Configure malac by asking

You don’t have to edit TOML to configure malac. Ask it:

• “switch to lora/smart”
• “add OpenRouter as a provider with my key”
• “allow cargo commands without asking”
• “set the context window of lora/default to 128k”
• “turn on the web UI for every session”
• “is there a newer version? install it”

The agent has two tools for its own configuration.

malac_settings: look

A Safe tool, so it never asks.

Argument	Shows
show: "config"	The user and project config files and the merged result, defaults included, plus which providers have a stored key (never the key itself)
show: "reference"	The full configuration reference
show: "models"	The models each provider offers
show: "status"	Version, available updates, tool servers and live agents
use_model: "provider/model"	Switches this session to that model from the next message

malac_configure: change

An Execute tool, so it asks for approval unless you are in autopilot.

Action	What it does
set	Set one key by dotted path, for example providers.openrouter.base_url or models."lora/smart".context_window
unset	Remove a key
set_api_key	Store a provider’s key in ~/.malac/credentials.toml (mode 0600)
remove_api_key	Remove a stored key
install_update	Install the latest release

set and unset edit the user config by default, or the project config with file: "project". Edits keep the comments and layout of your file, and the result is validated before it is saved, so a bad value is rejected instead of breaking your config. Saved settings apply to tabs that load afterwards; a tab that is already loaded keeps its settings until it reloads (the web UI’s Apply reloads idle tabs, and malac daemon restart reloads everything). Settings the daemon itself reads ([daemon], [web], [update], [control]) apply when it restarts.

The permission prompt shows exactly what will change, for example:

? malac_configure user config: permissions.allow = ["bash(cargo *)"]
  [y] allow  [a] always  [n] deny

Pre-approving edits

malac_configure is matched against action:key, so rules can pre-approve specific changes:

[permissions]
allow = ["malac_configure(set:ui.*)", "malac_configure(set:model)"]
deny = ["malac_configure(set:permissions.*)"]

API keys

When you ask malac to add a provider “with my key”, prefer pointing it at an environment variable (api_key_env). If you paste a key, malac stores it with set_api_key in credentials.toml, but the key also stays in the session transcript, because everything you type does. Deleting the session afterwards (malac sessions delete <id>) removes that copy.