Recipe

Get approvals for new apps

In Ask mode, Kilobat holds the first connections of an app that has no rule. It shows who signed the app and where it wants to go.

Needs Kilobat Pro in the appNeeds the network filter and the running appChecked: 29 October 2026

In the app

Switch to the Travel or Work profile. Unrestricted allows every app.
Click the pill above the app list and choose Ask about new apps.
To let macOS services and Apple apps through, turn on Allow Apple Software.
When a new app connects, read its signer, its path and its destinations in the window.
Click Allow This App or Block This App. Use More allow options for Allow for 1 Hour.

With the CLI

Ask about new apps.
```
kilobat settings new-apps ask
```
Let Apple software through.
```
kilobat settings apple-software on
```
List the apps that wait.
```
kilobat approvals
```
Output Each app with its process, path, signer, whether the signature is valid, and its destinations.
Block a waiting app at once.
```
kilobat deny com.example.App
```
Ask to allow a waiting app. Kilobat opens its window, and you confirm there.
```
kilobat approve com.example.App
```

Through MCP

Connect the MCP server once with claude mcp add kilobat -- kilobat mcp. For other clients, see the docs. Then an agent can call these tools. Tools that change settings tell the agent to ask you first.

Tool and arguments	What it does
`set_new_app_mode` `{"mode": "ask", "allow_apple": "on"}`	How Travel and Work treat apps that have no rule.
`list_approvals`	The apps that wait, with signer and destinations.
`decide_approval` `{"app": "com.example.App", "decision": "block"}`	Blocks at once. `allow` only opens the window for you to confirm.

Good to know

Connections that get no answer stop after one minute. The app asks again later.
If Kilobat is not running, new apps are allowed, not held.
Your blocklist and connection rules apply in every mode.
Do not allow an app with Signature not valid, or an app that you do not know.

Sources

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with man <name> in Terminal.