{ "data": { "a": { "slug": "clawboo", "name": "Clawboo", "vendor": "Sanreds", "vendorUrl": "https://www.claw.boo", "kind": "harness", "category": "agent-harnesses", "summary": "Clawboo is an open-source, self-hosted dashboard and server that runs a team of AI agents on one task board. A lead agent, Boo Zero, hands tasks to Claude Code, Codex, Hermes, OpenClaw or Clawboo's own built-in agents.", "url": "https://www.anchorterminal.com/tools/clawboo", "markdownUrl": "https://www.anchorterminal.com/tools/clawboo.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/clawboo.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/clawboo.json", "dns": "clawboo.grade.anchorterminal.com", "repo": "https://github.com/clawboo/clawboo", "license": "MIT", "transports": [], "packages": [ { "registry": "npm", "name": "clawboo" } ], "auth": "none", "authNotes": "No Clawboo account. On the default loopback bind the API needs no credential. An optional shared token, `STUDIO_ACCESS_TOKEN`, puts every `/api/` route behind a `clawboo_access` cookie, with no users, roles or per-person revocation. Agents Clawboo starts reach its MCP servers through signed attach URLs.", "pricing": "free", "pricingNotes": "Free and MIT, self-hosted, with nothing to buy. The owner pays the model providers or plans each runtime uses, or runs a local Ollama model with no key. No hosted option is offered.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the documentation (llms-full.txt), the README or the npm package metadata (checked 2026-11-01).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 100, "pypiWeekly": null, "asOf": "2026-11-01" }, "docsUrl": "https://docs.claw.boo", "llmsTxt": "https://docs.claw.boo/llms.txt", "capabilities": [ "agent.multi-agent", "agent.mcp-client" ], "tags": [ "open-source", "self-hosted", "local", "free", "no-card", "llms-txt", "mcp", "typescript" ], "lastRelease": "2026-10-21", "graded": true, "anchor": { "graded": true, "score": 61.4, "grade": "C", "agentReady": false, "rank": 555, "ranked": true, "rankOf": 1251, "categoryRank": 15, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 75, "maintenance": 51, "payments": 60, "reliability": 52, "schema": 83, "security": 70, "transparency": 58 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -4, "negativeNotes": [ "Undated advisory on the security page, read 1 November 2026. On 0.5.0 (21 October 2026) and older, any request from 127.0.0.1 reaches `/api/mcp/` without the access cookie, so a reverse proxy on the same machine exposes the boards, memory, team chat, tools and signed attach URLs for any agent, even with `STUDIO_ACCESS_TOKEN` set. Published by the maintainer with a proxy rule to block it, fixed on main and not released, in a setup that isn't the default, -3. https://docs.claw.boo/operating/security", "Listed under Unreleased in the changelog, read 1 November 2026. On 0.5.0 and older, an access token containing a character outside letters, digits and `.`, `_`, `~`, `-` turned the access check off while the server kept running, leaving a proxied dashboard open. Fixed on main and not released, -1. https://docs.claw.boo/appendices/changelog" ], "verdict": "Tasks, memory, team chat and connectors are shared across five runtimes through four MCP servers, with documentation that states each default and limit. Claude Code, Codex and Hermes run with their sandboxes and approval prompts off and no setting to change it, and a reverse-proxy exposure of the MCP servers is fixed only on the unreleased main branch.", "bestFor": "One person on one computer who wants several coding and general agents on one board, with shared memory and a lead agent that routes work.", "strengths": [ "One board, one team chat and one shared memory across Clawboo Native, Claude Code, Codex, Hermes and OpenClaw agents", "No telemetry per the docs, which list the three requests the server makes itself and the two the dashboard makes", "Loopback bind by default, a same-origin guard against browser and DNS-rebinding attacks, and a refusal to start on a network bind without a token", "About 120 documentation pages, served as Markdown with llms.txt and llms-full.txt, including a known-issues page and every built-in limit with its source line", "npm releases carry SLSA provenance from the repository's publish workflow, with CodeQL and Dependabot in the repository" ], "weaknesses": [ "Claude Code runs in `bypassPermissions`, Codex with `danger-full-access` and Hermes with `--yolo`, with no setting to change it and no sandbox", "On 0.5.0 and older, a same-machine reverse proxy exposes `/api/mcp/` without the access cookie. The fix is on main and unreleased on 1 November 2026", "No access token by default, so any local program can call the API and answer approval cards", "Keys saved under Providers are also written in plain text to `~/.openclaw/.env` and each OpenClaw agent's `auth-profiles.json`", "Version 0.5.0, with two releases in the 90 days to 1 November 2026 and budgets that only warn unless set to a hard cap" ], "agentNotes": [ "Run `npx clawboo@latest`, not a bare `npx clawboo`, which can reuse an older cached build. Node.js 22.12 or newer is required", "On 0.5.0 behind nginx, Caddy or a Cloudflare Tunnel, deny `/api/mcp/` at the proxy and set `STUDIO_ACCESS_TOKEN` from `openssl rand -hex 24`", "Give Claude Code, Codex and Hermes teammates only work you would let run unattended, or run Clawboo under a separate user account or VM", "Create a hard-cap budget in Settings \u003e Insights \u003e Governance before long runs. A fresh install has no budget and new budgets only warn", "Install `@anthropic-ai/claude-agent-sdk` globally beside Clawboo for Claude Code teammates. A one-off `npx` run cannot load it" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 61.4 } ], "editorialScores": { "ergonomics": 75, "maintenance": 51, "payments": 60, "reliability": 52, "schema": 83, "security": 70, "transparency": 80 }, "provenanceScore": 36, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx clawboo@latest # Node.js 22.12 or newer", "http": "curl http://localhost:18790/api/health", "headless": { "command": "curl -X POST http://localhost:18790/api/teams/\u003cteam-id\u003e/chat -H 'Content-Type: application/json' -d '{\"message\":\"Plan the launch checklist.\"}'" } }, "letme": { "capability": "https://letme.dev/agent.multi-agent", "tool": "https://letme.dev/clawboo" }, "area": "frameworks", "provenance": { "legalEntity": "", "domain": "claw.boo", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://docs.claw.boo/appendices/changelog", "securityTxt": "none", "checked": "2026-11-01", "notes": [ "No legal entity is named in the repository, the docs or the npm package. The MIT licence reads Copyright (c) 2026 Sanreds, and the npm package's only maintainer is sanreds.", "www.claw.boo was not read. Its robots.txt disallows Claude-Web in Cloudflare's managed block and later allows ClaudeBot and anthropic-ai, so the site's terms and privacy pages, if any, are unchecked.", "docs.claw.boo/.well-known/security.txt answered 404 on 1 November 2026. SECURITY.md sends reports to GitHub private vulnerability reporting.", "The software is self-hosted, so there is no vendor endpoint or status page to check. The domain registration date was not looked up." ], "score": 36 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/clawboo.json" }, "answer": "Mistral Vibe CLI scores 63 (B) on agent readiness against Clawboo's 61.4 (C), and leads in 4 of 7 scored categories. Clawboo leads on schema \u0026 documentation and security \u0026 auth.", "b": { "slug": "mistral-vibe-cli", "name": "Mistral Vibe CLI", "vendor": "Mistral AI", "vendorUrl": "https://docs.mistral.ai/vibe/code/cli/install-setup", "kind": "harness", "category": "agent-harnesses", "summary": "Mistral AI's open-source terminal coding agent. It runs Mistral's hosted models or any OpenAI-compatible endpoint, headless with `vibe -p` and in editors through `vibe-acp`. This listing covers the CLI, not Mistral's Vibe chat app.", "url": "https://www.anchorterminal.com/tools/mistral-vibe-cli", "markdownUrl": "https://www.anchorterminal.com/tools/mistral-vibe-cli.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/mistral-vibe-cli.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/mistral-vibe-cli.json", "dns": "mistral-vibe-cli.grade.anchorterminal.com", "repo": "https://github.com/mistralai/mistral-vibe", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "pypi", "name": "mistral-vibe" } ], "auth": "mixed", "authNotes": "Browser sign-in with a Mistral account, or a Mistral API key in `MISTRAL_API_KEY` or `~/.vibe/.env`, created under Code, Vibe CLI in the Mistral console. The same key works on the Free plan, a paid plan or pay-as-you-go. A local OpenAI-compatible server needs no Mistral account. MCP servers take static headers or OAuth.", "pricing": "freemium", "pricingNotes": "The CLI is free under Apache-2.0. Hosted models come with a Mistral plan or an API key. Free has limited coding sessions, Pro is $14.99 a month and Team $24.99 a user a month, Enterprise by quote, with pay-as-you-go at API rates past a plan's limit. The default model, Mistral Medium 3.5, is $1.5 per million input tokens and $7.5 per million output tokens on the API. A local model costs nothing (checked 2026-10-18).", "priceSummary": "Freemium", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the README, the CLI docs or the source (checked 2026-10-18).