the endpoint can actually observe. It recognizes separate surfaces such as Codex App and Codex CLI, joins runtime processes to static MCP, Skill, context, and memory records, and keeps the evidence in a bounded local SQLite store.
It is deliberately honest about the sensor boundary. FrostMI uses process snapshots, macOS running-app metadata, FSEvents, and lightweight lsof network-flow snapshots without pretending that a development build has Endpoint Security or Network Extension telemetry.
- Why FrostMI
- Three working views
- What FrostMI observes
- Quick start
- Runtime evidence model
- Privacy and boundaries
- Validation
- FAQ
- Project status
- One inventory for a fragmented local Agent stack. See Agents, MCP servers, Skills, instruction files, workspace context, and session or memory stores without opening every tool separately.
- Live state instead of an install list. Process inspection and
NSWorkspaceattribution distinguish an installed Agent from one that is actually running. - Behavior you can inspect. Process, file, network, MCP, tool, memory, and permission events appear in a searchable local timeline with Agent ownership and session context when attribution evidence exists.
- Useful signal without a firehose. Process samples are coalesced by minute; file and network observations use five-minute buckets; noisy event kinds and session graphs have explicit retention limits.
- Evidence stays on the Mac. Discovery, storage, analysis, and JSONL export run locally. Static MCP discovery never executes the configured server command.
Agent Analysis separates running and inactive Agents, then sorts them by meaningful activity rather than by the time a static scan happened. Activity labels make the source explicit: live activity, recent runtime, recent local activity, or last discovered. Dates use a stable numeric format such as 2026.08.09. 18:16.
Select an Agent to inspect its confidence, linked MCP servers and Skills, context and memory records, executable paths, active processes, and supporting evidence. Static Profile Rebuild and Runtime Observation controls stay at the top of the page.
Runtime Monitor combines a 60-minute activity chart with live process attribution, sensor health, refresh latency, event composition, and review-worthy signals. The event trail can be narrowed by 15 minutes, one hour, 24 hours, or all retained history; filtered by process, tool/MCP, file/memory, network, or review state; and searched across Agent, source, tool, path, provider, and metadata.
Selecting an event opens the local evidence record: exact timestamp, Agent, source, session, PID, provider, tool, risk signal, path or destination, and bounded metadata. Session Graphs reconstruct ordered nodes and next_observed edges from persisted events.
Static Scan discovers known and custom Agent candidates, MCP configuration, Skills, instruction and context files, memory metadata, and permission states. It shows the active scan roots and keeps high-confidence known Agents separate from lower-confidence or custom candidates. Every path is clickable in Finder, and the complete local evidence set can be exported as JSONL.
| Signal | Current implementation | What appears in the app |
|---|---|---|
| Agent presence | Known paths, configuration schemas, workspace markers, and fingerprints | Agent type, confidence, scope, paths, ownership |
| Running Agents | ps snapshots plus NSWorkspace.runningApplications |
PID, owner, process, score, provider, workspace |
| File activity | Root-filtered macOS FSEvents with batching and path attribution | File timeline events and Agent session nodes |
| Network destinations | Established TCP snapshots through /usr/sbin/lsof |
PID, remote endpoint, known provider, capture metadata |
| MCP | JSON/TOML config parsing and an optional transparent stdio wrapper | Server inventory, risk pre-score, tool calls and results |
| Skills and context | Bounded file metadata and content pre-scan | Scripts, URLs, install hints, context ownership, risk hints |
| Memory/session stores | Bounded discovery of JSONL, JSON, SQLite, and related files | Format, record estimate, history signals, sensitivity |
| Sensor capability | Real entitlement, framework, and command availability checks | Available, restricted, missing entitlement, or failed |
Known fingerprints currently cover Claude Code, Claude Desktop, Codex App, Codex CLI, Cursor, Gemini CLI, Windsurf, Trae, Cline/Roo Code, Continue, OpenClaw, Aider, and bounded unknown candidates. Codex App detection includes both standalone Codex.app and the Codex runtime embedded in current ChatGPT desktop builds.
