How-to guides
Connecting services
Apps and services OOMU can use for you.
Open Connections in the sidebar. Everything OOMU can reach beyond your own files is listed here, in seven groups. Each group has a different trust model, and it is worth knowing which is which.
| Group | Governed by |
|---|---|
| Apple Ecosystem | macOS, entirely. No OOMU account, no key. |
| Google Workspace | OAuth to your Google account. Refresh token in Keychain. |
| Cloud services | OAuth, where the build includes the client. |
| AI providers | Your API key, verified then stored in Keychain. |
| Browser Bridge | A browser add-on you install, paired with a code. Local connection only. |
| Tools on this Mac | Executables you pick yourself. |
| Messaging channels | A Slack or Discord app you create, bound to one channel and one owner. Approval commands only. |
Apple Ecosystem
"Native Mac apps, with access controlled entirely by macOS."
This is the part of OOMU with no permission layer of its own. Mail, Reminders, Calendar, Contacts, Notes, and Photos are reached through macOS, which means macOS asks (once, in its own dialog) and you manage the answer in System Settings alongside every other application.
The panel shows, per app, whether TCC Granted and Automation Allowed are true. Manage links open the right System Settings pane directly.
What OOMU can do with each, once macOS allows it:
| App | Actions |
|---|---|
| Read, create a draft, send, delete | |
| Calendar | Read events, create events |
| Reminders | Read, create, complete, delete |
| Notes | Read, create, update, delete |
| Contacts | Read, look up, create |
| Photos | Read, create an album |
| Music | Read status, play, pause |
| Notifications | Deliver a notification |
| Clipboard | Read the current text, copy text or a file |
Apple Shortcuts
"Use the shortcuts already installed on this Mac. OOMU only checks or runs them when you ask."
The panel shows how many shortcuts are installed and offers Test Shortcuts. OOMU can list your installed shortcuts and run one with optional text or file input. It does not create or edit shortcuts.
Google Workspace
"Gmail, Calendar, and Drive, connected directly to your Google account."
Choose Sign in with Google. Your browser opens Google's own sign-in page (OOMU never asks for your Google password) and OOMU uses OAuth with PKCE against a reviewed desktop client. When it completes, the panel shows Connected as {email}.
OOMU requests exactly three scopes, and no others:
| Scope | What it permits |
|---|---|
gmail.modify | Read threads, create drafts, send a draft |
calendar.events | List and create events |
drive.readonly | Search Drive and read a file. Read only. |
The eight capabilities built on those scopes are: list Gmail messages, read a Gmail thread, create a Gmail draft, send a Gmail draft, list Calendar events, create a Calendar event, search Drive, and read a Drive file.
"Your refresh token stays in macOS Keychain. OOMU connects only when you ask it to use a Workspace tool." The database stores an opaque reference and non-secret metadata. It never stores the token.
Disconnect / Manage Permissions revokes at Google and clears the local record.
Other cloud services
The Cloud services panel lists connectors this copy of OOMU was built with. Three exist in the code:
| Connector | Description |
|---|---|
| Google Workspace | Search Gmail, view your calendar, and find files in Drive. |
| Microsoft 365 | Work with Outlook, your calendar, and OneDrive. |
| Slack | Find conversations and send messages in Slack. |
Read the status before you plan around one. Each connector's OAuth client is compiled in at build time. If a client was not compiled into your copy, the connector shows Unavailable with "This service isn't configured in this build." In Beta 4, as in Beta 3, only Google Workspace ships with a reviewed client. Microsoft 365 and Slack are present in the code and gated off.
This Slack is not the messaging channel. The Slack connector here would let the assistant search and post in your workspace, and it is not available. Approving files from Slack on your phone is a separate feature, under Messaging channels, and it is available.
This is deliberate. OOMU does not offer a sign-in button that leads nowhere.
Once connected, a service exposes two capability shapes to the assistant: Read from a connected service and Update a connected service. Both are named that plainly in the interface.
AI providers
"Connect directly, then verify the real provider round trip."
These providers have built-in entries:
| Google AI Studio · OpenAI · Anthropic · xAI · Mistral AI · DeepSeek | Alibaba Qwen · Z.AI and Zhipu AI GLM · Moonshot AI (Kimi) · OpenRouter · Synthetic |
Some come in regional versions, such as Alibaba Qwen for the United States or international, and Moonshot AI global or mainland China. Pick the one your account belongs to.
The list of models under each provider updates on its own from a signed catalog, and Refresh models checks for a newer one straight away. A new chat on Google defaults to Gemini 3.8 Flash.