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 5100, "npmWeekly": null, "pypiWeekly": 331757, "asOf": "2026-10-18" }, "docsUrl": "https://docs.mistral.ai/vibe/code/cli/install-setup", "llmsTxt": "https://docs.mistral.ai/llms.txt", "capabilities": [ "agent.harness", "agent.mcp-client", "agent.multi-agent" ], "tags": [ "official", "harness", "coding-agent", "cli", "open-source", "python", "mcp", "acp", "llms-txt", "telemetry-default-on", "no-sandbox", "subagents", "hooks", "freemium", "no-card", "local" ], "lastRelease": "2026-10-09", "graded": true, "anchor": { "graded": true, "score": 63, "grade": "B", "agentReady": false, "rank": 483, "ranked": true, "rankOf": 1251, "categoryRank": 12, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 84, "maintenance": 75, "payments": 60, "reliability": 69, "schema": 76, "security": 58, "transparency": 80 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-18" }, "negative": -8, "negativeNotes": [ "2026-09-12. CVE-2026-87983 to CVE-2026-87988 (advisory MAI-2026-003, severity High, published 14 September 2026). Crafted shell commands could run without the approval prompt, reading or writing files outside the workspace or running code, and injected instructions could trigger them. HiddenLayer published the CVEs on 11 September and Mistral released 2.25.4 the next day. Fixed and published inside six months, so 2 points for each high, as nanobot's and zeroclaw's fixed advisories were weighed. Six highs come to 12, held at the -6 cap for fixed and published advisories that claude-code and the Claude Agent SDK listing use (research/new/NOTES-harnesses-H1.md, negative events). Paperclip's -10 adds -5 for its group of ten fixed advisories and separate lines for advisories with no patched version, which doesn't apply here (https://docs.mistral.ai/resources/security-advisories/MAI-2026-003). -6", "2026-10-18. The offline guide says that with `enable_telemetry = false` and `enable_auto_update = false` the CLI contacts no external service, and the configuration reference describes `enable_auto_update` as installing releases in the background. The 2.26.1 source has no such key. It reads `enable_update_checks`, which stays on, and the README says interactive sessions then query PyPI or uv once a day. We followed ironclaw's precedent, not zeroclaw's, because this is the vendor's documentation contradicting the shipped release on what leaves the machine, where zeroclaw's was a site-versus-docs mismatch. The safety page's line that `-p` falls back to `auto-approve` is also wrong, but it errs towards caution, so it stays a weakness with no deduction. A misleading claim, at the minimum, -2 (https://docs.mistral.ai/vibe/code/cli/offline-models; https://docs.mistral.ai/vibe/code/cli/configuration-reference; https://github.com/mistralai/mistral-vibe#update-settings). -2" ], "verdict": "Apache-2.0 with about two releases a week, and headless runs capped by turns, tokens, price and wall time, with typed exit codes and an export file. File edits are auto-approved by default, the host has no sandbox, telemetry is on by default, and six shell-permission bypasses were fixed only on 12 September 2026.", "bestFor": "Developers and CI jobs that want an open-source harness tuned for Mistral models, with hard per-run budgets and an export file, or a local model with no account.", "strengths": [ "Apache-2.0, on PyPI and Homebrew at 2.26.1, with 20 PyPI releases in the 90 days to 18 October 2026", "`vibe -p` stops on `--max-turns`, `--max-tokens`, `--max-price` or `--time-limit`, with exit codes 0 to 4 and an `export.json` naming the outcome", "Runs against any OpenAI-compatible endpoint, with a llama.cpp provider on 127.0.0.1:8080 in the defaults and a documented offline set-up", "Project `.vibe/` config, hooks, MCP servers and `AGENTS.md` load only from trusted folders, and `-p` runs never trust a folder without `--trust`", "`vibe-acp` is in the ACP registry at 2.26.1, with prebuilt binaries for macOS and Linux" ], "weaknesses": [ "The default agent auto-approves file edits, and there's no sandbox on the host. Isolation needs the experimental `--agent-socket` server or a container", "Six high-severity shell-permission bypasses (CVE-2026-87983 to CVE-2026-87988) were fixed in 2.25.4 on 12 September 2026, a day after HiddenLayer published them", "Telemetry is on by default, and the server-side experiments it enables can switch the default agent to the `smart-approve` classifier", "The docs disagree with the code. The safety page says `-p` falls back to auto-approve, and the offline guide names an `enable_auto_update` key the source doesn't define", "The repository takes no outside contributions, and its history is squashed release commits" ], "agentNotes": [ "Pass `--agent` on every `-p` run (`plan` is read-only). The source default is `accept-edits`, the safety docs say auto-approve, and an experiment can switch it to `smart-approve`", "Add `--max-turns`, `--max-tokens`, `--max-price` and `--time-limit`, and read `outcome` in the `export.json` that `--output-dir` writes. Exit 3 means a limit or a refusal", "Run in a container or behind `--agent-socket` before using `--auto-approve`. Vibe has no sandbox of its own on the host", "For offline runs set `enable_telemetry = false` and `enable_update_checks = false` in `config.toml`. The docs' `enable_auto_update` isn't the key the code reads", "Use 2.25.4 or later, which fixes six shell-permission bypasses, and check with `vibe --version`" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 4, "avgRating": 3.3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 63 } ], "editorialScores": { "ergonomics": 84, "maintenance": 75, "payments": 60, "reliability": 69, "schema": 76, "security": 58, "transparency": 68 }, "provenanceScore": 91, "checked": { "categories": { "ergonomics": "2026-10-18", "maintenance": "2026-10-18", "payments": "2026-10-18", "reliability": "2026-10-18", "schema": "2026-10-18", "security": "2026-10-18", "transparency": "2026-10-18" }, "last": "2026-10-18", "lastMoved": "2026-10-27", "oldest": "2026-10-18", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "uv tool install mistral-vibe # or: curl -LsSf https://mistral.ai/vibe/install.sh | bash", "headless": { "command": "vibe --prompt-file task.md --agent accept-edits --output json --max-turns 30 --max-price 1.0 --time-limit 1800 --output-dir out/", "env": { "MISTRAL_API_KEY": "\u003ckey\u003e" } } }, "letme": { "capability": "https://letme.dev/agent.harness", "tool": "https://letme.dev/mistral-vibe-cli" }, "sameCompany": [ "mistral-api", "mistral-embeddings", "mistral-moderation", "mistral-voxtral-transcribe", "voxtral-mini-4b-realtime-2602", "mistral-ocr", "mistral-large-4" ], "area": "frameworks", "provenance": { "legalEntity": "Mistral AI (RCS Paris 952 418 325)", "domain": "mistral.ai", "domainRegistered": "2019-05-15", "endpointOnVendorDomain": null, "terms": "https://legal.mistral.ai/terms/commercial-terms-of-service", "privacy": "https://legal.mistral.ai/terms/privacy-policy", "statusPage": "https://status.mistral.ai", "changelog": "https://github.com/mistralai/mistral-vibe/blob/main/CHANGELOG.md", "securityTxt": "valid", "checked": "2026-10-18", "notes": [ "security.txt read on 2026-10-18, a Mistral security contact, Expires 2027-05-05, Policy a HackerOne submission form. SECURITY.md in the repository points to the same contact and programme", "Privacy policy effective 3 September 2026 and commercial terms effective 25 September 2026, both read on 2026-10-18. Both name Vibe among the Mistral AI products they cover", "The legal entity and domain date are carried from the mistral-api listing's 17 October check", "status.mistral.ai covers the hosted API, answered with a bot check on 17 October per the mistral-api listing and wasn't read again. It doesn't cover the local CLI" ], "score": 91 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/mistral-vibe-cli.json", "live": { "slug": "mistral-vibe-cli", "vendorStatus": { "page": "https://status.mistral.ai", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-01T05:14:59.071965115Z" }, "versions": [ { "registry": "github", "name": "mistralai/mistral-vibe", "version": "v3.0.4", "released": "2026-10-30", "seenAt": "2026-10-31T16:09:39.876915405Z" }, { "registry": "pypi", "name": "mistral-vibe", "version": "3.0.4", "released": "2026-10-30", "seenAt": "2026-10-31T16:09:39.68801335Z" } ], "githubStars": 5260, "pypiWeekly": 355798, "securityTxt": { "url": "https://mistral.ai/.well-known/security.txt", "state": "valid", "expires": "2027-05-05T23:59:59.000Z", "checkedAt": "2026-10-31T15:41:38.574797026Z" }, "llmsTxt": { "url": "https://docs.mistral.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-31T15:11:22.470473579Z" }, "domain": { "domain": "mistral.ai", "registered": "2019-05-15", "source": "https://rdap.identitydigital.services/rdap/domain/mistral.ai", "checkedAt": "2026-10-25T14:03:13.400772123Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/mistralai/mistral-vibe/main/CHANGELOG.md", "kind": "deprecations", "status": 200, "checkedAt": "2026-10-31T06:21:55.264964477Z", "changedAt": "2026-10-31T06:21:55.264964477Z", "fingerprint": "32482e7688f4" } ], "github": { "repo": "mistralai/mistral-vibe", "checkedAt": "2026-10-26T07:47:02.037729335Z", "stars": 5200, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-22T20:42:31Z", "openIssues": 219, "openPRs": 204, "issuesOpened90d": 209, "issuesClosed90d": 182, "prsMerged90d": 28, "ci": { "branch": "main", "runs": 50, "success": 40, "failure": 10, "other": 0, "latest": "failure", "latestAt": "2026-10-22T21:03:30Z" }, "replies": { "sampled": 25, "unanswered": 17, "medianDays": 1.6 } }, "updatedAt": "2026-11-01T05:14:59.071965115Z" } }, "edges": [ { "by": 24, "category": "maintenance", "leads": "mistral-vibe-cli", "name": "Maintenance \u0026 community", "reasons": { "a": "0.5.0 was published to npm on 21 October 2026 (30). Two releases in the 90 days to 1 November 2026, 0.4.0 on 28 September and 0.5.0, below the three the line asks for (0). github.com was unreachable, so replies to issues, pull requests and Discussions are unchecked. The CI file cites issue #140 as fixed (3). One public npm package, current, with no entry in the official MCP registry for its four servers (10). CI, CodeQL, weekly Dependabot and SLSA provenance on 0.4.0 and 0.5.0, with `@composio/client` pinned to an alpha (8).", "b": "2.26.1 on 9 October 2026 (30). 