Frostagent

frostagent

What may your agent's tools do? A one-screen policy says; the check fails on anything else.

frostagent is a deny-by-default capability linter for AI agent setups. It reads the MCP servers, hooks, permission rules and skills that Claude Code, Claude Desktop, Cursor, VS Code, Codex, Zed, Windsurf, Gemini CLI, OpenCode, Cline and plugins have been given. It starts each server the way the host would, over stdio, streamable HTTP or legacy SSE, and inspects the tools, prompts, resources and startup instructions it offers. It reads the source of servers that live on the machine, including npx packages already in the npm cache, and says what the code can do. A lockfile pins every tool's description and schema so a server that changes under you fails the build. Nothing is uploaded anywhere.

Part of the [frost](https://github.com/keithadler/frost) family with [frostjs](https://github.com/keithadler/frostjs), [frostpy](https://github.com/keithadler/frostpy) and [frostphp](https://github.com/keithadler/frostphp): the same one-screen policy dialect, the same rule that everything is off until a line turns it on.

$ frostagent probe --user
probing meshy ... 24 tools in 1290 ms
probing retro-diffusion ... 20 tools in 527 ms
probing scantheblock ... failed: HTTP 401: authentication rejected

frostagent 0.1.0 — no policy file (everything is reported; run `frostagent init` to write one)
scanned 33 files: 9 servers, 0 hooks, 1 permission rule, 16 skills; probed 9 servers (46 tools)

FAIL  dangerous-permission permission "Bash(rm -rf ~/Library/Containers/...)"   ~/Downloads/app/.claude/settings.local.json (permissions.allow)
      pre-approves `rm -rf ~/Library/Containers/...`, which can destroy data or escalate privileges, with no confirmation.
WARN  plaintext-secret    server "meshy"   ~/.claude.json (projects[~/Downloads/app].mcpServers.meshy)
      env `MESHY_API_KEY` holds a literal secret (high-entropy value under a credential key, 40 chars).
      Reference it