Paste an API key and choose Test connection. OOMU performs a real round trip and reports the measured latency. If verification fails, nothing is saved: no half-configured provider, no key sitting in your Keychain for an endpoint that never answered.
Verified keys go into the macOS Keychain, under a Beta 4-specific service namespace.
Custom providers
+ Custom Provider connects any OpenAI-compatible endpoint you trust. Supply a display name, a base URL, one model ID per line, and a key. "The API key is verified first, then stored securely in macOS Keychain." If OOMU cannot verify the endpoint it says so and saves nothing.
Browser Bridge
"Use ChatGPT, Claude, Gemini, or Grok in a browser where you are already signed in."
The Browser Bridge lets OOMU work with an AI chat you already have open in your browser, on the account you already pay for, without an API key. It appears alongside the AI providers.
- Choose Set up, then Get browser add-on. OOMU saves the add-on to a folder on this Mac: "Save the add-on below, then add it from your browser's Extensions page. For Firefox, follow the instructions in the saved folder."
- Choose Show connection code and copy it into the add-on. "You will need a new code each time OOMU restarts."
- Open a chat in your browser, then Choose a chat in OOMU and Check connection.
The add-on talks to OOMU over a connection that never leaves your Mac, on a local port that only this computer can reach. What you send to ChatGPT, Claude, Gemini, or Grok this way goes to that service under your own account and its terms, exactly as if you had typed it there. Air-Gap Mode blocks it like every other outside connection.
Tools on this Mac
"Let OOMU use tools already installed on this Mac, like your notes app or a design tool."
This is local MCP. Add a tool opens the macOS file picker so you choose the executable yourself. The note under it matters: "OOMU opens the Mac file picker. Chats can never choose or change the app's private setup." A model cannot point OOMU at an arbitrary binary.
Each connected tool lists what it exposes, split two ways:
| State | |
|---|---|
| Read-only | The tool can only read. |
| Makes changes | The tool can mutate something. |
The panel counts them: "{read} can only read · {mutation} can make changes."
New tools can make changes until you mark them read-only. That is stated on the panel, and it is worth acting on. Review a newly added tool's list and mark anything that should not mutate.
Check for new tools re-reads the tool list. If it changed since you connected, the state shows Tools changed rather than silently accepting the new set. You can rename, disable, or remove a connection at any time.
Configured local tools
A separate Add from a setup file flow imports an MCP manifest, for tools that need structured configuration. These appear under Configured local tools, each marked On this Mac or Remote, with their own connect, reconnect, disable, and remove controls.
Messaging channels
"Message OOMU from your phone, review staged deliverables, and approve or deny them remotely."
There are two: Slack and Discord. Each is bound to one channel and one person, and it accepts seven fixed commands for the files waiting in Ready for review: check status, run a check, list, preview, approve, deny, and snooze. It is a remote control for approvals, not a way to chat with OOMU or give it new work, and it only answers while OOMU is open on your Mac.
Setup takes four guided steps, and OOMU verifies your tokens with Slack or Discord before saving anything to the Keychain. The full walkthrough, the command list, and exactly what a reply can contain are in Approving from Slack or Discord.
Telegram is gone. Beta 3 could send results to Telegram or Discord, one way. Beta 4 removes Telegram entirely. A Discord destination from Beta 3 comes across, but stays silent until you finish the new setup and choose the one account allowed to control OOMU.
What macOS is letting OOMU do
Settings → Connections & Apps → Mac access is the honest summary: "See the access macOS gives OOMU. macOS asks only when a feature needs it."
It reports ten categories (Accessibility, Input Monitoring, Screen & System Audio Recording, Automation, Files and Folders, Calendar, Contacts, Photos, Reminders, and Notifications) each in one of eight states:
| State | Meaning |
|---|---|
| Allowed | Granted. |
| Limited | Partial access, for example a subset of Photos. |
| Not asked yet | macOS has not prompted. |
| Denied | You said no. |
| Restricted by macOS | A policy on this Mac prevents it. |
| Needs System Settings | Must be granted manually. |
| macOS asks when needed | Prompted at point of use. |
| Unavailable | Not applicable here. |
Open System Settings jumps to the right pane. Check again re-reads the current state.
There is no OOMU-side override, and there is no OOMU permission dialog. If macOS says no, the answer is no.
Related
- Automating your Mac: what OOMU does with Apple app access once granted.
- Approving from Slack or Discord: the messaging channels, step by step.
- Working fast: the Quick Launcher, which reaches all of this from anywhere on your Mac.
- Privacy & security: where credentials live and what the database holds.