20 releases on PyPI in the 90 days to 18 October, and 22 in the changelog (20). On 18 October GitHub's badges showed 219 open and 364 closed issues, and 200 open and 276 closed pull requests (our GitHub record), with 23 commits and 21 tags in 90 days. Response times couldn't be read. CONTRIBUTING.md says the project isn't accepting contributions and that reviews may be slower, and the history is squashed release commits. Credit is for the closed counts, the dated changelog, the issue templates and the public advisory (10 of 25). No SDK. `vibe-acp` is current in the ACP registry at 2.26.1 and the Homebrew formula is at 2.26.1 (8 of 15). Dependencies are pinned to exact versions, workflow actions are pinned by commit, and CI runs on main, but no Dependabot or Renovate config was found (7 of 10). 30+20+10+8+7 = 75." }, "scores": { "a": 51, "b": 75 } }, { "by": 22, "category": "transparency", "leads": "mistral-vibe-cli", "name": "Transparency \u0026 trust", "reasons": { "a": "MIT, Copyright 2026 Sanreds, with a third-party notices file (30). The docs list every file Clawboo writes, which copies of keys are encrypted and which are plain text, retention for stored tool results (7 days) and pending approvals (24 hours), and that prompts go only to connected providers. There is no privacy statement, and the website wasn't read (22). The 0.1.x line is deprecated on npm with a note in the changelog, and removals are dated in release notes, with no written deprecation policy or notice period (10). No telemetry, with the server's own outbound requests disclosed, though the npm update check has no setting (18).", "b": "Apache-2.0, with LICENSE and pyproject in agreement (30). The README sends readers to Mistral's privacy policy (effective 3 September 2026), which names Vibe. The commercial terms (effective 25 September 2026) say no training on customer data unless a product's default or an opt-in allows it, and the pricing page lists model training as opt-out on Free, Pro and Team. The configuration reference calls telemetry anonymous without listing its fields. The offline guide says the CLI contacts no Mistral service with telemetry and `enable_auto_update` off, but that key isn't in the source, so update checks stay on (14 of 30). Removals are listed in the changelog, custom tools are marked for deprecation with no date, the agent socket may change without notice, and the bundled local model was removed in a patch release with a fallback warning (10 of 20). Telemetry is disclosed with an opt-out in the README and the configuration reference, and the README names the server-managed shell-tool rollout, but its fields are only in the source (14 of 20). 30+14+10+14 = 68." }, "scores": { "a": 58, "b": 80 } }, { "by": 17, "category": "reliability", "leads": "mistral-vibe-cli", "name": "Reliability", "reasons": { "a": "Read as local software. The official npm package `clawboo` states Node.js 22.12 or newer, and the README says macOS, Linux and Windows are supported (20). `ci.yml` runs lint, typecheck, Vitest and a real-concurrency suite on Linux and platform suites on Windows and macOS, and `publish.yml` reruns build, lint, typecheck, tests and a clean-install boot before it publishes. 0.5.0 carries provenance from that workflow on main, so its checks passed at that commit, but run results on main couldn't be read (15). github.com was unreachable, so open crash and regression issues are unchecked. A known-issues page lists 25 entries with a status each, three of them fixed on main (5). Changesets write a changelog entry per release, and removals and the 0.2.0 database reset are called out, though breaking changes arrive in minor versions before 1.0 (12). Version 0.5.0, and SECURITY.md says pre-1.0 (0).", "b": "Local-package reading. PyPI, uv, pip, Homebrew at 2.26.1 and an install script, with Python 3.12 or later stated and UNIX the supported target (20). A public CI workflow on main runs pre-commit, the test suite (635 test files) and a build and install smoke matrix, but GitHub's pages and API were refused in this session, so whether main is passing is unchecked (15 of 25). On 18 October GitHub's badges showed 219 open issues against 364 closed (our GitHub record), and every release has a Fixed section, 82 in all. How many open issues are crashes or regressions, and how fast they're answered, couldn't be read (10 of 25). The changelog states Keep a Changelog and semver and marks breaking changes, but the hooks rename shipped in minor 2.21.0, patch 2.11.1 changed the `-p` approval default, and patch 2.26.1 removed the bundled local model (9). 2.26.1, classified Production/Stable (15). 20+15+10+9+15 = 69." }, "scores": { "a": 52, "b": 69 } }, { "by": 12, "category": "security", "leads": "clawboo", "name": "Security \u0026 auth", "reasons": { "a": "Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The docs say Clawboo sends no telemetry and list the GitHub catalogue fetch, the npm version check, OpenRouter's public model list, Google Fonts and the GitHub star count, of which only the catalogue address can be changed (27). Clawboo Native shell commands are off by default and asked one at a time, and connector grants are per agent with approval on writes. Claude Code, Codex and Hermes run with their prompts and sandboxes off and no setting to change it, they can read Clawboo's database and key vault, and with no access token by default any local program can answer approval cards (8). Images in agent text don't load on their own, peer posts are marked as evidence, and a run that has read private data and untrusted content asks before any outbound connector call (11). An audit log of budget, breaker, approval, verification, tool-call and install events, with secrets masked (13). SECURITY.md with private reporting, CodeQL, Dependabot and npm provenance. No security.txt or bug bounty, OSV lists no advisory for `clawboo`, and the proxy advisory is on the docs with a workaround while its fix is unreleased (11).", "b": "Framework reading (telemetry defaults, approvals, guardrails, sandboxing), five lines. Telemetry and crash reporting are on by default with an opt-out, and the source sends tool names, approval decisions, the model and file counts to api.mistral.ai only when a Mistral key is set. Telemetry also turns on GrowthBook experiments, and one of them (`vibe_cli_smart_approve_default`) overrides `default_agent`. Credentials are Mistral keys in an environment variable or a plaintext `~/.vibe/.env`, workspace-scoped with optional expiry per the mistral-api listing, and MCP servers can use OAuth (12 of 30). Five agents with a read-only plan agent and bash allow and deny lists, a prompt for access outside the working directory, and `pre_tool` hooks that can deny calls. The default auto-approves file edits, and there's no sandbox on the host. Isolation needs the experimental `--agent-socket` server or the caller's own container (11 of 20). Project config, hooks and MCP servers load only from trusted folders, and `-p` needs `--trust` to load them. The safety page warns that smart-approve isn't a sandbox. No network egress control on the host, and MAI-2026-003 says injected instructions could trigger the bypassed commands (8 of 15). OpenTelemetry tracing is opt-in, with default, strict and no redaction, and each run can write a session journal and an export with the effective config. Managed admin config exists, and audit logs come with the Enterprise plan (13). SECURITY.md asks for private reports, security.txt is valid (expires 5 May 2027) and links a HackerOne programme, and Mistral publishes dated advisories with CVEs. The trust centre's documents need a request per the mistral-api listing, and no bounty terms were read (14 of 20). 12+11+8+13+14 = 58." }, "scores": { "a": 70, "b": 58 } }, { "by": 9, "category": "ergonomics", "leads": "mistral-vibe-cli", "name": "Agent ergonomics", "reasons": { "a": "Harness reading, scored on what an agent or pipeline driving it has to supply. Four MCP servers keep tool lists small (12 Tasks tools, 4 Memory tools, 2 or 3 TeamChat tools, and Tools with four demonstration builtins plus granted connectors), Clawboo Native gets a read-only Tasks subset, and Tools results over 16 KiB are trimmed with a handle to read the rest (22). Circuit breakers stop task-runner runs after more than 30 tool calls or 200,000 tokens a minute, and team chat caps hand-offs at 8 a turn and three levels. Budgets warn only unless set to a hard cap, and a hard cap stops most runs only between runs (14). REST errors use one `{error}` shape, refused MCP calls return `denied:` with a reason prefix, and 429s carry `Retry-After` (16). `claim_task` and `assign_task` are atomic, illegal status changes are refused by name, the board survives restarts and routines resume after failure. No MCP tool annotations are documented (14). One `npx` command and a provider key or a local Ollama, but Claude Code teammates need a global install with the Agent SDK, and there is no client SDK (9).", "b": "Framework reading, adapted to a harness driven by a pipeline. `--enabled-tools` and `--disabled-tools` with globs and regex (in `-p` the first disables everything else), per-tool and per-MCP-tool permissions, and switches for subagents and background processes (20 of 25). `--max-turns`, `--max-tokens`, `--max-price` and `--time-limit`, with text, json and streaming output and an export file with usage and cost (20). Exit codes 0 to 4 with named outcomes, refusals reported with a code, and config problems listed under `warnings` (18). `--resume SESSION_ID` and `--continue`, SIGTERM stops a run so it can be resumed, and model API failures are retried before exit 2 (16). One required input (the prompt), a GitHub Action and the ACP server, but no SDK, and the app-server's JSON-RPC protocol isn't documented for outside use (10). 