{ "data": { "a": { "slug": "deepseek-superagent", "name": "dsh-superagent (DeepSeek)", "vendor": "DeepSeek", "vendorUrl": "https://github.com/deepseek-ai/dsh-superagent-prototype", "kind": "harness", "category": "agent-harnesses", "summary": "dsh-superagent is DeepSeek's MIT-licensed research prototype of a proactive coding agent for one GitHub repository, run as a DeepSeek Harness bundle. A main Session admits requests from allowed people and parallel Executor Sessions work them into pull requests.", "url": "https://www.anchorterminal.com/tools/deepseek-superagent", "markdownUrl": "https://www.anchorterminal.com/tools/deepseek-superagent.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/deepseek-superagent.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/deepseek-superagent.json", "dns": "deepseek-superagent.grade.anchorterminal.com", "repo": "https://github.com/deepseek-ai/dsh-superagent-prototype", "license": "MIT", "transports": [], "packages": [], "auth": "pat", "authNotes": "No account with the project. The agent acts through a dedicated GitHub user account signed in to a `gh` wrapper with `auth login`, and optionally a Feishu bot through `lark-cli`. DSH needs a model provider key. The local Management API takes no credential and accepts only loopback requests with `x-orchestrator-request: 1`.", "pricing": "free", "pricingNotes": "Free and MIT, with nothing to buy. The operator pays the model provider DSH is set up with, usually DeepSeek's API, for a main Session and one Session per Ticket.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the README, SETUP.md or docs/000 to 008 (checked 2026-11-01).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-01" }, "docsUrl": "https://github.com/deepseek-ai/dsh-superagent-prototype/tree/main/docs", "capabilities": [ "agent.harness", "agent.multi-agent" ], "tags": [ "official", "harness", "coding-agent", "open-source", "mit", "typescript", "local", "free", "no-card", "pre-1.0", "preview", "telemetry-default-on" ], "lastRelease": "2026-10-31", "graded": true, "anchor": { "graded": true, "score": 42.1, "grade": "E", "agentReady": false, "rank": 1108, "ranked": true, "rankOf": 1251, "categoryRank": 41, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 67, "maintenance": 34, "payments": 40, "reliability": 15, "schema": 61, "security": 33, "transparency": 52 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": 0, "verdict": "The authorization design is careful, with allowed lists, Mandates and a Policy enforced in code, proactive work only recorded by default and auto-merge off. Executors run every command without approval under the operator's OS user, and the README calls it a research prototype with no release, changelog or security policy.", "bestFor": "Teams on github.com that want a DeepSeek Harness agent to turn allowed people's issue requests into pull requests, run on an isolated machine or OS account.", "strengths": [ "MIT licence, with nine numbered design and operations documents that state each rule, from admission to restart recovery", "Only listed GitHub logins can start work by default, and messages, comments and prompts cannot change the gate, which code enforces", "Proactive work starts in `observe` mode, which records what the agent would have done and accepts nothing", "The agent never enables auto-merge as its own account, and the default merge rule needs approvals and fewer than 200 changed lines", "Setup and worker shells drop environment variables named KEY, PASSWORD, SECRET or TOKEN, and git uses only the agent account's credentials" ], "weaknesses": [ "Executor and main Sessions run with `danger-full-access` as the operator's OS user, and the docs say a worker can read the operator's home directory", "The README calls it a research prototype, not an official DeepSeek product, at version 0.1.0 with no tag, release or changelog found", "Not on npm. Installing means a git clone, `pnpm build`, a pinned DSH release candidate, tmux and a dedicated GitHub user account", "The docs don't mention that DSH's shipped profiles upload the session log to DeepSeek with official API requests by default", "No SECURITY.md, security.txt or CI workflow found, and GitHub's issues and pull requests couldn't be read" ], "agentNotes": [ "Run it under a dedicated OS account holding only the agent's