FrostMI observes security-sensitive local Agent metadata, so its default boundary is intentionally narrow: local storage, bounded reads, no execution of discovered MCP commands, and no claim of entitlement-backed telemetry when that sensor is unavailable.

Please use GitHub's private vulnerability-reporting flow for the FrostMI repository. Do not open a public issue for a report that includes an exploit, a sensitive local path, tokens, credentials, or private session data.

Include the affected commit or version, macOS version, reproduction steps, impact, and the smallest safe proof needed to validate the report. Remove real secrets and personal content from logs or screenshots.

• The discovery database and JSONL exports are local files owned by the current user.
• Static MCP discovery parses configuration but does not start servers.
• Process arguments are sanitized before persistence.
• File traversal, file size, directory count, memory-file collection, and runtime retention are bounded.
• FSEvents and lsof observations are evidence, not authorization or prevention controls.
• Endpoint Security and Network Extension states are reported from actual entitlement and framework checks.
• The optional MCP stdio wrapper forwards the protocol unchanged while recording bounded request and response metadata.

Treat the FrostMI database, JSONL exports, screenshots, and runtime timelines as potentially sensitive. They can reveal local paths, installed tools, process ownership, remote destinations, and MCP tool names. Review them before attaching them to an issue.

The current v0.2 development build is not an EDR, does not block prompts or tool calls, and does not provide entitlement-backed Endpoint Security auth events or Network Extension enforcement.