20+20+18+16+10 = 84." }, "scores": { "a": 75, "b": 84 } }, { "by": 7, "category": "schema", "leads": "clawboo", "name": "Schema \u0026 documentation", "reasons": { "a": "Harness reading of the framework line, as for Paperclip. The REST API's 199 routes are documented per resource with parameters, bodies and responses, and the MCP tools reference gives typed arguments for every tool on the four servers, but no OpenAPI file was found (17). llms.txt, llms-full.txt and a Markdown copy of every page at `.md` on docs.claw.boo (10). The docs say what each part does and does not cover, with known issues, production defaults and a limits page that names the code line behind each number (17). Tool arguments are typed with required and optional fields and documented caps, such as 24 live subtasks per parent and limits lowered to 1,000, with free-text task bodies (12). curl examples on each API page, an events and errors reference, and the exact error strings each MCP tool returns (14). A dated changelog for every release with an Unreleased section, though API paths carry no version and every MCP server reports 0.1.0 (13).", "b": "Framework reading. A configuration reference with each key's type and default, the `export.json` fields, and the `--agent-socket` JSON-RPC methods with typed params and results in the README, plus ACP. No published schema file for the config or the streaming events was found (16 of 25). docs.mistral.ai/llms.txt indexes the CLI pages, each with a Markdown twin (10). The safety page says what each agent allows and when to use it, but it says `-p` falls back to `auto-approve` where the README and source say `accept-edits`, the offline guide and the configuration reference name `enable_auto_update`, which the source doesn't define (it reads `enable_update_checks`), and the API keys and offline pages carry unresolved TODO notes for developers (10 of 20). Output formats, agent names, permission values and OpenTelemetry redaction modes are enums, and the config is validated on load (12). Many examples and an exit-code table that maps each code to the outcome names in `export.json` (13). Dated changelog and version tags (15). 16+10+10+12+13+15 = 76." }, "scores": { "a": 83, "b": 76 } } ], "facts": [ { "a": "Agent harness", "b": "Agent harness", "name": "Kind" }, { "a": "Sanreds", "b": "Mistral AI", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "", "name": "Transports" }, { "a": "None", "b": "OAuth or key", "name": "Auth" }, { "a": "Free", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT", "b": "Apache-2.0", "name": "Licence" }, { "a": "no", "b": "yes", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-21", "b": "2026-10-09", "name": "Last release" }, { "a": "no document linked", "b": "2026-09-25", "name": "Terms last updated" }, { "a": "no document linked", "b": "2026-09-03", "name": "Privacy policy last updated" }, { "a": "not read yet", "b": "yes, with an opt-out", "name": "Customer content may train models" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "100 npm/wk", "b": "5.1k stars, 332k PyPI/wk", "name": "Popularity" }, { "a": "none", "b": "3.3/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Mistral Vibe CLI scores 63 (B) on agent readiness against Clawboo's 61.4 (C), and leads in 4 of 7 scored categories. Clawboo leads on schema \u0026 documentation and security \u0026 auth.", "question": "Which is better for AI agents, Clawboo or Mistral Vibe CLI?" }, { "answer": "Yes. Clawboo is open source (MIT). Mistral Vibe CLI is open source (Apache-2.0).", "question": "Are Clawboo and Mistral Vibe CLI open source?" } ], "goodFor": [ { "aheadOn": [ "Schema \u0026 documentation, 83 against 76", "Security \u0026 auth, 70 against 58" ], "also": [ "No key needed to call it" ], "goodFor": "One person on one computer who wants several coding and general agents on one board, with shared memory and a lead agent that routes work.", "slug": "clawboo", "watchFor": "Claude Code runs in `bypassPermissions`, Codex with `danger-full-access` and Hermes with `--yolo`, with no setting to change it and no sandbox" }, { "aheadOn": [ "Reliability, 69 against 52", "Agent ergonomics, 84 against 75", "Maintenance \u0026 community, 75 against 51", "Transparency \u0026 trust, 80 against 58" ], "also": null, "goodFor": "Developers and CI jobs that want an open-source harness tuned for Mistral models, with hard per-run budgets and an export file, or a local model with no account.", "slug": "mistral-vibe-cli", "watchFor": "The default agent auto-approves file edits, and there's no sandbox on the host. Isolation needs the experimental `--agent-socket` server or a container" } ], "history": { "clawboo": null, "mistral-vibe-cli": [ { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 62.9, "fromGrade": "B", "to": 63, "toGrade": "B" } ] }, "job": { "capability": "agent.multi-agent", "name": "Multi-agent orchestration" }, "others": [ { "json": "https://www.anchorterminal.com/compare/agent-zero-vs-mistral-vibe-cli.json", "title": "Agent Zero vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/agent-zero-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/aider-vs-mistral-vibe-cli.json", "title": "Aider vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/aider-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/amp-vs-mistral-vibe-cli.json", "title": "Amp vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/amp-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/antigravity-cli-vs-mistral-vibe-cli.json", "title": "Antigravity CLI vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/antigravity-cli-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/auggie-vs-mistral-vibe-cli.json", "title": "Auggie CLI vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/auggie-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/claude-code-vs-mistral-vibe-cli.json", "title": "Claude Code vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/claude-code-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/cline-vs-mistral-vibe-cli.json", "title": "Cline vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/cline-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/crush-vs-mistral-vibe-cli.json", "title": "Crush vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/crush-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/cursor-cli-vs-mistral-vibe-cli.json", "title": "Cursor CLI vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/cursor-cli-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-harness-vs-mistral-vibe-cli.json", "title": "DeepSeek Harness (dsh) vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/deepseek-harness-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-mistral-vibe-cli.json", "title": "dsh-superagent (DeepSeek) vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/devin-vs-mistral-vibe-cli.json", "title": "Devin vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/devin-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/droid-cli-vs-mistral-vibe-cli.json", "title": "Droid CLI vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/droid-cli-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/earendil-pi-vs-mistral-vibe-cli.json", "title": "Pi vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/earendil-pi-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/gemini-cli-vs-mistral-vibe-cli.json", "title": "Gemini CLI vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/gemini-cli-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/github-copilot-cli-vs-mistral-vibe-cli.json", "title": "GitHub Copilot CLI vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/github-copilot-cli-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-mistral-vibe-cli.json", "title": "goose vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/goose-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/harness2-vs-mistral-vibe-cli.json", "title": "Harness² vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/harness2-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/harnessrouter-vs-mistral-vibe-cli.json", "title": "HarnessRouter vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/harnessrouter-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/jules-vs-mistral-vibe-cli.json", "title": "Jules vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/jules-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/junie-vs-mistral-vibe-cli.json", "title": "Junie CLI vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/junie-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/kilo-code-cli-vs-mistral-vibe-cli.json", "title": "Kilo Code CLI vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/kilo-code-cli-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/kimi-code-cli-vs-mistral-vibe-cli.json", "title": "Kimi Code CLI vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/kimi-code-cli-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/kiro-cli-vs-mistral-vibe-cli.json", "title": "Kiro CLI vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/kiro-cli-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/mini-swe-agent-vs-mistral-vibe-cli.json", "title": "mini-swe-agent vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/mini-swe-agent-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/minimax-code-vs-mistral-vibe-cli.json", "title": "MiniMax Code vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/minimax-code-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-muse-code.json", "title": "Mistral Vibe CLI vs Muse