malac
Multi-Agent Loop for Autonomous Coding
An open-source coding agent for your terminal, written in Rust. It reads, edits and runs your code, hands work to parallel subagents, and works with any model provider.
curl -fsSL https://raw.githubusercontent.com/lobirus/malac/main/install.sh | shbrew tap lobirus/malac https://github.com/lobirus/malac && brew install lobirus/malac/malacv1.2.0 for macOS (Apple silicon and Intel) and Linux (x86-64). Elsewhere the script builds from source. All downloads
Roots through your codebase
One prompt, start to finish. A real run: malac reads the file, fixes the bug and checks its own work before it answers.
$ malac -y calc.py has a bug in add, fix it and verify with a python one-liner
● read calc.py
⎿ 1 def add(a, b): (+1 lines)
● edit calc.py
⎿ Edited calc.py: (+2 lines)
● bash python3 -c "import calc; assert calc.add(2,3)==5; assert calc.add(-1,1)==0; print('ok')"
⎿ ok
Fixed `calc.py:2`: `add` returned `a - b`, now returns `a + b`. Verified with `python3 -c "..."` → `ok`.
─ lora/default · 3.3k context · 366 out · $0.0024 · 2.2s-y runs on autopilot. The last line is the turn’s model, context size, output tokens, cost and time.Everything in one loop
A CLI first, with the rest built around it.
Workspaces that outlive the terminal
A per-user daemon holds your workspaces: tabs, one per project folder, each with its own agents. Close the terminal and they keep working; malac brings you back, even after a reboot.
Voice in every appNew
Dictate instead of typing, hear malac ask for approval or say a long task is done, or talk the work through with a Realtime model. In the terminal, the browser, VS Code and on the phone.
Files and screenshots sent to youNew
Ask for a screenshot or a file and it arrives in the app you are using. Every image opens full screen, to zoom, pan, save or share.
Design guidance built inNew
UI work follows the product’s own design language, or gives a new product a restrained house style. The agent checks its work at three widths in both themes; /design-review audits a UI.
Agents on a server, you anywhere
Run the daemon on a server and drive it from your laptop, a browser or a phone. Devices pair once with a code or a QR code; Cloudflare, ngrok and Tailscale tunnels are one command.
Knows the project from the start
Reads AGENTS.md and the rules of Claude Code, Gemini, Copilot, Cursor, Windsurf and Cline, keeps a project index, and saves what it learns in .malac/MALAC.md, for your team too.
Plugins and marketplaces
Skills, commands, agents, MCP servers and hooks in Claude Code or Agent Plugins format, from any git repository. Nothing that runs code turns on without your approval.
A terminal UI made for reading
Answers stand out from tool calls. Tabs, an agent map, drag to copy, @ to attach files, Ctrl-V for images, a folder browser, a menu bar and F-keys, mouse or keyboard.
Any provider
OpenAI- and Anthropic-compatible APIs, several at once. Use gateways such as LiteLLM, OpenRouter or Together, or local models through Ollama and vLLM.
Subagents in parallel
The agent hands self-contained work to subagents that run side by side, each on a model picked for its task. Watch them live on the agent map, in the terminal or the browser.
Permissions and autopilot
Ask, edits or autopilot, per tab. Allow and deny rules refine every mode, and an approval answered in one client closes in all of them.
Background jobs
Dev servers and watchers the agent starts become jobs that keep running. List them, read their output and stop them from the terminal, the browser or the agent.
Computer and browser control
malac-control serves the desktop and Chrome as MCP tools, on this machine or a remote one with a desktop. Every browser profile is its own Chrome instance.
Web UI and VS Code
The same workspaces in the browser: tabs, agents, jobs, approvals and every setting. In VS Code, a native chat with the current file as context, plus jobs, sessions and usage.
Memory
Durable facts live in Markdown files you can read and edit. Add Milvus, self-hosted or Zilliz Cloud, for semantic search and automatic recall.
MCP servers
Connect any Model Context Protocol server over stdio, streamable HTTP or WebSocket. Its tools follow the same permission rules.
Updates that never interrupt
malac update swaps the binaries with an atomic rename. Running agents and the daemon keep their version until you restart them.
Configure it by asking
“Switch to lora/smart” or “allow cargo commands without asking”. malac edits its own configuration, with your approval.
How it works
One daemon per user holds your workspaces, and every front end is a client of it. Agents publish everything they do on one event bus, so subagents are as visible as the main agent, in every client at once.
- 1You give it a task from the terminal, a script, the web UI or VS Code, on this machine or a paired one.
- 2The agent loop streams from your model and checks every tool call against your permission rules.
- 3Subagents take self-contained pieces in parallel and report back when they are done.
Download
malac 1.2.0 for macOS and Linux, and the extension for VS Code and compatible editors.
Windows is not supported yet. malac runs on macOS and Linux; the downloads below are for those.
macOS
For this computerA universal installer for Apple silicon and Intel Macs. It puts malac and malac-control in /usr/local/bin. The archives hold the same two binaries.
Linux
For this computerAn x86-64 archive with malac and malac-control: unpack it and put both on your PATH. The install script does that for you, and builds from source where no archive fits.
curl -fsSL https://raw.githubusercontent.com/lobirus/malac/main/install.sh | shVS Code extension
A native chat panel with the current file as context, and the daemon's workspaces, jobs and sessions. The same .vsix works in VS Code and in VS Code–compatible editors such as Cursor, Windsurf and VSCodium. It is not on the Marketplace yet, so install the file.
code --install-extension malac-vscode-1.2.0.vsixOr in the editor: Extensions → … → Install from VSIX.
Android
For this phoneThe app for Android 8 and later: workspaces, agents, approvals with notifications and jobs, from a daemon you pair it with. It is not on Google Play yet, so allow the install when Android asks; later releases install over it.
Then run malac remote pair on the computer and scan the code. See the mobile apps.
Windows is not supported yet.malac 1.2.0 on GitHub.Checksums: SHA256SUMS. Verify with shasum -a 256 -c SHA256SUMS in the download folder.
Start in two commands
# with ANTHROPIC_API_KEY or OPENAI_API_KEY in your environment
curl -fsSL https://raw.githubusercontent.com/lobirus/malac/main/install.sh | sh
malac explain how requests are routed in this repoOpinionated by design: malac follows its author's workflow and changes with it. It is open source so you can see everything it does. Read why.