credentials. Executors run commands without approval and can read the operator's home directory", "Set `enabled: false` on the `session-log-deepseek` row of the `superagent` profile before using DeepSeek's official API on private code", "Keep the accept mode at `observe` and the allowed list short until the recorded Decisions look right", "Wait for `scripts/dsh-superagent status` to stop exiting 1 after any save that answers `restarting: true` before the next request", "Send `x-orchestrator-request: 1` and a loopback Host to the Management API, and send `revision` with each PUT, since a stale one gets 409" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 42.1 } ], "editorialScores": { "ergonomics": 67, "maintenance": 34, "payments": 40, "reliability": 15, "schema": 61, "security": 33, "transparency": 51 }, "provenanceScore": 52, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install -g @deepseek-ai/dsh@0.2.1-rc.3 \u0026\u0026 git clone https://github.com/deepseek-ai/dsh-superagent-prototype dsh-superagent \u0026\u0026 cd dsh-superagent \u0026\u0026 pnpm install \u0026\u0026 pnpm build \u0026\u0026 dsh superagent --from-default-profile web --dump-config \u003e /dev/null \u0026\u0026 dsh plugin --profile superagent add \"link:$PWD\"" }, "letme": { "capability": "https://letme.dev/agent.harness", "tool": "https://letme.dev/deepseek-superagent" }, "sameCompany": [ "deepseek-harness" ], "area": "frameworks", "provenance": { "legalEntity": "DeepSeek (the LICENSE names the DeepSeek Harness Team; DeepSeek Harness's terms name Hangzhou DeepSeek Artificial Intelligence Co., Ltd.)", "domain": "github.com", "domainRegistered": "", "endpointOnVendorDomain": null, "terms": "", "privacy": "https://www.deepseek.com/en/harness/privacy/", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-01", "notes": [ "The repository has no terms or privacy policy of its own. DeepSeek Harness's terms of use and privacy policy (both last updated 20 September 2026) name Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and cover the harness it runs on. The README says the prototype is not an official DeepSeek product.", "package.json names `DeepSeek Harness Team \u003cteam@dsh.dev\u003e` as author. dsh.dev didn't resolve from our network on 1 November 2026.", "No SECURITY.md in the root or .github, and www.deepseek.com/.well-known/security.txt returned 404 on 1 November 2026.", "No CHANGELOG.md, tags or releases found. GitHub's web pages and API weren't reachable, so files were read on raw.githubusercontent.com and the commit history, stars and issues are unchecked." ], "score": 52 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/deepseek-superagent.json" }, "answer": "Mistral Vibe CLI scores 63 (B) on agent readiness against dsh-superagent (DeepSeek)'s 42.1 (E), and leads in every scored category.", "b": { "slug": "mistral-vibe-cli", "name": "Mistral Vibe CLI", "vendor": "Mistral AI", "vendorUrl": "https://docs.mistral.ai/vibe/code/cli/install-setup", "kind": "harness", "category": "agent-harnesses", "summary": "Mistral AI's open-source terminal coding agent. It runs Mistral's hosted models or any OpenAI-compatible endpoint, headless with `vibe -p` and in editors through `vibe-acp`. This listing covers the CLI, not Mistral's Vibe chat app.", "url": "https://www.anchorterminal.com/tools/mistral-vibe-cli", "markdownUrl": "https://www.anchorterminal.com/tools/mistral-vibe-cli.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/mistral-vibe-cli.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/mistral-vibe-cli.json", "dns": "mistral-vibe-cli.grade.anchorterminal.com", "repo": "https://github.com/mistralai/mistral-vibe", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "pypi", "name": "mistral-vibe" } ], "auth": "mixed", "authNotes": "Browser sign-in with a Mistral account, or a Mistral API key in `MISTRAL_API_KEY` or `~/.vibe/.env`, created under Code, Vibe CLI in the Mistral console. The same key works on the Free plan, a paid plan or pay-as-you-go. A local OpenAI-compatible server needs no Mistral account. MCP servers take static headers or OAuth.", "pricing": "freemium", "pricingNotes": "The CLI is free under Apache-2.0. Hosted models come with a Mistral plan or an API key. Free has limited coding sessions, Pro is $14.99 a month and Team $24.99 a user a month, Enterprise by quote, with pay-as-you-go at API rates past a plan's limit. The default model, Mistral Medium 3.5, is $1.5 per million input tokens and $7.5 per million output tokens on the API. A local model costs nothing (checked 2026-10-18).", "priceSummary": "Freemium", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the README, the CLI docs or the source (checked 2026-10-18).