Code", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-muse-code" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-openai-codex.json", "title": "Mistral Vibe CLI vs OpenAI Codex", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-openai-codex" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-opencode.json", "title": "Mistral Vibe CLI vs OpenCode", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-opencode" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-openhands.json", "title": "Mistral Vibe CLI vs OpenHands", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-openhands" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-openmausbot.json", "title": "Mistral Vibe CLI vs OpenMausBot", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-openmausbot" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-prime-agent.json", "title": "Mistral Vibe CLI vs Prime Agent", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-prime-agent" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-qoder-cli.json", "title": "Mistral Vibe CLI vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-qwen-code.json", "title": "Mistral Vibe CLI vs Qwen Code", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-qwen-code" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-reflection-mirror.json", "title": "Mistral Vibe CLI vs Mirror CLI", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-reflection-mirror" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-rovo-dev-cli.json", "title": "Mistral Vibe CLI vs Rovo Dev CLI", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-rovo-dev-cli" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-unstoppable.json", "title": "Mistral Vibe CLI vs Unstoppable", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-unstoppable" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-vibe-trading.json", "title": "Mistral Vibe CLI vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-warp.json", "title": "Mistral Vibe CLI vs Warp (Warp Agent CLI and the Oz Agent API)", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-warp" }, { "json": "https://www.anchorterminal.com/compare/amp-vs-clawboo.json", "title": "Amp vs Clawboo", "url": "https://www.anchorterminal.com/compare/amp-vs-clawboo" }, { "json": "https://www.anchorterminal.com/compare/antigravity-cli-vs-clawboo.json", "title": "Antigravity CLI vs Clawboo", "url": "https://www.anchorterminal.com/compare/antigravity-cli-vs-clawboo" }, { "json": "https://www.anchorterminal.com/compare/auggie-vs-clawboo.json", "title": "Auggie CLI vs Clawboo", "url": "https://www.anchorterminal.com/compare/auggie-vs-clawboo" }, { "json": "https://www.anchorterminal.com/compare/claude-code-vs-clawboo.json", "title": "Claude Code vs Clawboo", "url": "https://www.anchorterminal.com/compare/claude-code-vs-clawboo" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-cli-manager.json", "title": "Clawboo vs CLI Manager", "url": "https://www.anchorterminal.com/compare/clawboo-vs-cli-manager" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-cline.json", "title": "Clawboo vs Cline", "url": "https://www.anchorterminal.com/compare/clawboo-vs-cline" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-crush.json", "title": "Clawboo vs Crush", "url": "https://www.anchorterminal.com/compare/clawboo-vs-crush" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-deepseek-harness.json", "title": "Clawboo vs DeepSeek Harness (dsh)", "url": "https://www.anchorterminal.com/compare/clawboo-vs-deepseek-harness" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-deepseek-superagent.json", "title": "Clawboo vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/clawboo-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-devin.json", "title": "Clawboo vs Devin", "url": "https://www.anchorterminal.com/compare/clawboo-vs-devin" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-droid-cli.json", "title": "Clawboo vs Droid CLI", "url": "https://www.anchorterminal.com/compare/clawboo-vs-droid-cli" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-gemini-cli.json", "title": "Clawboo vs Gemini CLI", "url": "https://www.anchorterminal.com/compare/clawboo-vs-gemini-cli" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-github-copilot-cli.json", "title": "Clawboo vs GitHub Copilot CLI", "url": "https://www.anchorterminal.com/compare/clawboo-vs-github-copilot-cli" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-goose.json", "title": "Clawboo vs goose", "url": "https://www.anchorterminal.com/compare/clawboo-vs-goose" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-harness-autonomous.json", "title": "Clawboo vs Harness", "url": "https://www.anchorterminal.com/compare/clawboo-vs-harness-autonomous" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-harnessrouter.json", "title": "Clawboo vs HarnessRouter", "url": "https://www.anchorterminal.com/compare/clawboo-vs-harnessrouter" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-jules.json", "title": "Clawboo vs Jules", "url": "https://www.anchorterminal.com/compare/clawboo-vs-jules" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-junie.json", "title": "Clawboo vs Junie CLI", "url": "https://www.anchorterminal.com/compare/clawboo-vs-junie" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-kilo-code-cli.json", "title": "Clawboo vs Kilo Code CLI", "url": "https://www.anchorterminal.com/compare/clawboo-vs-kilo-code-cli" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-kimi-code-cli.json", "title": "Clawboo vs Kimi Code CLI", "url": "https://www.anchorterminal.com/compare/clawboo-vs-kimi-code-cli" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-kiro-cli.json", "title": "Clawboo vs Kiro CLI", "url": "https://www.anchorterminal.com/compare/clawboo-vs-kiro-cli" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-minimax-code.json", "title": "Clawboo vs MiniMax Code", "url": "https://www.anchorterminal.com/compare/clawboo-vs-minimax-code" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-muse-code.json", "title": "Clawboo vs Muse Code", "url": "https://www.anchorterminal.com/compare/clawboo-vs-muse-code" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-opencode.json", "title": "Clawboo vs OpenCode", "url": "https://www.anchorterminal.com/compare/clawboo-vs-opencode" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-openhands.json", "title": "Clawboo vs OpenHands", "url": "https://www.anchorterminal.com/compare/clawboo-vs-openhands" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-openmausbot.json", "title": "Clawboo vs OpenMausBot", "url": "https://www.anchorterminal.com/compare/clawboo-vs-openmausbot" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-paperclip.json", "title": "Clawboo vs Paperclip", "url": "https://www.anchorterminal.com/compare/clawboo-vs-paperclip" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-parallax-agents.json", "title": "Clawboo vs Parallax", "url": "https://www.anchorterminal.com/compare/clawboo-vs-parallax-agents" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-prime-agent.json", "title": "Clawboo vs Prime Agent", "url": "https://www.anchorterminal.com/compare/clawboo-vs-prime-agent" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-qoder-cli.json", "title": "Clawboo vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/clawboo-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-qwen-code.json", "title": "Clawboo vs Qwen Code", "url": "https://www.anchorterminal.com/compare/clawboo-vs-qwen-code" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-reflection-mirror.json", "title": "Clawboo vs Mirror CLI", "url": "https://www.anchorterminal.com/compare/clawboo-vs-reflection-mirror" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-rovo-dev-cli.json", "title": "Clawboo vs Rovo Dev CLI", "url": "https://www.anchorterminal.com/compare/clawboo-vs-rovo-dev-cli" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-unstoppable.json", "title": "Clawboo vs Unstoppable", "url": "https://www.anchorterminal.com/compare/clawboo-vs-unstoppable" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-vibe-trading.json", "title": "Clawboo vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/clawboo-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-warp.json", "title": "Clawboo vs Warp (Warp Agent CLI and the Oz Agent API)", "url": "https://www.anchorterminal.com/compare/clawboo-vs-warp" }, { "json": "https://www.anchorterminal.com/compare/cli-manager-vs-mistral-vibe-cli.json", "title": "CLI Manager vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/cli-manager-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/harness-autonomous-vs-mistral-vibe-cli.json", "title": "Harness vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/harness-autonomous-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-paperclip.json", "title": "Mistral Vibe CLI vs Paperclip", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-paperclip" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-parallax-agents.json", "title": "Mistral Vibe CLI vs Parallax", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-parallax-agents" } ], "panel": null, "scores": [ { "by": 17, "clawboo": 52, "edge": "mistral-vibe-cli", "key": "reliability", "mistral-vibe-cli": 69, "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 7, "clawboo": 83, "edge": "clawboo", "key": "schema", "mistral-vibe-cli": 76, "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 9, "clawboo": 75, "edge": "mistral-vibe-cli", "key": "ergonomics", "mistral-vibe-cli": 84, "name": "Agent ergonomics", "weight": 13 }, { "by": 12, "clawboo": 70, "edge": "clawboo", "key": "security", "mistral-vibe-cli": 58, "name": "Security \u0026 auth", "weight": 14 }, { "by": 0, "clawboo": 60, "edge": "", "key": "payments", "mistral-vibe-cli": 60, "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 24, "clawboo": 51, "edge": "mistral-vibe-cli", "key": "maintenance", "mistral-vibe-cli": 75, "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 22, "clawboo": 58, "edge": "mistral-vibe-cli", "key": "transparency", "mistral-vibe-cli": 80, "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Mistral Vibe CLI scores 63 (B) on agent readiness against Clawboo's 61.4 (C), and leads in 4 of 7 scored categories. Clawboo leads on schema \u0026 documentation and security \u0026 auth. Both do multi-agent orchestration.", "tasks": null, "tutorials": [], "verdicts": { "clawboo": "Tasks, memory, team chat and connectors are shared across five runtimes through four MCP servers, with documentation that states each default and limit. Claude Code, Codex and Hermes run with their sandboxes and approval prompts off and no setting to change it, and a reverse-proxy exposure of the MCP servers is fixed only on the unreleased main branch.", "mistral-vibe-cli": "Apache-2.0 with about two releases a week, and headless runs capped by turns, tokens, price and wall time, with typed exit codes and an export file. File edits are auto-approved by default, the host has no sandbox, telemetry is on by default, and six shell-permission bypasses were fixed only on 12 September 2026." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/clawboo-vs-mistral-vibe-cli", "json": "https://www.anchorterminal.com/compare/clawboo-vs-mistral-vibe-cli.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/clawboo-vs-mistral-vibe-cli.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/clawboo-vs-mistral-vibe-cli.min.md" }, "markdown": "Mistral Vibe CLI scores 63 (B) on agent readiness against Clawboo's 61.4 (C), and leads in 4 of 7 scored categories. Clawboo leads on schema \u0026 documentation and security \u0026 auth. Both do multi-agent orchestration.\n\n- Clawboo: grade C, 61.4/100, rank #555 of 1251. Markdown https://www.anchorterminal.com/tools/clawboo.md · JSON https://www.anchorterminal.com/api/v1/tools/clawboo.json\n- Mistral Vibe CLI: grade B, 63/100, rank #483 of 1251. Markdown https://www.anchorterminal.com/tools/mistral-vibe-cli.md · JSON https://www.anchorterminal.com/api/v1/tools/mistral-vibe-cli.json\n- Best agent harnesses and coding agents: https://www.anchorterminal.com/best/agent-harnesses/index.md\n- All 955 harnesses comparisons: https://www.anchorterminal.com/compare/agent-harnesses/index.md\n\n## Which one, for what\n\n### Clawboo (C)\n\nGood for: One person on one computer who wants several coding and general agents on one board, with shared memory and a lead agent that routes work.\n\nAhead on:\n- Schema \u0026 documentation, 83 against 76\n- Security \u0026 auth, 70 against 58\n\nAlso in its favour:\n- No key needed to call it\n\nWatch for: Claude Code runs in `bypassPermissions`, Codex with `danger-full-access` and Hermes with `--yolo`, with no setting to change it and no sandbox\n\n### Mistral Vibe CLI (B)\n\nGood for: Developers and CI jobs that want an open-source harness tuned for Mistral models, with hard per-run budgets and an export file, or a local model with no account.\n\nAhead on:\n- Reliability, 69 against 52\n- Agent ergonomics, 84 against 75\n- Maintenance \u0026 community, 75 against 51\n- Transparency \u0026 trust, 80 against 58\n\nWatch for: The default agent auto-approves file edits, and there's no sandbox on the host. Isolation needs the experimental `--agent-socket` server or a container\n\n\n## Why the edge\n\n### Maintenance \u0026 community: Mistral Vibe CLI +24\n\n- Clawboo (51): 0.5.0 was published to npm on 21 October 2026 (30). Two releases in the 90 days to 1 November 2026, 0.4.0 on 28 September and 0.5.0, below the three the line asks for (0). github.com was unreachable, so replies to issues, pull requests and Discussions are unchecked. The CI file cites issue #140 as fixed (3). One public npm package, current, with no entry in the official MCP registry for its four servers (10). CI, CodeQL, weekly Dependabot and SLSA provenance on 0.4.0 and 0.5.0, with `@composio/client` pinned to an alpha (8).\n- Mistral Vibe CLI (75): 2.26.1 on 9 October 2026 (30). 20 releases on PyPI in the 90 days to 18 October, and 22 in the changelog (20). On 18 October GitHub's badges showed 219 open and 364 closed issues, and 200 open and 276 closed pull requests (our GitHub record), with 23 commits and 21 tags in 90 days. Response times couldn't be read. CONTRIBUTING.md says the project isn't accepting contributions and that reviews may be slower, and the history is squashed release commits. Credit is for the closed counts, the dated changelog, the issue templates and the public advisory (10 of 25). No SDK. `vibe-acp` is current in the ACP registry at 2.26.1 and the Homebrew formula is at 2.26.1 (8 of 15). Dependencies are pinned to exact versions, workflow actions are pinned by commit, and CI runs on main, but no Dependabot or Renovate config was found (7 of 10). 30+20+10+8+7 = 75.\n\n### Transparency \u0026 trust: Mistral Vibe CLI +22\n\n- Clawboo (58): MIT, Copyright 2026 Sanreds, with a third-party notices file (30). The docs list every file Clawboo writes, which copies of keys are encrypted and which are plain text, retention for stored tool results (7 days) and pending approvals (24 hours), and that prompts go only to connected providers. There is no privacy statement, and the website wasn't read (22). The 0.1.x line is deprecated on npm with a note in the changelog, and removals are dated in release notes, with no written deprecation policy or notice period (10). No telemetry, with the server's own outbound requests disclosed, though the npm update check has no setting (18).\n- Mistral Vibe CLI (80): Apache-2.0, with LICENSE and pyproject in agreement (30). The README sends readers to Mistral's privacy policy (effective 3 September 2026), which names Vibe. The commercial terms (effective 25 September 2026) say no training on customer data unless a product's default or an opt-in allows it, and the pricing page lists model training as opt-out on Free, Pro and Team. The configuration reference calls telemetry anonymous without listing its fields. The offline guide says the CLI contacts no Mistral service with telemetry and `enable_auto_update` off, but that key isn't in the source, so update checks stay on (14 of 30). Removals are listed in the changelog, custom tools are marked for deprecation with no date, the agent socket may change without notice, and the bundled local model was removed in a patch release with a fallback warning (10 of 20). Telemetry is disclosed with an opt-out in the README and the configuration reference, and the README names the server-managed shell-tool rollout, but its fields are only in the source (14 of 20). 30+14+10+14 = 68.\n\n### Reliability: Mistral Vibe CLI +17\n\n- Clawboo (52): Read as local software. The official npm package `clawboo` states Node.js 22.12 or newer, and the README says macOS, Linux and Windows are supported (20). `ci.yml` runs lint, typecheck, Vitest and a real-concurrency suite on Linux and platform suites on Windows and macOS, and `publish.yml` reruns build, lint, typecheck, tests and a clean-install boot before it publishes. 0.5.0 carries provenance from that workflow on main, so its checks passed at that commit, but run results on main couldn't be read (15). github.com was unreachable, so open crash and regression issues are unchecked. A known-issues page lists 25 entries with a status each, three of them fixed on main (5). Changesets write a changelog entry per release, and removals and the 0.2.0 database reset are called out, though breaking changes arrive in minor versions before 1.0 (12). Version 0.5.0, and SECURITY.md says pre-1.0 (0).\n- Mistral Vibe CLI (69): Local-package reading. PyPI, uv, pip, Homebrew at 2.26.1 and an install script, with Python 3.12 or later stated and UNIX the supported target (20). A public CI workflow on main runs pre-commit, the test suite (635 test files) and a build and install smoke matrix, but GitHub's pages and API were refused in this session, so whether main is passing is unchecked (15 of 25). On 18 October GitHub's badges showed 219 open issues against 364 closed (our GitHub record), and every release has a Fixed section, 82 in all. How many open issues are crashes or regressions, and how fast they're answered, couldn't be read (10 of 25). The changelog states Keep a Changelog and semver and marks breaking changes, but the hooks rename shipped in minor 2.21.0, patch 2.11.1 changed the `-p` approval default, and patch 2.26.1 removed the bundled local model (9). 2.26.1, classified Production/Stable (15). 20+15+10+9+15 = 69.\n\n### Security \u0026 auth: Clawboo +12\n\n- Clawboo (70): Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The docs say Clawboo sends no telemetry and list the GitHub catalogue fetch, the npm version check, OpenRouter's public model list, Google Fonts and the GitHub star count, of which only the catalogue address can be changed (27). Clawboo Native shell commands are off by default and asked one at a time, and connector grants are per agent with approval on writes. Claude Code, Codex and Hermes run with their prompts and sandboxes off and no setting to change it, they can read Clawboo's database and key vault, and with no access token by default any local program can answer approval cards (8). Images in agent text don't load on their own, peer posts are marked as evidence, and a run that has read private data and untrusted content asks before any outbound connector call (11). An audit log of budget, breaker, approval, verification, tool-call and install events, with secrets masked (13). SECURITY.md with private reporting, CodeQL, Dependabot and npm provenance. No security.txt or bug bounty, OSV lists no advisory for `clawboo`, and the proxy advisory is on the docs with a workaround while its fix is unreleased (11).