Documentation

Run Frost in
ten minutes.

Everything you need to install the desktop app, connect a MetaMask smart account, and ship your first bounded automation. This is living documentation for the early-access build.

Overview

Frost is a desktop app that turns a plain-English instruction into a signed, scoped, revocable on-chain mandate. A master agent compiles your brief into a structured authority spec; you sign once; at runtime the master dynamically spawns specialist sub-agents inside strictly bounded sub-mandates. Inference is paid per call in USDC over the x402 rail (no API keys), transactions are submitted through 1Shot's private mempool, and every decision is committed to an on-chain Merkle root via the AuditRegistry.

New here? Read the Architecture page for how Port-42 fits together — the six contracts are live on Base Sepolia and each links to BaseScan — then come back to install.

Install

Grab the build for your platform from the download page, which links straight to the latest GitHub Release. Frost is a Tauri 2 app — about 5 MB for the macOS .dmg, Windows .msi/.exe, and Linux .deb/.rpm (the self-contained Linux AppImage is ~78 MB) — and runs fully offline after install.

  1. 1
    Download & open. Pick the binary for your platform; each download has a published SHA-256 you can verify against the checksums on the download page.
  2. 2
    Install MetaMask Flask. Frost needs Flask (or a Snap-capable MetaMask) for ERC-7715 permission grants.
  3. 3
    Add Base Sepolia. The MVP targets Base Sepolia; Frost will prompt MetaMask to switch/add the chain on first connect.

Connect your wallet

Frost talks to your browser MetaMask through a hosted bridge at /connect. When the app needs a signature or a permission grant, it opens the matching bridge route and waits for the signed result on a local callback. You stay in control: nothing is submitted without an explicit click in MetaMask.

Your account must be a MetaMask Smart Account. Frost never upgrades it for you — switch the account to a smart account inside MetaMask, then retry.

Author a mandate

Describe the workflow in one sentence — a trigger, an action, and limits:

If ETH on Uniswap v3 falls below $2,800, swap to USDC on the best Base DEX, then post a Discord update. Cap $200, slippage < 30bps, pause for me above $8k, expire in 48h.

Frost compiles that into a structured mandate with explicit caveats, shows you the spec, and asks you to sign once. From then on the master agent acts only within those bounds.

Caveats & safety

Caveats are the load-bearing safety primitive. Authority can only narrow as it flows down the delegation chain — a sub-agent can never hold more power than its parent.

CAP$200HITL ≥$8kSLIPPAGE30bpsTTL48hSUBS ≤12CHAINBase
  • HITL threshold intersects as max(parent, sub) — sub-mandates can only tighten it.
  • Rate limits use a unified token bucket across x402 settlements and sub-mandate issuance.
  • Revocation is one click — kill any branch, or the master's spawning authority, mid-flight.

Bridge routes

The hosted bridge exposes one route per signing action. The Tauri app opens these with a one-time challenge and a local callback port.

/connect/loginConnect a MetaMask Flask account and read its address + chain.
/connect/grant-permissionsReview and approve an ERC-7715 execution permission.
/connect/commitEIP-712 co-sign of a session's audit Merkle root.
/connect/revokeSubmit disableDelegation() to revoke a granted permission.
/connect/echoRound-trip smoke test for the Tauri ↔ browser bridge.