DingTalk's enterprise CLI is built for agents, not just humans

What it does

dws is DingTalk’s official cross-platform CLI, written in Go, that exposes the platform’s full enterprise stack—calendar, docs, drive, contacts, todos, and more—from the terminal. It is explicitly dual-targeted: humans get --help, table formatting, and --dry-run previews, while AI agents get structured JSON, built-in skills, and a schema-discovery system so they can figure out available commands on the fly.

The interesting bit

The tool treats agent interoperability as a core feature, not an afterthought. It ships with two skill-packaging modes—mono (one unified skill) and multi (20 per-product skills, currently experimental)—and installs them directly into agent directories like ~/.claude/skills and ~/.cursor/skills. Agents can introspect capabilities via dws schema instead of relying on hardcoded API knowledge.

Key highlights

• Zero-trust security architecture with OAuth device-flow auth, domain allowlisting, and least-privilege scoping; the README claims not a single byte bypasses authentication and audit
• Atomic self-upgrade with SHA256 verification, automatic backup, and rollback via dws upgrade --rollback
• Two agent skill layouts: stable mono mode for cross-product workflows, and an experimental multi mode that splits 20 products into separate skills to reduce per-call context
• dws schema lets agents dynamically discover products, tool parameters, and authorization metadata without pre-training
• Enterprise-gated access: organizations must explicitly enable CLI access in the DingTalk developer platform, and admins control authorization

Caveats

• Still in a “co-creation phase” that requires enterprise admin approval; casual users cannot simply log in with a personal account
• The multi skill mode is experimental, and the README warns that interfaces, naming, and cross-skill references may change
• macOS binaries are not notarized, so users may need to manually strip quarantine attributes

Verdict

Worth exploring if you administer DingTalk inside an enterprise and want to let Claude, Cursor, or custom agents manage calendars, docs, and tasks by natural language. If you do not use DingTalk, or lack admin rights to enable CLI access, this is a walled garden you cannot enter.