App access

Lookout runs an MCP server, so another app can start, steer and watch chats on your machines. Each app signs in with your Lookout account and gets only the tools you allow. Settings › App access lists these apps. What the agent itself uses is on Settings › Connectors (Connectors and skills).

Server address

https://mcp.lookout.itoowasinarcadia.com/mcp

Connect an app, in Settings › App access, shows it as Server URL with Copy.

Connect an MCP client

1. In Settings › App access, click Connect an app, then Another MCP client, and copy the server URL.
2. In the client, add a remote MCP server and paste the server address.
3. The client opens your browser. Sign in with your Lookout account: only the account the server belongs to can approve the app.

The app then shows under Apps in Settings › App access. The server signs clients in with OAuth (scope mcp).

Connect Grok

1. In Settings › App access, click Connect an app, then Grok, and copy the server URL.
2. In Grok, open Connectors, then New Connector, then Custom.
3. Paste the server address.
4. Sign in when the browser opens.

Let apps reach this Mac

The Mac that answers the server address signs apps in with your account. Turn it on once:

1. Open Settings › App access and turn on Let apps reach this Mac.
2. Enter your Lookout password and click Turn on.

Connect an app asks for the same password first when the switch is still off. Lookout keeps the credential on this Mac and never shows it; your password isn't stored. When your account no longer takes it, the row says so with Set up again. Turning the switch off revokes it, and the apps that reach this Mac lose access until you turn it on again. Turning it on again asks connected apps to sign in once more.

What a connected app can do

Its tools start chats and send them follow-ups, check, stop, retry and answer them, read the files they changed, merge or push their worktrees, manage projects, list models and plan usage, and list and tune your machines. A chat they start can wait out a used-up plan, or move to models they list, and go on by itself (MCP tools). Every refusal carries a code and the call to make next.

A call can name the machine it runs on. A new chat can take machine: "auto", which puts it on the machine with the most headroom that runs its model; the chat stays on that machine. A machine's limits hold the chats connected apps start there until it has room.

Choose the tools an app can use

1. Open Settings › App access. In the app's menu, click Edit tools.
2. Turn tools on or off, or click All or None.
3. Click Save.

The change applies within 5 minutes, on the app's next token refresh. Lookout enforces the choice; the app's own tool switches don't change it.

Let an app add projects

An app works in the projects you already have. To let one add a folder of yours as a project, or clone a repository into one:

1. Open Settings › App access and find the app's row under Apps.
2. In its Add projects picker, pick Anywhere in Home for any existing folder in your home folder, or Chosen folders and add the folders it may add projects inside, then click Save.

Every connected app has its own choice, and so does each client on this Mac, such as Claude Code, once it has asked: each has one row under Apps. Each starts Off. Lookout enforces it on this Mac: no app can allow itself or another, and the agents in the chats an app starts can't add projects through it. An app that asks without it is refused with grant_needed, which names this place.

Let an app set up agents

An app can't change your agents. To let one set an agent up for you (its name, description, instructions, section, projects, fallback models, and whether its chat shows every step):

1. Open Settings › App access and find the app's row under Apps.
2. Turn on its Configure agents switch.

Every connected app has its own switch, and so does each client on this Mac, such as Claude Code, once it has asked. Each starts Off. An agent's limits, allowed models, pause, lock and memory switches stay yours in the app: no app sets them, whatever its switch says. Every change an app makes names it, in the agent's transcript and in Lookout's action log. An app that asks without it is refused with grant_needed, which names this place.

Revoke an app

1. Open Settings › App access. In the app's menu, click Revoke.
2. Click Revoke to confirm.

It loses access at once. Connect again from the app to undo it. An app whose sign-in ran out shows Expired, with Reconnect in its menu. Sign out everywhere else in Settings › Account revokes every app's access too.

Claude Code

The Lookout plugin for Claude Code drives your account from a Claude Code session: it hands tasks to Lookout agents, steers chats, and reads machines and plan usage.

Install the plugin

In Claude Code, run:

/plugin marketplace add arcadia-eng/lookout-marketplace
/plugin install lookout@lookout-marketplace

The plugin runs with Bun: the copy Lookout ships, or Bun installed on the machine.

How it connects

On a machine with the Mac app or the lookout command, the plugin uses that Lookout. While Lookout isn't running, each call says so, and the first call after it starts works, with no reconnect. On a machine with neither, it uses the hosted server, which needs a sign-in: run /lookout:login and sign in with your Lookout account in the browser it opens. If /mcp then shows the lookout server as failed, reconnect it there. When Lookout updates, a session that is already open moves to the new version's tools at its next call, with no reconnect.

What the plugin adds