outboundctl ai

outboundctl ai ask asks a language model at the selected provider or custom server a question about this Mac’s network activity, using the same rollups the app’s analytics shows. It is read-only: no rule or setting can change through it. You bring your own API key, and you can inspect the exact request before anything leaves the Mac. For the privacy picture, see providers and privacy.

outboundctl ai providers
outboundctl ai ask [--provider openai|anthropic|gemini|openrouter|custom] [--model <id>]
                   [--base-url <url>] [--window hour|day|week|month|year] [--preview] <question>

Providers

ai providers lists what outboundctl can ask, one per line: the --provider name, the display name, the default model, and the environment variable the key is read from.

Provider	Display name	Default model	Key variable
openai	OpenAI	gpt-6.1-sol	OPENAI_API_KEY
anthropic	Anthropic	claude-sonnet-5-5	ANTHROPIC_API_KEY
gemini	Google Gemini	gemini-3.8-flash	GEMINI_API_KEY
openrouter	OpenRouter	~openai/gpt-sol-latest	OPENROUTER_API_KEY
custom	OpenAI-Compatible	(you choose)	OUTBOUND_AI_KEY

custom talks to any OpenAI-compatible server (Ollama, LM Studio, vLLM): pass its /v1 base with --base-url, for example http://127.0.0.1:11434/v1. A custom server on this machine (localhost, 127.0.0.1 or ::1) can use http:// and needs no key. Any other server needs an https:// address and a key: unencrypted AI connections are allowed only on this Mac, and a redirect to a different address or transport is refused. Requests to a cloud provider go to the provider’s own endpoint, over a connection that gives up after 60 seconds of silence or 90 seconds in total.

Asking

The question is the unconsumed arguments joined with spaces. Quote it as one argument to keep words resembling recognised flags inside the question. --window picks how far back the figures reach: hour, day, week, month or year, default week. --model overrides the provider’s default model. The provider defaults to openai. An unrecognised provider or window value, or either flag without a value, is a usage error.

Without a key in the provider’s environment variable, the command stops with a usage error that names the variable and suggests --preview to see the request anyway.

The answer is printed as plain text. One request, one answer: no tools run on the provider’s say-so.

If the analytics database does not exist, the command stops with a message that says so and names the analytics database it looked for.

What is sent

The request contains fixed instructions, your question verbatim and figures for the chosen window. The automatic summary includes totals, app names, website domains and countries. The domain ranking excludes IP addresses. Anything you put in the question is also sent:

• Totals: connections, allowed, blocked, bytes sent and received, and how many apps, domains and countries were seen.
• Up to 8 top apps, with connection and blocked counts. Sent and received byte fields appear only when their sum is positive.
• The top domains (up to 8), with connection and blocked counts and byte fields when their sum is positive; IP addresses are excluded from this list.
• Up to 8 top countries and up to 5 apps seen for the first time in the window, with the date each was first seen.

The instructions tell the model to use only the figures given, quote numbers exactly, never estimate, never call anything malware or safe, and treat a country as where a server is. The figures are data; the prompt says so explicitly.

--preview prints the exact request (the method line, headers and body) and sends nothing. The key is redacted as <your key>.

month covers the preceding 30 days and year the preceding 365 days. Each request asks for at most 700 output tokens. A custom provider needs both a model ID and an HTTPS base URL, or HTTP only for a server on this Mac.

outboundctl ai ask --provider openai --window day --preview "Which apps used the most data?"

Success exits 0. Missing questions, invalid provider/window choices and missing required keys exit 64. Analytics, request-construction and provider failures exit 1.