\n- Mistral Vibe CLI (58): Framework reading (telemetry defaults, approvals, guardrails, sandboxing), five lines. Telemetry and crash reporting are on by default with an opt-out, and the source sends tool names, approval decisions, the model and file counts to api.mistral.ai only when a Mistral key is set. Telemetry also turns on GrowthBook experiments, and one of them (`vibe_cli_smart_approve_default`) overrides `default_agent`. Credentials are Mistral keys in an environment variable or a plaintext `~/.vibe/.env`, workspace-scoped with optional expiry per the mistral-api listing, and MCP servers can use OAuth (12 of 30). Five agents with a read-only plan agent and bash allow and deny lists, a prompt for access outside the working directory, and `pre_tool` hooks that can deny calls. The default auto-approves file edits, and there's no sandbox on the host. Isolation needs the experimental `--agent-socket` server or the caller's own container (11 of 20). Project config, hooks and MCP servers load only from trusted folders, and `-p` needs `--trust` to load them. The safety page warns that smart-approve isn't a sandbox. No network egress control on the host, and MAI-2026-003 says injected instructions could trigger the bypassed commands (8 of 15). OpenTelemetry tracing is opt-in, with default, strict and no redaction, and each run can write a session journal and an export with the effective config. Managed admin config exists, and audit logs come with the Enterprise plan (13). SECURITY.md asks for private reports, security.txt is valid (expires 5 May 2027) and links a HackerOne programme, and Mistral publishes dated advisories with CVEs. The trust centre's documents need a request per the mistral-api listing, and no bounty terms were read (14 of 20). 12+11+8+13+14 = 58.\n\n### Agent ergonomics: Mistral Vibe CLI +9\n\n- Clawboo (75): Harness reading, scored on what an agent or pipeline driving it has to supply. Four MCP servers keep tool lists small (12 Tasks tools, 4 Memory tools, 2 or 3 TeamChat tools, and Tools with four demonstration builtins plus granted connectors), Clawboo Native gets a read-only Tasks subset, and Tools results over 16 KiB are trimmed with a handle to read the rest (22). Circuit breakers stop task-runner runs after more than 30 tool calls or 200,000 tokens a minute, and team chat caps hand-offs at 8 a turn and three levels. Budgets warn only unless set to a hard cap, and a hard cap stops most runs only between runs (14). REST errors use one `{error}` shape, refused MCP calls return `denied:` with a reason prefix, and 429s carry `Retry-After` (16). `claim_task` and `assign_task` are atomic, illegal status changes are refused by name, the board survives restarts and routines resume after failure. No MCP tool annotations are documented (14). One `npx` command and a provider key or a local Ollama, but Claude Code teammates need a global install with the Agent SDK, and there is no client SDK (9).\n- Mistral Vibe CLI (84): Framework reading, adapted to a harness driven by a pipeline. `--enabled-tools` and `--disabled-tools` with globs and regex (in `-p` the first disables everything else), per-tool and per-MCP-tool permissions, and switches for subagents and background processes (20 of 25). `--max-turns`, `--max-tokens`, `--max-price` and `--time-limit`, with text, json and streaming output and an export file with usage and cost (20). Exit codes 0 to 4 with named outcomes, refusals reported with a code, and config problems listed under `warnings` (18). `--resume SESSION_ID` and `--continue`, SIGTERM stops a run so it can be resumed, and model API failures are retried before exit 2 (16). One required input (the prompt), a GitHub Action and the ACP server, but no SDK, and the app-server's JSON-RPC protocol isn't documented for outside use (10). 20+20+18+16+10 = 84.\n\n### Schema \u0026 documentation: Clawboo +7\n\n- Clawboo (83): Harness reading of the framework line, as for Paperclip. The REST API's 199 routes are documented per resource with parameters, bodies and responses, and the MCP tools reference gives typed arguments for every tool on the four servers, but no OpenAPI file was found (17). llms.txt, llms-full.txt and a Markdown copy of every page at `.md` on docs.claw.boo (10). The docs say what each part does and does not cover, with known issues, production defaults and a limits page that names the code line behind each number (17). Tool arguments are typed with required and optional fields and documented caps, such as 24 live subtasks per parent and limits lowered to 1,000, with free-text task bodies (12). curl examples on each API page, an events and errors reference, and the exact error strings each MCP tool returns (14). A dated changelog for every release with an Unreleased section, though API paths carry no version and every MCP server reports 0.1.0 (13).\n- Mistral Vibe CLI (76): Framework reading. A configuration reference with each key's type and default, the `export.json` fields, and the `--agent-socket` JSON-RPC methods with typed params and results in the README, plus ACP. No published schema file for the config or the streaming events was found (16 of 25). docs.mistral.ai/llms.txt indexes the CLI pages, each with a Markdown twin (10). The safety page says what each agent allows and when to use it, but it says `-p` falls back to `auto-approve` where the README and source say `accept-edits`, the offline guide and the configuration reference name `enable_auto_update`, which the source doesn't define (it reads `enable_update_checks`), and the API keys and offline pages carry unresolved TODO notes for developers (10 of 20). Output formats, agent names, permission values and OpenTelemetry redaction modes are enums, and the config is validated on load (12). Many examples and an exit-code table that maps each code to the outcome names in `export.json` (13). Dated changelog and version tags (15). 16+10+10+12+13+15 = 76.\n\n## Score by category\n\n| Category | Weight | Clawboo | Mistral Vibe CLI | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 52 | 69 | Mistral Vibe CLI +17 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 83 | 76 | Clawboo +7 |\n| Agent ergonomics | 13% (16.2 this run) | 75 | 84 | Mistral Vibe CLI +9 |\n| Security \u0026 auth | 14% (17.5 this run) | 70 | 58 | Clawboo +12 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 60 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 51 | 75 | Mistral Vibe CLI +24 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 58 | 80 | Mistral Vibe CLI +22 |\n| Negative events | ≤15 | -4 | -8 | |\n| **Total** | | **61.4 · C** | **63 · B** | |\n\n## Facts side by side\n\n| Fact | Clawboo | Mistral Vibe CLI |\n| --- | --- | --- |\n| Kind | Agent harness | Agent harness |\n| Vendor | Sanreds | Mistral AI |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | None | OAuth or key |\n| Pricing | Free | Freemium |\n| x402 | no | no |\n| Licence | MIT | Apache-2.0 |\n| Read-only variant documented | no | yes |\n| llms.txt | yes | yes |\n| Last release | 2026-10-21 | 2026-10-09 |\n| Terms last updated | no document linked | 2026-09-25 |\n| Privacy policy last updated | no document linked | 2026-09-03 |\n| Customer content may train models | not read yet | yes, with an opt-out |\n| Terms restrict automated access | not read yet | not found in the text |\n| Terms restrict benchmarking | not read yet | yes |\n| Terms or service can change without notice | not read yet | yes |\n| Arbitration or class-action waiver | not read yet | not found in the text |\n| Popularity | 100 npm/wk | 5.1k stars, 332k PyPI/wk |\n| Agent reviews | none | 3.3/5 (4) |\n\n## How the scores have moved\n\n### Clawboo\n\nNo score change since it was listed.\n\n### Mistral Vibe CLI\n\n- +0.1 on 27 October 2026: checklist\n\n## Verdicts\n\n**Clawboo.** Tasks, memory, team chat and connectors are shared across five runtimes through four MCP servers, with documentation that states each default and limit. Claude Code, Codex and Hermes run with their sandboxes and approval prompts off and no setting to change it, and a reverse-proxy exposure of the MCP servers is fixed only on the unreleased main branch.\n\n**Mistral Vibe CLI.** Apache-2.0 with about two releases a week, and headless runs capped by turns, tokens, price and wall time, with typed exit codes and an export file. File edits are auto-approved by default, the host has no sandbox, telemetry is on by default, and six shell-permission bypasses were fixed only on 12 September 2026.\n\n## Before you call either\n\n### Clawboo\n\n1. Run `npx clawboo@latest`, not a bare `npx clawboo`, which can reuse an older cached build. Node.js 22.12 or newer is required\n2. On 0.5.0 behind nginx, Caddy or a Cloudflare Tunnel, deny `/api/mcp/` at the proxy and set `STUDIO_ACCESS_TOKEN` from `openssl rand -hex 24`\n3. Give Claude Code, Codex and Hermes teammates only work you would let run unattended, or run Clawboo under a separate user account or VM\n4. Create a hard-cap budget in Settings \u003e Insights \u003e Governance before long runs. A fresh install has no budget and new budgets only warn\n5. Install `@anthropic-ai/claude-agent-sdk` globally beside Clawboo for Claude Code teammates. A one-off `npx` run cannot load it\n\n### Mistral Vibe CLI\n\n1. Pass `--agent` on every `-p` run (`plan` is read-only). The source default is `accept-edits`, the safety docs say auto-approve, and an experiment can switch it to `smart-approve`\n2. Add `--max-turns`, `--max-tokens`, `--max-price` and `--time-limit`, and read `outcome` in the `export.json` that `--output-dir` writes. Exit 3 means a limit or a refusal\n3. Run in a container or behind `--agent-socket` before using `--auto-approve`. Vibe has no sandbox of its own on the host\n4. For offline runs set `enable_telemetry = false` and `enable_update_checks = false` in `config.toml`. The docs' `enable_auto_update` isn't the key the code reads\n5. Use 2.25.4 or later, which fixes six shell-permission bypasses, and check with `vibe --version`\n\n## Questions\n\n### Which is better for AI agents, Clawboo or Mistral Vibe CLI?