{"name":"Mistral Vibe","repo":"https://github.com/mistralai/mistral-vibe","docs":"https://docs.mistral.ai/vibe/code/cli/","headless":{"finding":"Yes. With authentication/local inference already configured: vibe --workdir /path/to/project --prompt \"Implement the task\" --auto-approve --output-dir /path/to/run-output . Runs one task, exits and leaves tool-written files in the project. Omit blanket auto-approval to use a preconfigured restricted tool policy.","quote":"Run in headless (programmatic) mode: send prompt, output response, exit.","url":"https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/cli-rust/src/cli.rs","third_party":false,"evidence":[{"finding":"Inputs: -p/--prompt TEXT; --prompt-file PATH; or stdin piped into vibe -p with no text. A positional prompt alone initializes the interactive UI. --workdir PATH selects project; VIBE_CWD is its environment equivalent. Relative prompt-file/output-dir resolve before workdir changes.","quote":"self.prompt.is_some() || self.prompt_file.is_some()","url":"https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/cli-rust/src/cli.rs","third_party":false},{"finding":"Default accept-edits automatically edits files; calls needing approval are denied headlessly. --auto-approve/--yolo approves every call, unless administrator enable_auto_approve=false disables the bypass. There is no waiting approval prompt.","quote":"Nobody can answer an approval prompt, so Vibe denies any tool call that needs one.","url":"https://docs.mistral.ai/vibe/code/cli/work-with-cli","third_party":false},{"finding":"Source explicitly answers approval and user_input callbacks with denial in headless mode, instead of sending a request to a terminal UI.","quote":"When `deny` is true (headless mode), both `approval` and `user_input` kinds","url":"https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/cli-rust/src/server/callback.rs","third_party":false},{"finding":"Headless callbacks answer approval/user_input with denial; ask_user_question and cron tools are disabled automatically.","quote":"for &t in &[\"ask_user_question\", \"cron\"]","url":"https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/cli-rust/src/headless/config.rs","third_party":false},{"finding":"Untrusted project configuration is skipped with a warning. --trust temporarily loads it; headless never asks for trust.","quote":"Re-run with --trust to trust this folder temporarily.","url":"https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/cli-rust/src/headless_trust.rs","third_party":false},{"finding":"Exit codes: 0 finished; 1 usage_error/config_error; 2 infrastructure_failure; 3 turn_limit/token_limit/price_limit/deadline/terminated/length/refusal; 4 aborted by experimental agent-socket server. These are CLI run outcomes, not shell subprocess statuses.","quote":"4: `Aborted`, by the server on the other end of `--agent-socket`","url":"https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/cli-rust/src/run_export/model.rs","third_party":false},{"finding":"Limits: --max-turns N, --max-tokens N, --max-price DOLLARS, --time-limit SECONDS. SIGTERM stops like deadline. --output text|json|streaming gives final text, end-of-run message JSON array, or NDJSON messages. --output-dir DIR writes export.json and DIR/session even on unsuccessful outcomes; parser errors can exit 1 without export. Completion waits for app-server shutdown and outstanding children.","quote":"Only an argument the parser itself rejects (an unknown flag, a malformed value) exits 1 without an export.","url":"https://raw.githubusercontent.com/mistralai/mistral-vibe/main/README.md","third_party":false}]},"confinement":{"finding":"Application-level permission controls, not default OS isolation. Ordinary CLI actions use the account access; workdir is context, not a security boundary. Experimental agent-socket delegates file/shell operations to an external sandbox. No bundled Docker/seatbelt/gVisor/bubblewrap isolation or global shell-network-off switch found.","quote":"Smart approve is a classifier, not a sandbox.","url":"https://docs.mistral.ai/vibe/code/safety-approvals-permissions","third_party":false,"evidence":[{"finding":"Per-tool permission always/ask/never; bash allow/deny lists use command prefixes; read_file/write_file/edit use absolute-path globs. Lists replace defaults. enabled_tools then disabled_tools (also repeatable CLI flags) filter tools by exact name, glob or re: regex.","quote":"\"always\" to auto-allow the tool, \"ask\" to prompt before use, \"never\" to block