Mali Cowork
v0.1.2early access · fully open source

AI that runs on your machine
not on someone else's server

Chat with AI or let an agent edit real files—only in folders you approve. Every model and agent you already pay for, in one app.

Read security first
macOSWindowsLinuxTauri · React · Rust
  • You approve every action
  • No telemetry
  • No Mali server
Idle
Two modes, strictly separate

One chat stays in one mode

A normal chat cannot silently become a file-editing agent. Switch modes in the composer before you start.

Mode Cowork

Agent edits code, organizes files, runs commands

File access: Only folders you approve
  • Per-folder read-only or read & write
  • Every impactful action asks first
  • Checkpoint rolls back every edit
Why lock mode from the start
If a chat could become an agent mid-thread, you would never know which message grants file access. Locking mode for the whole chat makes permissions clear before the first keystroke.
What you can connect

Every model you pay for, one picker

See which models come from your CLI login, your API keys, or OpenCode—and quota is used only when you pick that model and send.

On-machine agents
Calls CLIs you already signed into, as your user.
opencodeOpenCodeCodexCodex CLIGemini CLIGemini CLICursorCursor Agent

OpenCode includes free models—no signup required.

Your own API keys
Keys go straight to the provider. Nothing in the middle.
OpenAIOpenAIAnthropicAnthropicGoogleGoogleGroqGroqDeepSeekDeepSeekMistralMistralQwenQwenGrokxAIOpenRouterOpenRouterOllamaOllama

Ollama local or cloud—fully offline on your machine.

MCP tools
Wire up tools you already use. Install from chat.
GmailNotionNotionLinearFigmaFigmaPlaywrightfilesystem

Plus hundreds more from the registry.

Skills
Playbooks you write so the agent follows them every time.
Deploy stepsCode styleReport format

Write once, use in every chat.

Pick a model
ClaudeClaude Sonnetyour key
CodexGPT-5 CodexCodex CLI
CursorComposer 1Cursor CLI
GrokGrok Code Fastvia OpenCode
Qwenqwen3-coderOllama · local

No automatic agent switching

If the selected model fails, Mali finds a substitute from the same source only—not another subscription. Changing agents mid-chat shows a warning: different session, different billing.

Mali Cowork never asks for Cursor, ChatGPT, or Google passwords—you sign in through each CLI yourself.

OpenAIOpenAIAnthropicAnthropicGoogleGoogleGroqGroqDeepSeekDeepSeekMistralMistralQwenQwenZ.aiZ.aiMoonshotAIMoonshotGrokxAIOpenRouterOpenRouterOllamaOllamaopencodeOpenCodeCursorCursorCodexCodexGeminiGeminiOpenAIOpenAIAnthropicAnthropicGoogleGoogleGroqGroqDeepSeekDeepSeekMistralMistralQwenQwenZ.aiZ.aiMoonshotAIMoonshotGrokxAIOpenRouterOpenRouterOllamaOllamaopencodeOpenCodeCursorCursorCodexCodexGeminiGemini
What you can do

Tools for daily work, not a demo

Everything runs on your files, and every change can be rolled back.

Work on real folders
Read, edit, create, run commands—and review every line of git diff before you commit.
export function resolvePath(p: string) {
- return path.join(root, p);
+ const abs = path.resolve(root, p);
+ if (!abs.startsWith(root)) throw new DeniedError(abs);
+ return abs;
}
Checkpoint
Roll back everything the agent changed before you accept the work.
  1. Edited 4 files · added migration
  2. Ran bun test — 28/28 passed
  3. Rewrote README
Built-in Git
Stage, commit (with message help), branch, push/pull in one place.
Files and images
Drag and drop. Open images and video from the agent or MCP full screen.
Link hover previews
See where a link goes before you click. Favicons fetched from the site, not a third party.
Ask back
The agent can ask when unsure instead of guessing wrong.
System notifications
On macOS, Allow / Always / Deny from the notification without switching windows.
Security

Questions worth asking—and honest answers

What the app can and cannot do, without overselling safety.

Keys live in the OS credential store
macOS Keychain · Windows Credential Manager—not plain text files. Models never see keys; they stay in HTTP headers, not chat context.
No telemetry
No analytics, crash reporter, accounts, or Mali server—verify in source.
Rust 141 tests · TS 28 tests passing
Coverage for permission decisions—policy, OAuth, path resolution.
Example: prompt injection meets the last gate

1. The agent fetches a page you asked it to summarize

fetch https://example.com/pricing

Question by question

Not done yet (straight talk)
  • No third-party security audit yet
  • Linux OS credential store not integrated yet
Six cowork bots

Agent state you can read at a glance

Thinking splits into three dots. Working bounces with a rainbow ring. Permission tilts with a lock—no status text required.

Mochi

Idle

Waves on the home screen

Jelly

Thinking

Runs jobs through to completion

Petal

Working

Spins while thinking

Nori

Connecting

Guards permissions

Sora

Done

Watches model connections

Momo

Welcome

Signals when something goes wrong

Version 0.1.2 — early access

Usable every day, with limits you should know

This table is not marketing—it is here so you can decide clearly.

TopicStatus
Core features (Chat, Cowork, MCP, Git, Checkpoint)Available
Key storage / permissions / OAuthTest coverage (Rust 141 · TS 28 passing)
Code signing & notarizationNot yet—first open via right-click → Open
Auto-updateNot yet—download new releases manually
Linux credential storeOwner-only file instead
Third-party security auditNot done yet
Good fit for
Developers and power users who want one hub for every model/agent and clear control over what AI can touch.
Not yet for
Organizations that require audited apps with built-in auto-update.
Install

Download and run—no account required

Mali Cowork is free. You pay model providers directly, or use OpenCode / local Ollama free tiers.

Contact before launch

Downloads aren't ready yet — email or reach out on any channel below.

macOS

Apple Silicon · Intel

Windows

x64

Linux

AppImage · deb

Current builds are not code signed / notarized

macOS may block the app as an unknown developer → right-click the app → Open → Open

Windows SmartScreen may warn → More info → Run anyway

Early-access limitation, not a sign the file is malicious. Developer signing comes in a later release—or build from source if you prefer.

After first launch

  1. 1

    Install OpenCode

    Free models included—no signup—or skip to step 2 if you already have keys.

  2. 2

    Add your provider API keys

    Stored in the OS keychain / credential manager, not plain text files.

  3. 3

    Enable MCP tools you want (optional)

    Install from chat. Toggle each server anytime.

The app walks you through step by step.

More questions

Small things people ask

Let an agent do real work—you still hold the keys

No account. No telemetry. No Mali server—download, open, pick the first folder you want help with.

Read security

Contact before launch

Downloads aren't ready yet — email or reach out on any channel below.