larksuite/cli

Introduction

lark-cli is the official Lark/Feishu CLI maintained by the larksuite team. It exposes Messenger, Docs, Drive, Base, Sheets, Slides, Calendar, Mail, Tasks, Meetings, Wiki, Contact, Attendance, Approval, OKR, and app-building operations from a terminal, with more than 200 curated commands and 26 AI Agent Skills (repository, commands and features).

The command surface has three layers: shortcuts prefixed with + for common operations with smart defaults and table output; API commands generated from Lark OAPI metadata and mapped to platform endpoints; and raw lark-cli api calls that reach any Open Platform endpoint (three-layer command system). Structured JSON output, pagination flags, dry-run previews, and schema introspection make the tool suitable for scripts and for agents that need predictable responses.

Quick start

Requirements: Node.js with npm/npx. Building from source also needs Go 1.23+ and Python 3.

Install from npm:

npx @larksuite/cli@latest install

Then configure credentials, log in, and run a first command:

lark-cli config init
lark-cli auth login --recommend
lark-cli calendar +agenda

config init is an interactive one-time setup for app credentials. auth login --recommend selects commonly used scopes; you can instead narrow login by domain or exact scope, for example lark-cli auth login --domain calendar,task or lark-cli auth login --scope "calendar:calendar:read" (authentication).

Agents follow the same flow, but run setup and login in the background, extract the authorization URL for the user to open in a browser, then verify with lark-cli auth status (AI agent quick start). Source builds additionally require installing the CLI skill with npx skills add larksuite/cli -y -g after make install.

Authentication and command usage

Login stores credentials and tracks granted scopes. auth status, auth check, auth scopes, and auth list let you inspect the current user and permissions. Commands can run with user or bot identity: --as user or --as bot. DPoP proof-of-possession is enabled by default for new local credentials and can be set to preferred, disabled, or required; changing the policy requires re-authorizing.

With --format json (the default), successes are written to stdout with exit code 0 and a { "ok": true, ... } envelope, while errors go to stderr with a non-zero exit code and { "ok": false, "error": { ... } }. Check ok or the exit code rather than a top-level code field; the upstream OpenAPI error code appears inside error. Shortcuts such as im +messages-send support --dry-run to preview side-effecting requests. Use lark-cli schema <method> to inspect parameters, request bodies, response structure, supported identities, and scopes (advanced usage, error contract).

Constraints and risks

Authorizing the CLI gives it access under your user identity within the granted scopes, and an AI agent driving it can be affected by model errors or prompt injection. The documentation recommends not relaxing default security settings, and keeping any bot integrated with the tool as a private assistant rather than adding it to group chats (security warnings).

By default the CLI sends the operating-system type and device hardware model with requests to official Feishu/Lark HTTPS domains as risk-control signals; this can be changed per workspace with lark-cli config risk-control off|on|default. The code is MIT-licensed, but using the underlying APIs also means accepting the Feishu/Lark terms of service and privacy policies. Some domains are separate: Meegle project management is provided by the standalone meegle-cli, which must be installed separately (meegle-cli). Enterprise embedding paths for centralized credentials and audit logging are documented separately (embedding guide).

HotRepo's take

The Go daily list recorded 18,097 stars and 1,380 forks on 2026-11-13, with 18 stars gained that day and a best position of 16 on the Go daily list. That is a modest daily gain rather than a sharp spike, which fits an official, broadly scoped CLI that accumulates users across many Lark/Feishu domains. The notable design choice is the explicit dual audience: shortcuts and Skills for agents, and raw API access for developers who need full coverage. The documented risk-control data collection and the warning against adding the bot to group chats are concrete constraints to weigh before granting broad scopes.