it","url":"https://docs.mistral.ai/vibe/code/cli/configuration-reference","third_party":false},{"finding":"3.0.3 adds outside_workdir=\"deny\" globally/per-tool: file/shell calls reaching outside workdir and --add-dir roots return denial rather than ask. Default ask; path allowlists are exceptions. These are tool/path checks, not OS enforcement.","quote":"`outside_workdir = \"deny\"` (global or per tool) refuses file and shell access outside the working directory","url":"https://raw.githubusercontent.com/mistralai/mistral-vibe/main/CHANGELOG.md","third_party":false},{"finding":"Blanket auto-approval skips ordinary outside-path/sensitive-file approval checks, so do not treat it as confinement. Smart-approve classifies calls; ask requests approval; accept-edits edits within workspace. Headless denies requests needing a person.","quote":"A call that it judges safe runs with the same access as your user account.","url":"https://docs.mistral.ai/vibe/code/safety-approvals-permissions","third_party":false},{"finding":"Experimental hidden --agent-socket PATH needs a caller-supplied server implementing sandbox/execute and sandbox/readFile, workspace and Python interpreter. Caller enforces OS/network policy. Model calls, MCP, hooks and session storage remain on host. Incompatible with workdir/worktree/add-dir/continue/teleport; unavailable on Windows. CLI tool filters exclude server-declared tools.","quote":"Session storage, model calls, MCP servers and hooks stay on this host.","url":"https://raw.githubusercontent.com/mistralai/mistral-vibe/main/README.md","third_party":false},{"finding":"Offline setup: local model plus enable_telemetry=false and enable_update_checks=false. Disable external skills/MCP/connectors separately. This stops documented CLI background contact; it is not a firewall for shell subprocesses.","quote":"enable_telemetry = false","url":"https://docs.mistral.ai/vibe/code/cli/offline-models","third_party":false},{"finding":"Worker tool reduction: minimal --enabled-tools allowlist plus command/path permissions; enable_mcp=false and enable_connectors=false remove those classes. Admin config outranks flags/local config. Inspect exported effective settings. External isolation remains necessary for an enforceable host/network boundary.","quote":"Admin-managed settings take precedence over command-line flags","url":"https://docs.mistral.ai/vibe/code/cli/configuration","third_party":false}]},"token_reporting":{"finding":"Yes: --output-dir emits export.json with usage.input_tokens, output_tokens, cached_input_tokens, total_tokens; cost_usd, steps, outcome, exit_code, stop_reason, limits, timestamps, version, session_id, redacted config and copied journals. RunUsage has no distinct reasoning_tokens field. Message stdout formats do not replace usage export.","quote":"pub cached_input_tokens: u64,","url":"https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/cli-rust/src/run_export/model.rs","third_party":false,"evidence":[{"finding":"Root usage is per-run, including resumes: baseline-subtract prompt/completion/cache session counters. total=input+output; cached input is included in input.","quote":"let own = spent(&stats).saturating_sub(spent(&self.0));","url":"https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/cli-rust/src/headless/usage.rs","third_party":false},{"finding":"Cost estimate uses configured per-million prices for uncached input, cached input and output; missing cache price falls back to input rate. Not provider-invoiced cost. --max-price is indicative; max-tokens observes prompt+completion after usage reports, not a prepaid hard cap.","quote":"(input_cost + output_cost) / 1_000_000.0","url":"https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/cli-rust/src/headless/report.rs","third_party":false},{"finding":"Child entries in subagents[] export own usage/cost/steps/model/status/pricing_model/pricing_fallback/journal_dir. Root totals exclude children. Child usage/cost cover whole child lifetime (including older work after resume); steps cover this run. Metering must sum/difference separately; root limits are not established whole-process billing caps.","quote":"``usage``, ``cost_usd`` and ``steps`` are the subagent's own; the run's","url":"https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/app_server/run_export.py","third_party":false},{"finding":"3.0.3 fails agent model replies lacking usage; compatible servers must provide streamed usage.","quote":"A reply without token usage fails the turn; third-party model servers must support `stream_options.include_usage`","url":"https://raw.githubusercontent.com/mistralai/mistral-vibe/main/CHANGELOG.md","third_party":false}]},"parallelism":{"finding":"Yes. Independent subagents run concurrently. enable_subagents=false disables them; max_subagents caps live children and max_concurrent_subagents running turns, both default 32. Default runtime exposes tools.subagent through run_typescript; README also documents task and read-only explore.","quote":"Maximum number of subagents running a turn at the same time;","url":"https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/core/config/vibe_schema.py","third_party":false,"evidence":[{"finding":"Custom profiles set agent_type=\"subagent\" in ~/.vibe/agents/ or trusted project .vibe/agents/. Children return text, cannot ask users, and cannot broaden parent permissions. Generic delegation needs no custom child profile.","quote":"never with broader permissions than the parent agent","url":"https://docs.mistral.ai/vibe/code/cli/agents","third_party":false},{"finding":"3.0.3 honors child active_model. Online Agents docs still say subagents ignore it; prefer current release changelog and retain this discrepancy.","quote":"Custom subagents now run on the model their `active_model` selects instead of the session's model","url":"https://raw.githubusercontent.com/mistralai/mistral-vibe/main/CHANGELOG.md","third_party":false},{"finding":"Independent CLI sessions can run concurrently. Separate worktrees avoid shared checkout edits; automatic names claim unique worktrees for simultaneous sessions. Programmatic worktrees persist on exit.","quote":"so two sessions started at once can never land in the same checkout.","url":"https://raw.githubusercontent.com/mistralai/mistral-vibe/main/README.md","third_party":false},{"finding":"Experimental hidden vibe run-server serves concurrent runs sharing app-servers. --runs-per-app-server K defaults 16; --max-runs N caps live runs. Every run requires a sandbox agent socket; not Windows. JSON-RPC run/start returns immediately, run/ended reports outcome/exitCode/exportPath. Headless completion waits for children; stops interrupt them.","quote":"`vibe run-server` serves many runs at once","url":"https://raw.githubusercontent.com/mistralai/mistral-vibe/main/README.md","third_party":false}]},"providers":{"finding":"Native Mistral and configurable generic endpoints. Agent adapters: OpenAI Chat Completions, OpenAI Responses, reasoning-style APIs, Anthropic Messages, Anthropic on Google Vertex AI. Configure [[providers]] name/api_base/api_key_env_var/backend/api_style and [[models]] name/provider/alias; active_model chooses alias. No native Gemini API style listed.","quote":"\"openai\": OpenAIAdapter,","url":"https://raw.githubusercontent.com/mistralai/mistral-vibe/main/harness/runtimes/python/python/mistralai_vibe_local_harness/vibe/adapters/generic/_execute.py","third_party":false,"evidence":[{"finding":"Official OpenRouter example uses generic backend, openai API style and API key; other compatible endpoints supply own base URL/key. Supported styles are openai, openai-responses, reasoning, anthropic, vertex-anthropic.","quote":"api_base = \"https://openrouter.ai/api/v1\"","url":"https://docs.mistral.ai/vibe/code/cli/api-keys-profiles","third_party":false},{"finding":"Documented local serving options: vLLM, llama.cpp, LM Studio, Ollama through OpenAI-compatible HTTP. No bundled local model. Built-in llamacpp preset targets http://127.0.0.1:8080/v1 without key; custom unauthenticated servers can omit api_key_env_var.","quote":"Vibe doesn't ship a built-in local model.","url":"https://docs.mistral.ai/vibe/code/cli/offline-models","third_party":false},{"finding":"Vertex Anthropic uses Google Application Default Credentials, not generic API-key auth or consumer Gemini subscription login.","quote":"``vertex-anthropic`` adapter ignores it and obtains its own Google ADC","url":"https://raw.githubusercontent.com/mistralai/mistral-vibe/main/harness/runtimes/python/python/mistralai_vibe_local_harness/vibe/adapters/generic/_execute.py","third_party":false}]},"subscription_login":{"finding":"Yes for Mistral own account/plan: browser setup provisions/stores credentials instead of requiring manual API-key entry. First-time enrollment needs interaction; subsequent authenticated runs can be headless. Setup recommends API keys for automation. No evidence found for ChatGPT/Claude/Gemini/GitHub Copilot subscription-provider login; browser flow is not explicitly named OAuth/device-code by checked docs.","quote":"Launch browser: sign