The Malleable CLI is on npm (and it ships with a Claude Code skill)

We built Malleable to get your calendar and your work out of your head and into one place you can trust. For a lot of people that place is a terminal, not a browser tab, so today we are publishing the mal CLI to npm: version 0.2.1, MIT licensed, installable with one command.

Install and log in

The package is @malleable-cloud/cli and it exposes two binaries that run the same entrypoint: the short alias mal and the long form malleable. It requires Node 18 or newer.

npm install -g @malleable-cloud/cli

mal login

mal login opens a browser for a device-auth flow: approve it once, and the CLI holds a session from then on. Headless boxes and CI runners can skip the browser entirely with an API key, minted at Settings → Integrations in the app:

mal login --api-key mk_live_...

Credentials are stored in the OS keychain where one is available, with a plain JSON fallback on headless machines that have no keychain to use.

A tour of the commands

The verb surface splits cleanly into two kinds of commands: deterministic CRUD that talks straight to the API, and one natural-language escape hatch that goes through Malleable's AI agent. It is worth knowing which is which, because only one of them spends AI credits.

Your day and week, read-only:

mal today
mal tomorrow
mal week

Direct event CRUD, no LLM involved:

mal events add --title "Client call" --start "2026-08-03T14:00" --duration 30
mal events ls
mal events rm <event-id>

Natural language, when typing structured flags is more friction than it is worth:

mal nl "lunch with Sam friday noon"

Tasks and the kanban board:

mal tasks add --title "Ship the CLI post" --stage todo
mal board ls
mal board move <task-id> ready_for_review
mal board comment <task-id> "Draft is up, ready for a look."

Beyond that there is mal buckets for the projects and categories your time rolls up into, mal time for starting and stopping a timer from the shell, mal notes for attaching context to a task, and mal free / mal free-with <user> for mutual availability, the same arbitrage that powers Malleable's booking-invite emails, now queryable straight from the terminal. Almost every command takes --json for scripting.

The headline feature: your own Claude drives your board

The install includes a skill for Claude Code, but it does not do anything on its own. Nothing runs at npm install time. You opt in explicitly:

mal skill install

That copies the bundled /malleable skill into ~/.claude/skills. From then on, typing /malleable in a Claude Code session pointed at a repo tied to your board gives you a live view of it: it prints the board, creates and moves tickets, tags the branch you are working on, attaches the commits you just pushed, and posts plain-language comments so a non-technical teammate can follow along without reading a diff.

Here is the part we think matters most. Every one of those board operations, printing the board, adding a task, moving a stage, tagging a branch, attaching a commit, posting a comment, is a deterministic API call through the CLI. It costs none of your Malleable AI credits. The thinking happens in your Claude Code session, on your own inference. The only command that spends Malleable's AI agent is mal nl, because that one has to parse an ambiguous sentence into a real calendar action. Everything else is just plumbing, and plumbing should be free.

What's next

This is the first Malleable package to land on npm, not the last. The MCP server and the Embed SDK are next in line to get their own npm packages, so the same install-and-go pattern extends to running Malleable's tools from Claude Desktop and to embedding the booking widget in a real build pipeline instead of a script tag.

Full command reference lives at /docs/cli, and the rest of what you can build on, the V1 API, the MCP server, the Embed SDK, is laid out at the Developer Portal. The package itself is on npm at @malleable-cloud/cli.