AI apps and MCP

Outbound includes a Model Context Protocol (MCP) server, so AI apps on your Mac can ask about your network: which apps connect, the sites and countries they reach, what was blocked, and your rules. The apps see the same figures as Analytics, never the contents of a connection. Anything they could change, they can only ask for; you approve each change.

Adding Outbound to an AI app

Settings › Intelligence has an “Add Outbound to” row with buttons for the supported clients:

• Claude Code
• Claude (Claude Desktop)
• Cursor
• Codex
• Gemini CLI
• VS Code

Each button runs outboundctl mcp install --client <name> under the hood and edits that app’s own configuration file, merging Outbound into what is already there. The installer tells you to restart Claude and VS Code afterwards. For Cursor the entry is written as a standard input/output server; for Codex, whose settings are TOML, Outbound only ever appends a [mcp_servers.outbound] table and never rewrites or removes a line of your file.

The same row shows the “Command” to enter by hand: the full path to Outbound’s outboundctl followed by mcp, with a Copy button.

From the command line, the full form is:

$ outboundctl mcp install --client claude-code
Added Outbound to Claude Code (/Users/you/.claude.json).

Pass --dry-run to print the file it would write without changing anything. The client names are claude-code, claude-desktop, cursor, codex, gemini and vscode. Running outboundctl mcp on its own starts the server on standard input and output, which is what the AI app launches. The CLI reference covers the flags in full.

Choosing what the server offers

Three flags shape what an AI app can do. Add them after mcp, or pass them to mcp install, which writes them into the client’s configuration:

• --read-only offers no tools that change anything.
• --toolsets limits the tools to a comma-separated list of groups: traffic, rules, trackers and review.
• --detail hosts includes full host names, but only while “Let AI apps see host names” is on in Settings › Intelligence. The default is --detail domains.

outboundctl mcp --print-disclosure prints the disclosure policy the server would use, without starting it.

What AI tools can see

By default AI tools see website domains, not full host names: api.example.com appears as example.com. Addresses and networks show as “address”, and local names show as “local network”. App paths show as app names, and your user name is never included. Rules the tools return follow the same policy.

To share full host names with AI apps, turn on “Let AI apps see host names” in Settings › Intelligence and start the server with --detail hosts. Host names, IP addresses, networks and local names are then included; paths still show as app names and user names stay hidden.

The same policy applies to an explanation in a connection alert and to outboundctl output in JSON, NDJSON, TSV and legacy JSON. See machine-readable output.

What the tools return

The server offers 26 tools in four groups. These read records and change nothing:

Tool	Group	What it reports
network_summary	traffic	Totals for a window: connections, blocked, data sent and received, top apps, domains and countries, new apps
top_apps	traffic	The apps that connected most, by data then connections
top_domains	traffic	The website domains reached most, by connections
top_countries	traffic	The countries whose servers were reached most, as ISO codes
blocked	traffic	Blocked connections: totals plus the apps and domains blocked most
new_apps	traffic	Apps that connected for the first time in the window, newest first
traffic_over_time	traffic	Connections and bytes in each hour or day
app_activity	traffic	What one app sent: totals, domains, countries and ports
recent_connections	traffic	History rows, with domains unless host names are allowed
alerts_spikes	traffic	Upload spikes detected in the last seven days
audit_events	traffic	Audit lines in a window from the app’s copy of the audit log, not the sealed record
audit_sinks	traffic	Each configured audit sink’s last delivery, backlog and last error
firewall_status	rules	Whether the filter is configured and on, and how many rules there are
rules	rules	The rules: action, remote, ports, protocol, program, enabled
explain_connection	rules	Why the saved rules decide a connection
change_status	rules	The decision on a change request; it cannot approve one
tracking_report	trackers	Tracker companies and the apps that reach them
tracker_lookup	trackers	The tracker catalogue label for a host, if any
app_optouts	trackers	Telemetry switches a company already offers for an app
likely_telemetry	trackers	Unverified local telemetry suggestions; they never become blocks from this tool
review_queue	review	Connections waiting for a decision; you decide them in Outbound

Five tools ask for a change: add_rule, remove_rule, set_rule_enabled and activate_profile (switch the active profile) in the rules group, and block_trackers (block known trackers for one app) in the trackers group. Outbound shows each request on your Mac and changes nothing unless you allow it; “Rule changes” in Outbound decides how rule requests are handled. The server marks these tools destructive in its tool listings, and --read-only leaves them out.

The activity tools accept a window of hour, day, week, month or year, defaulting to day. The ranking tools, blocked and new_apps accept limit, from 1 to 20 rows, defaulting to 10. network_summary accepts only window. firewall_status takes no parameters. rules accepts only limit, from 1 to 200, defaulting to 50.

Coding agents used by Outbound itself

Settings › Intelligence shows detected agents under “Your Coding Agents”, plus the currently selected agent if it is no longer found. The supported names are Claude Code, Codex, Gemini CLI, Cursor, GitHub Copilot, OpenCode, Grok, Factory Droid, Goose, Kimi CLI, Qwen Code, Kilo, Cline and Auggie. Outbound looks for installed agent commands and talks to them over the Agent Client Protocol. Claude Code and Codex also need Node.js (npx): Outbound launches pinned adapter packages through npx -y, which can download those packages.

An agent answering the Assistant starts in an Outbound-owned workspace. Outbound permits its own MCP tools and refuses permission requests for other work. Codex is also launched in read-only mode. The agent’s own settings decide what it can do without requesting permission, so these controls are not a general sandbox guarantee.

If an agent needs you to sign in, Outbound tells you how: “Open Terminal, run “claude” and sign in, then try again.” (the wording names the agent’s own command).