Documentation
Security & data
What Frontier Proxy runs, what it stores, what it never does — and the boundaries you should know before pointing an agent at a folder.
No API keys
Frontier does not call model APIs and holds no keys of its own. There are no key or token fields on providers,
by design. Every agent authenticates through its own CLI's login session, which stays where that CLI put it. If a
provider cannot authenticate, log in with that CLI — copilot login, for example.
How processes are launched
-
Never through a shell. Providers are spawned with a cross-platform argument-safe wrapper
(including Windows
.cmdshims) with shell execution disabled. - Prompts go over stdin. The prompt is never interpolated into a command line, so nothing in a prompt can be read as an argument or shell metacharacter.
-
Custom CLIs get the same treatment. The
{prompt}placeholder exists only for tools that require the prompt as an argv value.
Permission modes
| Agent | Mode |
|---|---|
| Codex | --sandbox workspace-write |
| Claude Code | --permission-mode acceptEdits |
| Copilot |
Non-interactive silent mode with an explicit allow list for file writes and common Git, package, and build
commands — not --allow-all.
|
The desktop app itself
- Renderer code has no Node.js access; a small context-isolated preload bridge exposes only task and settings operations.
- MCP OAuth tokens are encrypted with Electron's
safeStorage, stay in the main process, and reach agents only as environment-backed header placeholders. - No telemetry is included.
What is stored, and where
State lives in a single frontier-state.json file in Electron's per-user application-data directory:
tasks and their conversations, provider configuration, settings, and usage counters. Daily usage totals are
discarded at the next local-date rollover. Delete the file to reset the app completely.
macOS permissions
The normal folder chooser and projects under your home directory do not require Full Disk Access. Choose New task → Choose folder… → Use this folder, or paste an absolute path. Full Disk Access is only relevant for protected locations such as Mail, Messages, some system folders, or another user's data.
If a provider is Ready but later hits an operating-system permission error, grant access to Frontier Proxy and the relevant CLI host in System Settings → Privacy & Security, then restart the app. A provider that says Not detected is a PATH problem, not a filesystem permission problem.
Honest limits
- Frontier proxies CLI processes, not the private internals of the Codex or Claude desktop apps.
- Subscription tools expose no reliable universal "tokens remaining" interface, so Frontier combines what each CLI reports with conservative local estimates and optional daily budgets.
- Direct Ollama output is not an agent. Use Codex + Ollama when a local model needs filesystem and shell tools.