- Apple Silicon Mac
- macOS 14 or later
- Xcode Command Line Tools with Swift 6 support
git clone https://github.com/godicewang/FrostMI.git
cd FrostMI
./FrostMI.commandThe command builds dist/FrostMI.app and opens it. To package a release build:
./PackageFrostMI.commandOr use the build script directly:
Scripts/build_app.sh --debug --open
Scripts/build_app.sh --releaseThe current community build is not Apple-notarized. A locally built app may require Control-click → Open the first time.
flowchart LR
A["Known paths · configs · workspaces"] --> P["Agent profile"]
B["ps · NSWorkspace"] --> P
C["FSEvents · lsof · MCP stdio"] --> E["Runtime event store"]
P --> T["Attributed timeline"]
E --> T
E --> G["Session Graph"]
T --> X["Local JSONL export"]
G --> X
Runtime records are stored in the FrostADR Runtime SQLite foundation under the current user's Application Support directory. The public product remains FrostMI; FrostADR Runtime is the internal sensing, evidence, and future response layer.
Coalescing preserves a usable trend while bounding storage:
- process observations: one record per process and minute;
- FSEvents paths: one record per path and five-minute bucket;
- network flows: one record per process, remote endpoint, and five-minute bucket;
- default store: at most 1,600 runtime events and 320 graph nodes per session;
- per-kind quotas: 360 file events, 240 network events, and 96 process observations.
Legacy persistence keys are migrated as new observations arrive, so upgrading does not leave old coalesced rows outside retention control.
FrostMI is local-first and does not require an account, cloud service, or API key. It sanitizes observed process arguments before persistence, does not execute discovered MCP commands, limits file sizes and directory traversal, and avoids broad protected macOS folders by default.
The current development build does not claim:
- Endpoint Security authentication events;
- Network Extension packet or flow-detail enforcement;
- Full Disk Access to unrelated application data;
- prompt blocking, policy enforcement, or automatic remediation.
When an entitlement or sensor is unavailable, FrostMI records that state instead of generating substitute telemetry. See SECURITY.md for the security model and disclosure process.
Run the complete local regression suite:
Scripts/run_bench_tests.shThe suite currently covers:
- 16 strict static-discovery fixtures across known, mixed, shared, duplicate, broken, and permission-degraded environments;
- 6 runtime fixtures modeled after TraceLab-style tool loops, AgentDojo-style untrusted results, and Atomic Red Team/osquery/Sigma-style endpoint events;
- runtime store retention, migration, coalescing, and session-graph reconstruction;
- real FSEvents delivery with a degraded mode for constrained CI;
- MCP stdio pass-through and capture;
- packaged app resources and release builds.
Focused commands are documented in Tests/FrostMITests/Bench/README.md and the release validation guide.
FrostMI is a local AI Agent monitor and inventory app for Apple Silicon Macs. It joins static Agent, MCP, Skill, context, and memory discovery with live process, file, network, and tool evidence.
No server is required, and FrostMI does not upload its discovery database. It records only what an enabled local sensor or wrapper can actually observe. The MCP wrapper is opt-in and captures protocol metadata while forwarding stdin and stdout unchanged.
Yes. Profiles and runtime sessions are Agent-specific when FrostMI has enough process, path, or event evidence to attribute them. Codex App and Codex CLI are kept separate.
No. FrostMI is endpoint-native Agent intelligence with a security-oriented evidence foundation. Entitlement-backed prevention and response are roadmap work, not current development-build claims.
Custom terminal and IDE behavior can resemble an Agent without proving ownership. FrostMI exposes confidence and evidence instead of silently promoting every match to a known Agent.
FrostMI v0.2 is an early public build focused on accurate local discovery and observable runtime behavior. The implemented product surface is Agent Analysis, Runtime Monitor, Static Scan, bounded local storage, Session Graph reconstruction, MCP stdio capture, and JSONL export.
Prompt Copilot, evidence-bound long-term memory, cross-Agent assistance, policy enforcement, Endpoint Security auth events, and Network Extension enforcement remain future directions. They are not represented as available UI modules.
Issues and focused pull requests are welcome. Start with CONTRIBUTING.md, SUPPORT.md, and SECURITY.md.
FrostMI is an independent project and is not an official product of OpenAI, Anthropic, Google, Apple, Cursor, or any other Agent vendor.