Configure malac by asking

Configure malac by asking

malac can inspect and change its own configuration, store API keys, manage plugins and install updates when you ask.

You don't have to edit TOML to configure malac. Ask it:

• "switch to lora/smart"
• "add OpenRouter as a provider with my key"
• "allow cargo commands without asking"
• "set the context window of lora/default to 128k"
• "add the lobirus marketplace and install release-tools"
• "keep the machine awake while the daemon runs"
• "is there a newer version? install it"

The agent has two tools for its own configuration.

malac_settings: look

A Safe tool, so it never asks.

Argument	Shows
show: "config"	The user and project config files and the merged result, defaults included, plus which providers have a stored key (never the key itself)
show: "reference"	The full configuration reference
show: "models"	The models each provider offers
show: "status"	Version, available updates, tool servers and live agents
show: "context"	What this tab loaded: instruction files, docs, index, skills, commands, plugins; the same as /context
show: "plugins"	Installed and built-in plugins, and the marketplaces
use_model: "provider/model"	Switches this session to that model from the next message

malac_configure: change

An Execute tool, so it asks for approval unless you are in autopilot.

Action	What it does
set	Set one key by dotted path, for example providers.openrouter.base_url or models."lora/smart".context_window
unset	Remove a key
set_api_key	Store a provider's key in ~/.malac/credentials.toml (mode 0600)
remove_api_key	Remove a stored key
install_update	Install the latest release
marketplace_add, marketplace_remove, marketplace_update	Manage plugin marketplaces (source for adding)
plugin_install, plugin_enable, plugin_disable, plugin_uninstall, plugin_update	Manage plugins (plugin names one), for you or with file: "project" for the team

set and unset edit the user config by default, or the project config with file: "project". Edits keep the comments and layout of your file, and the result is validated before it is saved, so a bad value is rejected instead of breaking your config. Saved settings apply to tabs that load afterwards; a tab that is already loaded keeps its settings until it reloads (the web UI's Apply reloads idle tabs, and malac daemon restart reloads everything). Settings the daemon itself reads ([daemon], [web], [remote], [update], [control]) apply when it restarts.

Enabling a plugin that runs code (hooks, MCP servers or scripts) asks you even in autopilot.

The permission prompt shows exactly what will change, for example:

? malac_configure user config: permissions.allow = ["bash(cargo *)"]
  [y] allow  [a] always  [n] deny

Pre-approving edits

malac_configure is matched against action:key, so rules can pre-approve specific changes:

[permissions]
allow = ["malac_configure(set:ui.*)", "malac_configure(set:model)"]
deny = ["malac_configure(set:permissions.*)"]

API keys

When you ask malac to add a provider "with my key", prefer pointing it at an environment variable (api_key_env). If you paste a key, malac stores it with set_api_key in credentials.toml, but the key also stays in the session transcript, because everything you type does. Deleting the session afterwards (malac sessions delete <id>) removes that copy.