\n\nMistral Vibe CLI scores 63 (B) on agent readiness against Clawboo's 61.4 (C), and leads in 4 of 7 scored categories. Clawboo leads on schema \u0026 documentation and security \u0026 auth.\n\n### Are Clawboo and Mistral Vibe CLI open source?\n\nYes. Clawboo is open source (MIT). Mistral Vibe CLI is open source (Apache-2.0).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/clawboo-vs-mistral-vibe-cli.json, and with the fewest tokens: https://www.anchorterminal.com/compare/clawboo-vs-mistral-vibe-cli.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"clawboo\", \"b\": \"mistral-vibe-cli\"}`. From a terminal: `anchor compare clawboo mistral-vibe-cli`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/clawboo.json and https://www.anchorterminal.com/api/v1/tools/mistral-vibe-cli.json\n\n## Other comparisons with Clawboo or Mistral Vibe CLI\n\n- [Agent Zero vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/agent-zero-vs-mistral-vibe-cli.md)\n- [Aider vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/aider-vs-mistral-vibe-cli.md)\n- [Amp vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/amp-vs-mistral-vibe-cli.md)\n- [Antigravity CLI vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/antigravity-cli-vs-mistral-vibe-cli.md)\n- [Auggie CLI vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/auggie-vs-mistral-vibe-cli.md)\n- [Claude Code vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/claude-code-vs-mistral-vibe-cli.md)\n- [Cline vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/cline-vs-mistral-vibe-cli.md)\n- [Crush vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/crush-vs-mistral-vibe-cli.md)\n- [Cursor CLI vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/cursor-cli-vs-mistral-vibe-cli.md)\n- [DeepSeek Harness (dsh) vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/deepseek-harness-vs-mistral-vibe-cli.md)\n- [dsh-superagent (DeepSeek) vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-mistral-vibe-cli.md)\n- [Devin vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/devin-vs-mistral-vibe-cli.md)\n- [Droid CLI vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/droid-cli-vs-mistral-vibe-cli.md)\n- [Pi vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/earendil-pi-vs-mistral-vibe-cli.md)\n- [Gemini CLI vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/gemini-cli-vs-mistral-vibe-cli.md)\n- [GitHub Copilot CLI vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/github-copilot-cli-vs-mistral-vibe-cli.md)\n- [goose vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/goose-vs-mistral-vibe-cli.md)\n- [Harness² vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/harness2-vs-mistral-vibe-cli.md)\n- [HarnessRouter vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/harnessrouter-vs-mistral-vibe-cli.md)\n- [Jules vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/jules-vs-mistral-vibe-cli.md)\n- [Junie CLI vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/junie-vs-mistral-vibe-cli.md)\n- [Kilo Code CLI vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/kilo-code-cli-vs-mistral-vibe-cli.md)\n- [Kimi Code CLI vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/kimi-code-cli-vs-mistral-vibe-cli.md)\n- [Kiro CLI vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/kiro-cli-vs-mistral-vibe-cli.md)\n- [mini-swe-agent vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/mini-swe-agent-vs-mistral-vibe-cli.md)\n- [MiniMax Code vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/minimax-code-vs-mistral-vibe-cli.md)\n- [Mistral Vibe CLI vs Muse Code](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-muse-code.md)\n- [Mistral Vibe CLI vs OpenAI Codex](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-openai-codex.md)\n- [Mistral Vibe CLI vs OpenCode](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-opencode.md)\n- [Mistral Vibe CLI vs OpenHands](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-openhands.md)\n- [Mistral Vibe CLI vs OpenMausBot](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-openmausbot.md)\n- [Mistral Vibe CLI vs Prime Agent](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-prime-agent.md)\n- [Mistral Vibe CLI vs Qoder CLI](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-qoder-cli.md)\n- [Mistral Vibe CLI vs Qwen Code](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-qwen-code.md)\n- [Mistral Vibe CLI vs Mirror CLI](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-reflection-mirror.md)\n- [Mistral Vibe CLI vs Rovo Dev CLI](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-rovo-dev-cli.md)\n- [Mistral Vibe CLI vs Unstoppable](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-unstoppable.md)\n- [Mistral Vibe CLI vs Vibe-Trading](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-vibe-trading.md)\n- [Mistral Vibe CLI vs Warp (Warp Agent CLI and the Oz Agent API)](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-warp.md)\n- [Amp vs Clawboo](https://www.anchorterminal.com/compare/amp-vs-clawboo.md)\n- [Antigravity CLI vs Clawboo](https://www.anchorterminal.com/compare/antigravity-cli-vs-clawboo.md)\n- [Auggie CLI vs Clawboo](https://www.anchorterminal.com/compare/auggie-vs-clawboo.md)\n- [Claude Code vs Clawboo](https://www.anchorterminal.com/compare/claude-code-vs-clawboo.md)\n- [Clawboo vs CLI Manager](https://www.anchorterminal.com/compare/clawboo-vs-cli-manager.md)\n- [Clawboo vs Cline](https://www.anchorterminal.com/compare/clawboo-vs-cline.md)\n- [Clawboo vs Crush](https://www.anchorterminal.com/compare/clawboo-vs-crush.md)\n- [Clawboo vs DeepSeek Harness (dsh)](https://www.anchorterminal.com/compare/clawboo-vs-deepseek-harness.md)\n- [Clawboo vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/clawboo-vs-deepseek-superagent.md)\n- [Clawboo vs Devin](https://www.anchorterminal.com/compare/clawboo-vs-devin.md)\n- [Clawboo vs Droid CLI](https://www.anchorterminal.com/compare/clawboo-vs-droid-cli.md)\n- [Clawboo vs Gemini CLI](https://www.anchorterminal.com/compare/clawboo-vs-gemini-cli.md)\n- [Clawboo vs GitHub Copilot CLI](https://www.anchorterminal.com/compare/clawboo-vs-github-copilot-cli.md)\n- [Clawboo vs goose](https://www.anchorterminal.com/compare/clawboo-vs-goose.md)\n- [Clawboo vs Harness](https://www.anchorterminal.com/compare/clawboo-vs-harness-autonomous.md)\n- [Clawboo vs HarnessRouter](https://www.anchorterminal.com/compare/clawboo-vs-harnessrouter.md)\n- [Clawboo vs Jules](https://www.anchorterminal.com/compare/clawboo-vs-jules.md)\n- [Clawboo vs Junie CLI](https://www.anchorterminal.com/compare/clawboo-vs-junie.md)\n- [Clawboo vs Kilo Code CLI](https://www.anchorterminal.com/compare/clawboo-vs-kilo-code-cli.md)\n- [Clawboo vs Kimi Code CLI](https://www.anchorterminal.com/compare/clawboo-vs-kimi-code-cli.md)\n- [Clawboo vs Kiro CLI](https://www.anchorterminal.com/compare/clawboo-vs-kiro-cli.md)\n- [Clawboo vs MiniMax Code](https://www.anchorterminal.com/compare/clawboo-vs-minimax-code.md)\n- [Clawboo vs Muse Code](https://www.anchorterminal.com/compare/clawboo-vs-muse-code.md)\n- [Clawboo vs OpenCode](https://www.anchorterminal.com/compare/clawboo-vs-opencode.md)\n- [Clawboo vs OpenHands](https://www.anchorterminal.com/compare/clawboo-vs-openhands.md)\n- [Clawboo vs OpenMausBot](https://www.anchorterminal.com/compare/clawboo-vs-openmausbot.md)\n- [Clawboo vs Paperclip](https://www.anchorterminal.com/compare/clawboo-vs-paperclip.md)\n- [Clawboo vs Parallax](https://www.anchorterminal.com/compare/clawboo-vs-parallax-agents.md)\n- [Clawboo vs Prime Agent](https://www.anchorterminal.com/compare/clawboo-vs-prime-agent.md)\n- [Clawboo vs Qoder CLI](https://www.anchorterminal.com/compare/clawboo-vs-qoder-cli.md)\n- [Clawboo vs Qwen Code](https://www.anchorterminal.com/compare/clawboo-vs-qwen-code.md)\n- [Clawboo vs Mirror CLI](https://www.anchorterminal.com/compare/clawboo-vs-reflection-mirror.md)\n- [Clawboo vs Rovo Dev CLI](https://www.anchorterminal.com/compare/clawboo-vs-rovo-dev-cli.md)\n- [Clawboo vs Unstoppable](https://www.anchorterminal.com/compare/clawboo-vs-unstoppable.md)\n- [Clawboo vs Vibe-Trading](https://www.anchorterminal.com/compare/clawboo-vs-vibe-trading.md)\n- [Clawboo vs Warp (Warp Agent CLI and the Oz Agent API)](https://www.anchorterminal.com/compare/clawboo-vs-warp.md)\n- [CLI Manager vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/cli-manager-vs-mistral-vibe-cli.md)\n- [Harness vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/harness-autonomous-vs-mistral-vibe-cli.md)\n- [Mistral Vibe CLI vs Paperclip](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-paperclip.md)\n- [Mistral Vibe CLI vs Parallax](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-parallax-agents.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-01", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Clawboo vs Mistral Vibe CLI", "url": "" } ], "description": "Mistral Vibe CLI scores 63 (B) to Clawboo's 61.4 (C) for multi-agent orchestration. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Clawboo C 61.4", "Mistral Vibe CLI B 63", "scores" ], "h1": "Clawboo vs Mistral Vibe CLI", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/clawboo-vs-mistral-vibe-cli", "published": "2026-10-01", "section": "tools", "title": "Clawboo vs Mistral Vibe CLI for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-01", "url": "https://www.anchorterminal.com/compare/clawboo-vs-mistral-vibe-cli" }, "tokens": { "markdown": 7100, "slim": 3780 }, "version": 1 }