in with your Mistral account and use your Mistral plan.","url":"https://docs.mistral.ai/vibe/code/cli/install-setup","third_party":false,"evidence":[{"finding":"Typical Mistral browser setups need no manually provided key. Plan quota is shared by Studio, API and Vibe; after quota, behavior depends on pay-as-you-go settings. Not unlimited subscription execution.","quote":"The flow provisions and stores credentials for you","url":"https://docs.mistral.ai/vibe/code/cli/api-keys-profiles","third_party":false}]},"license":{"finding":"Apache-2.0, SPDX identifier corresponding to LICENSE Apache License Version 2.0.","quote":"Apache License\n                           Version 2.0, January 2004","url":"https://raw.githubusercontent.com/mistralai/mistral-vibe/main/LICENSE","third_party":false},"latest_stable":{"finding":"v3.0.3, published 2026-10-26T21:38:58Z (ISO date 2026-10-26); prerelease=false, draft=false. Checked 2026-10-27 from releases API. Main and this tag both resolve to 7bb48f213ac677f943d5c791199ed3dddf302f00.","quote":"\"tag_name\": \"v3.0.3\"","url":"https://api.github.com/repos/mistralai/mistral-vibe/releases?per_page=100","third_party":false,"evidence":[{"finding":"Release publication timestamp.","quote":"\"published_at\": \"2026-10-26T21:38:58Z\"","url":"https://api.github.com/repos/mistralai/mistral-vibe/releases?per_page=100","third_party":false},{"finding":"PyPI package mistral-vibe version 3.0.3 (primary publisher registry metadata, not a third-party review).","quote":"\"version\":\"3.0.3\"","url":"https://pypi.org/pypi/mistral-vibe/json","third_party":false},{"finding":"Release source equals checked main commit.","quote":"\"sha\": \"7bb48f213ac677f943d5c791199ed3dddf302f00\"","url":"https://api.github.com/repos/mistralai/mistral-vibe/git/ref/tags/v3.0.3","third_party":false}]},"latest_prerelease":{"finding":"not found","quote":"\"prerelease\": false","url":"https://api.github.com/repos/mistralai/mistral-vibe/releases?per_page=100","third_party":false,"evidence":[{"finding":"All 97 returned releases are stable; second page empty. No published prerelease tag/date. No inference about unpublished tags.","quote":"[]","url":"https://api.github.com/repos/mistralai/mistral-vibe/releases?per_page=100&page=2","third_party":false}]},"last_commit":{"finding":"Default branch main: 7bb48f213ac677f943d5c791199ed3dddf302f00; committer date 2026-10-26T21:37:45Z (ISO date 2026-10-26). Checked 2026-10-27.","quote":"\"date\": \"2026-10-26T21:37:45Z\"","url":"https://api.github.com/repos/mistralai/mistral-vibe/commits?per_page=1","third_party":false},"fork_of":{"finding":"GitHub classifies repo as not a fork (fork=false, no parent). No upstream coding-agent fork attribution found in README/metadata; not proof of independent provenance of every component.","quote":"\"fork\": false","url":"https://api.github.com/repos/mistralai/mistral-vibe","third_party":false},"maintenance":{"finding":"Not archived or disabled per API. No unmaintained notice found in README/changelog. 2026-10-26 release/commit support active maintenance as of 2026-10-27.","quote":"\"archived\": false","url":"https://api.github.com/repos/mistralai/mistral-vibe","third_party":false},"gaps":[{"finding":"No published prerelease found in 97 entries and empty page 2.","checked":["https://api.github.com/repos/mistralai/mistral-vibe/releases?per_page=100","https://api.github.com/repos/mistralai/mistral-vibe/releases?per_page=100&page=2"]},{"finding":"No bundled Docker/seatbelt/gVisor/bubblewrap or global shell-network-off switch found. Experimental sandbox isolation is supplied by caller.","checked":["https://raw.githubusercontent.com/mistralai/mistral-vibe/main/README.md","https://docs.mistral.ai/vibe/code/safety-approvals-permissions","https://docs.mistral.ai/vibe/code/cli/configuration-reference","https://docs.mistral.ai/vibe/code/cli/offline-models","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/app_server/_unified_permissions.py","https://api.github.com/repos/mistralai/mistral-vibe/git/trees/main?recursive=1"]},{"finding":"No separate exported reasoning_tokens field or demonstrated budget covering all child/utility calls. Root totals exclude children.","checked":["https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/cli-rust/src/run_export/model.rs","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/app_server/run_export.py","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/cli-rust/src/headless/usage.rs","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/cli-rust/src/headless/report.rs","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/core/llm/backend/factory.py"]},{"finding":"No