---
title: "Get approvals for new apps · Kilobat Recipes"
url: "https://kilobat.app/guides/recipes/approve-new-apps"
description: "Make Kilobat hold the first connections of a new app and ask you to allow or block it, with its signer, path and destinations."
---

Recipe

# Get approvals for new apps

In Ask mode, Kilobat holds the first connections of an app that has no rule. It shows who signed the app and where it wants to go.

Needs Kilobat Pro in the app · Needs the network filter and the running app · Checked: 29 October 2026

## In the app

1. Switch to the Travel or Work profile. Unrestricted allows every app.
2. Click the pill above the app list and choose Ask about new apps.
3. To let macOS services and Apple apps through, turn on Allow Apple Software.
4. When a new app connects, read its signer, its path and its destinations in the window.
5. Click Allow This App or Block This App. Use More allow options for Allow for 1 Hour.

## With the CLI

1. Ask about new apps.

   ```
   kilobat settings new-apps ask
   ```
2. Let Apple software through.

   ```
   kilobat settings apple-software on
   ```
3. List the apps that wait.

   ```
   kilobat approvals
   ```

   Output Each app with its process, path, signer, whether the signature is valid, and its destinations.
4. Block a waiting app at once.

   ```
   kilobat deny com.example.App
   ```
5. Ask to allow a waiting app. Kilobat opens its window, and you confirm there.

   ```
   kilobat approve com.example.App
   ```

## Through MCP

Connect the MCP server once with `claude mcp add kilobat -- kilobat mcp`. For other clients, see [the docs](https://kilobat.app/docs#agents). Then an agent can call these tools. Tools that change settings tell the agent to ask you first.

| Tool and arguments | What it does |
|---|---|
| `set_new_app_mode` `{"mode": "ask", "allow_apple": "on"}` | How Travel and Work treat apps that have no rule. |
| `list_approvals` | The apps that wait, with signer and destinations. |
| `decide_approval` `{"app": "com.example.App", "decision": "block"}` | Blocks at once. `allow` only opens the window for you to confirm. |

## Good to know

- Connections that get no answer stop after one minute. The app asks again later.
- If Kilobat is not running, new apps are allowed, not held.
- Your blocklist and connection rules apply in every mode.
- Do not allow an app with Signature not valid, or an app that you do not know.

## Sources

- [Kilobat docs: New apps: allow, ask or block](https://kilobat.app/docs#new-apps)
- [Kilobat skill: mac-app-firewall](https://github.com/seifip/kilobat-skills/tree/main/skills/mac-app-firewall)
- [Kilobat llms.txt: CLI and MCP reference](https://kilobat.app/llms.txt)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

## Related guides

- [Block an app on metered networks](https://kilobat.app/guides/recipes/block-app-on-metered): The Travel profile allows only the apps that you choose.
- [Little Snitch, LuLu and other network extensions conflict on a Mac](https://kilobat.app/guides/network-extension-conflicts): Firewalls, VPNs and content filters on macOS use network extensions.
- [A content filter blocks websites on a Mac](https://kilobat.app/guides/content-filter-blocking): A content filter examines web traffic and blocks some sites.
- [See where your apps connect](https://kilobat.app/guides/recipes/see-where-apps-connect): Kilobat shows the open connections of each app and the country where each address is registered.