How-to guides
Connecting services
Apps and services OOMU can use for you.
Open Connections in the sidebar. Everything OOMU can reach beyond your own files is listed here, in five groups. Each group has a different trust model, and it is worth knowing which is which.
| Group | Governed by |
|---|---|
| Apple Ecosystem | macOS, entirely. No OOMU account, no key. |
| Google Workspace | OAuth to your Google account. Refresh token in Keychain. |
| Cloud services | OAuth, where the build includes the client. |
| AI providers | Your API key, verified then stored in Keychain. |
| Tools on this Mac | Executables you pick yourself. |
| Messaging channels | A bot token you supply. Outbound delivery only. |
Apple Ecosystem
"Native Mac apps, with access controlled entirely by macOS."
This is the part of OOMU with no permission layer of its own. Mail, Reminders, Calendar, Notes, and Photos are reached through macOS, which means macOS asks (once, in its own dialog) and you manage the answer in System Settings alongside every other application.
The panel shows, per app, whether TCC Granted and Automation Allowed are true. Manage links open the right System Settings pane directly.
What OOMU can do with each, once macOS allows it:
| App | Actions |
|---|---|
| Read, create a draft, send, delete | |
| Calendar | Read events, create events |
| Reminders | Read, create, complete, delete |
| Notes | Read, create, update, delete |
| Contacts | Read, create |
| Photos | Read, create an album |
| Music | Read status, play, pause |
| Notifications | Deliver a notification |
| Clipboard | Read the current text, copy text or a file |
Apple Shortcuts
"Use the shortcuts already installed on this Mac. OOMU only checks or runs them when you ask."
The panel shows how many shortcuts are installed and offers Test Shortcuts. OOMU can list your installed shortcuts and run one with optional text or file input. It does not create or edit shortcuts.
Google Workspace
"Gmail, Calendar, and Drive, connected directly to your Google account."
Choose Sign in with Google. Your browser opens Google's own sign-in page (OOMU never asks for your Google password) and OOMU uses OAuth with PKCE against a reviewed desktop client. When it completes, the panel shows Connected as {email}.
OOMU requests exactly three scopes, and no others:
| Scope | What it permits |
|---|---|
gmail.modify | Read threads, create drafts, send a draft |
calendar.events | List and create events |
drive.readonly | Search Drive and read a file. Read only. |
The eight capabilities built on those scopes are: list Gmail messages, read a Gmail thread, create a Gmail draft, send a Gmail draft, list Calendar events, create a Calendar event, search Drive, and read a Drive file.
"Your refresh token stays in macOS Keychain. OOMU connects only when you ask it to use a Workspace tool." The database stores an opaque reference and non-secret metadata. It never stores the token.
Disconnect / Manage Permissions revokes at Google and clears the local record.
Other cloud services
The Cloud services panel lists connectors this copy of OOMU was built with. Three exist in the code:
| Connector | Description |
|---|---|
| Google Workspace | Search Gmail, view your calendar, and find files in Drive. |
| Microsoft 365 | Work with Outlook, your calendar, and OneDrive. |
| Slack | Find conversations and send messages in Slack. |
Read the status before you plan around one. Each connector's OAuth client is compiled in at build time. If a client was not compiled into your copy, the connector shows Unavailable with "This service isn't configured in this build." In Beta 2 only Google Workspace ships with a reviewed client. Microsoft 365 and Slack are present in the code and gated off.
This is deliberate. OOMU does not offer a sign-in button that leads nowhere.
Once connected, a service exposes two capability shapes to the assistant: Read from a connected service and Update a connected service. Both are named that plainly in the interface.
AI providers
"Connect directly, then verify the real provider round trip."
Eight providers have built-in entries:
| Google AI Studio · OpenAI · Anthropic · DeepSeek | Alibaba Cloud (Qwen) · Zhipu AI GLM · OpenRouter · Synthetic |
Paste an API key and choose Test connection. OOMU performs a real round trip and reports the measured latency. If verification fails, nothing is saved: no half-configured provider, no key sitting in your Keychain for an endpoint that never answered.
Verified keys go into the macOS Keychain, under a Beta 2-specific service namespace.
Custom providers
+ Custom Provider connects any OpenAI-compatible endpoint you trust. Supply a display name, a base URL, one model ID per line, and a key. "The API key is verified first, then stored securely in macOS Keychain." If OOMU cannot verify the endpoint it says so and saves nothing.
Tools on this Mac
"Let OOMU use tools already installed on this Mac, like your notes app or a design tool."
This is local MCP. Add a tool opens the macOS file picker so you choose the executable yourself. The note under it matters: "OOMU opens the Mac file picker. Chats can never choose or change the app's private setup." A model cannot point OOMU at an arbitrary binary.
Each connected tool lists what it exposes, split two ways:
| State | |
|---|---|
| Read-only | The tool can only read. |
| Makes changes | The tool can mutate something. |
The panel counts them: "{read} can only read · {mutation} can make changes."
New tools can make changes until you mark them read-only. That is stated on the panel, and it is worth acting on. Review a newly added tool's list and mark anything that should not mutate.
Check for new tools re-reads the tool list. If it changed since you connected, the state shows Tools changed rather than silently accepting the new set. You can rename, disable, or remove a connection at any time.
Configured local tools
A separate Add from a setup file flow imports an MCP manifest, for tools that need structured configuration. These appear under Configured local tools, each marked On this Mac or Remote, with their own connect, reconnect, disable, and remove controls.
Messaging channels
"Send routine results to one verified Telegram or Discord destination."
This is outbound delivery only. A messaging channel is a destination OOMU can send a result to. It is not a way to control OOMU from your phone, and OOMU does not read messages from it.
| Service | You supply |
|---|---|
| Telegram | Bot token and a chat ID |
| Discord | Bot token and a channel ID |
Choose Connect and OOMU verifies both the token and the destination with the service before saving anything. On success: "Account and destination verified."
"The key is sent directly to the service for checking, then stored safely on this Mac. It is never kept in this form."
Test re-verifies a live channel. Disconnect stops delivery but keeps the record; Remove deletes it.
What actually uses it today. Sending to a channel is a capability OOMU can call while working (
channel.remote.message.send). It is not yet one of the actions you can add as a step in the workflow builder, so a scheduled routine cannot currently be authored to post its own result. Scheduled runs notify you through macOS notifications instead.
What macOS is letting OOMU do
Settings → Mac access is the honest summary: "See the access macOS gives OOMU. macOS asks only when a feature needs it."
It reports ten categories (Accessibility, Input Monitoring, Screen & System Audio Recording, Automation, Files and Folders, Calendar, Contacts, Photos, Reminders, and Notifications) each in one of eight states:
| State | Meaning |
|---|---|
| Allowed | Granted. |
| Limited | Partial access, for example a subset of Photos. |
| Not asked yet | macOS has not prompted. |
| Denied | You said no. |
| Restricted by macOS | A policy on this Mac prevents it. |
| Needs System Settings | Must be granted manually. |
| macOS asks when needed | Prompted at point of use. |
| Unavailable | Not applicable here. |
Open System Settings jumps to the right pane. Check again re-reads the current state.
There is no OOMU-side override, and there is no OOMU permission dialog. If macOS says no, the answer is no.
Related
- Automating your Mac: what OOMU does with Apple app access once granted.
- Scheduling routines: where messaging channels are actually used.
- Working fast: the Quick Launcher, which reaches all of this from anywhere on your Mac.
- Privacy & security: where credentials live and what the database holds.