CLI

malac [OPTIONS] [PROMPT]...
malac <COMMAND>

malac <prompt> starts working on the prompt right away, in a new tab of your last workspace. malac alone reopens the last workspace. Everything after the options is the prompt; quoting it is optional. Interactive sessions run in the daemon; -p, --json and piped input run in their own process.

If the prompt starts with a subcommand name but does not parse as that subcommand, it is still a prompt: malac web scraper for the docs runs a prompt, malac web --open runs the web UI. malac -- <prompt> is always a prompt.

Options

Session options

These apply to malac and to malac web (for the tab --cwd opens).

Option	Meaning
-m, --model <provider/model>	Model for this session, for example lora/smart
--profile <name>	Apply [profiles.<name>] from the configuration
--mode <ask|edits|autopilot>	Permission mode
-y, --autopilot	Never ask for permission; same as --mode autopilot. Deny rules still apply.
--cwd <dir>	Working directory: the folder of the new tab
--no-control	Do not connect the computer and browser control service
-v, --verbose	Show model reasoning as it streams

Workspace options

For the interactive interfaces, which are daemon clients. See Workspaces, tabs and the daemon.

Option	Meaning
-n, --new	Start a fresh workspace; the current one stays resumable
-w, --workspace <name|id>	Open a workspace by name or id. Cannot be combined with -n.
--name <name>	Name the new tab, or with -n the new workspace
-c, --continue	Continue the most recent session in this folder, in its tab
-r, --resume <id>	Resume a session by id, in the tab that holds it or a tab for its folder

Run options

Option	Meaning
-p, --print	Answer the prompt and exit instead of staying interactive; runs in this process
--json	Stream events as JSON lines instead of rendering them; exits after the turn; runs in this process
--plain	Use the line-based interface instead of the full-screen one
-h, --help	Print help
-V, --version	Print the version

Piped stdin is added to the prompt and runs in this process. See Plain mode and scripting. The daemon always serves the web UI, so no option is needed for it: malac web prints its address.

Exit status

Status	When
0	The prompt was answered, or the interactive session ended normally
1	The turn failed in a non-interactive run, or malac could not start (for example no prompt given or no model configured)

Commands

Command	What it does
malac web	Make sure the daemon runs and print or open its web UI
malac daemon	Run, start, stop or inspect the background daemon
malac workspaces	List, rename or delete workspaces
malac sessions	List, show or delete saved sessions
malac provider	Add or list model providers
malac models	List the models every configured provider offers
malac config	Show configuration paths and the resolved configuration
malac memory	List, search or reindex long-term memory
malac mcp	Show connected MCP servers and their tools
malac update	Update malac to the latest release
malac control	Run the computer and browser control service (malac-control)

malac web

malac web [--open] [--json-ready] [--port <port>] [--host <addr>] [--remote] [--token <token>] [SESSION OPTIONS]

Option	Meaning
--open	Open the UI in the default browser
--json-ready	Print one JSON line with the URL and token, then stay attached until stopped (for editor integrations)
--cwd <dir>	Add a tab for this folder to the current workspace, or activate the one that exists
--port <port>	Port, if this starts the daemon (default web.port, 7700, or any free port if taken); 0 picks one
--host <addr>	Bind address, if this starts the daemon (default web.host, or 0.0.0.0 with --remote)
--remote	Accept connections from other machines, if this starts the daemon. The token is still required.
--token <token>	Use this token instead of the saved one, if this starts the daemon. Env: MALAC_WEB_TOKEN.

When the daemon already runs, it keeps its own address and token; malac daemon restart --remote opens it to other machines. See Web UI.

malac daemon

malac daemon [run|start|stop|status|restart]

Subcommand	Meaning
start (default)	Start in the background unless one is running; output goes to ~/.malac/daemon.log
run	Run in the foreground
status [--json]	Whether it runs, its version, address, clients, workspaces, running agents and jobs, and when it exits. Exits with status 1 when it is not running.
stop [--force]	Stop it. Refused while agents or jobs run, unless --force.
restart [--force]	Stop and start again, for example to use an updated malac. Same --force rule.

run, start and restart take --port, --host, --remote and --token (env MALAC_WEB_TOKEN), as for malac web.

malac workspaces

malac workspaces [list | rename <workspace> <name> | delete <workspace> [--force]]

Subcommand	Meaning
list (default)	Workspaces, the last used one marked with *, with tab count, running agents and last change
rename <workspace> <name>	Rename a workspace, given by name or id
delete <workspace>	Delete a workspace; its sessions stay on disk. --force deletes it even while its agents work, stopping them.

malac sessions

malac sessions [list [--all] [-n <limit>] | show <id> | delete <id>]

Subcommand	Meaning
list (default)	Recent sessions, newest first. --all includes subagent sessions; -n, --limit sets how many (default 20).
show <id>	Print a session’s transcript and those of its subagents
delete <id>	Delete a session file

See Sessions.

malac provider

malac provider add <name> --base-url <url> [--kind openai|anthropic] [--model <id>]
                   [--api-key-env <VAR>] [--api-key-stdin] [--set-default]
malac provider list
malac provider models <name>

Subcommand	Meaning
add <name>	Add or replace a provider in ~/.malac/config.toml
list	List configured providers, their kind, base URL and whether a key is set, plus the default model
models <name>	List the models a provider serves

Options of add:

Option	Meaning
--base-url <url>	Endpoint. Required.
--kind <kind>	openai (chat completions, the default) or anthropic (Messages API)
--model <id>	Model to list for this provider, and to use with --set-default
--api-key-env <VAR>	Read the API key from this environment variable
--api-key-stdin	Read the API key from stdin and store it in ~/.malac/credentials.toml
--set-default	Make <name>/<model> the default model. Needs --model.

See Configure a provider.

malac models

Lists every model of every configured provider, as provider/model, marking the default with *. Providers that cannot be reached are listed with their error.

malac config

Subcommand	Meaning
path (default)	Print the locations of the home directory, user config, project config, credentials and sessions
show [--profile <name>]	Print the merged configuration for this directory, optionally with a profile applied

malac memory

Subcommand	Meaning
list (default)	List saved memories with scope, name, description and path
search <query>...	Search memories; prints a score per match
reindex	Re-embed every memory file into the vector store

See Memory.

malac mcp

Connects to every configured MCP server and prints each one’s status and tool count, then the MCP tool names. See MCP servers.

malac update

Option	Meaning
--check	Only check whether an update is available

See Updating.

malac control

malac control [ARGS]...

Runs malac-control (found next to malac or on PATH) with the given arguments and exits with its status.

malac-control

malac-control [--config <path>] <COMMAND>

Command	Meaning
stdio	Serve MCP on stdin and stdout. This is how malac spawns it.
serve	Serve MCP over WebSocket and advertise it in ~/.malac/control.json
profiles	List configured and system browser profiles
permissions [--request] [--json]	Show the macOS permissions desktop control needs (Screen Recording, Accessibility) and which app holds them; --request asks for the missing ones and opens System Settings

Option	Meaning
--config <path>	Config file (default ~/.malac/control.toml)

Options of serve:

Option	Default	Meaning
--host <addr>	127.0.0.1	Bind address
--port <port>	7878	Port
--token <token>	random	Token clients must present. Env: MALAC_CONTROL_TOKEN.

malac-control logs to stderr at info level; set RUST_LOG to change it. See Computer and browser control.