ChatGPT/Claude/Gemini/GitHub Copilot subscription-provider login found, or explicit OAuth/device-code designation for Mistral browser sign-in.","checked":["https://docs.mistral.ai/vibe/code/cli/install-setup","https://docs.mistral.ai/vibe/code/cli/api-keys-profiles","https://docs.mistral.ai/vibe/code/cli/configuration-reference","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/core/config/models.py","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/harness/runtimes/python/python/mistralai_vibe_local_harness/vibe/adapters/generic/_execute.py"]},{"finding":"Docs conflict: Agents says child active_model is ignored; 3.0.3 changelog says now honored. Prefer release changelog. Configuration reference also still describes auto_compact_threshold=0 as disabling compaction whereas 3.0.3 rejects it; do not use that stale setting for worker limits.","checked":["https://docs.mistral.ai/vibe/code/cli/agents","https://docs.mistral.ai/vibe/code/cli/configuration-reference","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/CHANGELOG.md"]}],"sources":["https://github.com/mistralai/mistral-vibe","https://docs.mistral.ai/vibe/code/cli/","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/cli-rust/src/cli.rs","https://docs.mistral.ai/vibe/code/cli/work-with-cli","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/cli-rust/src/headless/config.rs","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/cli-rust/src/headless_trust.rs","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/cli-rust/src/run_export/model.rs","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/README.md","https://docs.mistral.ai/vibe/code/safety-approvals-permissions","https://docs.mistral.ai/vibe/code/cli/configuration-reference","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/CHANGELOG.md","https://docs.mistral.ai/vibe/code/cli/offline-models","https://docs.mistral.ai/vibe/code/cli/configuration","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/cli-rust/src/headless/usage.rs","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/cli-rust/src/headless/report.rs","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/app_server/run_export.py","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/core/config/vibe_schema.py","https://docs.mistral.ai/vibe/code/cli/agents","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/harness/runtimes/python/python/mistralai_vibe_local_harness/vibe/adapters/generic/_execute.py","https://docs.mistral.ai/vibe/code/cli/api-keys-profiles","https://docs.mistral.ai/vibe/code/cli/install-setup","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/LICENSE","https://api.github.com/repos/mistralai/mistral-vibe/releases?per_page=100","https://pypi.org/pypi/mistral-vibe/json","https://api.github.com/repos/mistralai/mistral-vibe/git/ref/tags/v3.0.3","https://api.github.com/repos/mistralai/mistral-vibe/releases?per_page=100&page=2","https://api.github.com/repos/mistralai/mistral-vibe/commits?per_page=1","https://api.github.com/repos/mistralai/mistral-vibe","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/app_server/_unified_permissions.py","https://api.github.com/repos/mistralai/mistral-vibe/git/trees/main?recursive=1","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/core/llm/backend/factory.py","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/core/config/models.py","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/core/tools/base.py","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/core/types.py","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/core/config/_defaults.py","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/core/tools/builtins/task.py","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/permissions.py","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/cli-rust/src/headless/turn.rs","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/cli-rust/src/server/callback.rs","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/docs/reference/configuration.md","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/vibe/core/tools/permissions.py","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/harness/runtimes/python/python/mistralai_vibe_local_harness/vibe/adapters/generic/_provider.py","https://raw.githubusercontent.com/mistralai/mistral-vibe/main/harness/runtimes/python/python/mistralai_vibe_local_harness/vibe/adapters/generic/_model.py","https://docs.mistral.ai/vibe/code/overview"]}