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 5100, "npmWeekly": null, "pypiWeekly": 331757, "asOf": "2026-10-18" }, "docsUrl": "https://docs.mistral.ai/vibe/code/cli/install-setup", "llmsTxt": "https://docs.mistral.ai/llms.txt", "capabilities": [ "agent.harness", "agent.mcp-client", "agent.multi-agent" ], "tags": [ "official", "harness", "coding-agent", "cli", "open-source", "python", "mcp", "acp", "llms-txt", "telemetry-default-on", "no-sandbox", "subagents", "hooks", "freemium", "no-card", "local" ], "lastRelease": "2026-10-09", "graded": true, "anchor": { "graded": true, "score": 63, "grade": "B", "agentReady": false, "rank": 483, "ranked": true, "rankOf": 1251, "categoryRank": 12, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 84, "maintenance": 75, "payments": 60, "reliability": 69, "schema": 76, "security": 58, "transparency": 80 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-18" }, "negative": -8, "negativeNotes": [ "2026-09-12. CVE-2026-87983 to CVE-2026-87988 (advisory MAI-2026-003, severity High, published 14 September 2026). Crafted shell commands could run without the approval prompt, reading or writing files outside the workspace or running code, and injected instructions could trigger them. HiddenLayer published the CVEs on 11 September and Mistral released 2.25.4 the next day. Fixed and published inside six months, so 2 points for each high, as nanobot's and zeroclaw's fixed advisories were weighed. Six highs come to 12, held at the -6 cap for fixed and published advisories that claude-code and the Claude Agent SDK listing use (research/new/NOTES-harnesses-H1.md, negative events). Paperclip's -10 adds -5 for its group of ten fixed advisories and separate lines for advisories with no patched version, which doesn't apply here (https://docs.mistral.ai/resources/security-advisories/MAI-2026-003). -6", "2026-10-18. The offline guide says that with `enable_telemetry = false` and `enable_auto_update = false` the CLI contacts no external service, and the configuration reference describes `enable_auto_update` as installing releases in the background. The 2.26.1 source has no such key. It reads `enable_update_checks`, which stays on, and the README says interactive sessions then query PyPI or uv once a day. We followed ironclaw's precedent, not zeroclaw's, because this is the vendor's documentation contradicting the shipped release on what leaves the machine, where zeroclaw's was a site-versus-docs mismatch. The safety page's line that `-p` falls back to `auto-approve` is also wrong, but it errs towards caution, so it stays a weakness with no deduction. A misleading claim, at the minimum, -2 (https://docs.mistral.ai/vibe/code/cli/offline-models; https://docs.mistral.ai/vibe/code/cli/configuration-reference; https://github.com/mistralai/mistral-vibe#update-settings). -2" ], "verdict": "Apache-2.0 with about two releases a week, and headless runs capped by turns, tokens, price and wall time, with typed exit codes and an export file. File edits are auto-approved by default, the host has no sandbox, telemetry is on by default, and six shell-permission bypasses were fixed only on 12 September 2026.", "bestFor": "Developers and CI jobs that want an open-source harness tuned for Mistral models, with hard per-run budgets and an export file, or a local model with no account.", "strengths": [ "Apache-2.0, on PyPI and Homebrew at 2.26.1, with 20 PyPI releases in the 90 days to 18 October 2026", "`vibe -p` stops on `--max-turns`, `--max-tokens`, `--max-price` or `--time-limit`, with exit codes 0 to 4 and an `export.json` naming the outcome", "Runs against any OpenAI-compatible endpoint, with a llama.cpp provider on 127.0.0.1:8080 in the defaults and a documented offline set-up", "Project `.vibe/` config, hooks, MCP servers and `AGENTS.md` load only from trusted folders, and `-p` runs never trust a folder without `--trust`", "`vibe-acp` is in the ACP registry at 2.26.1, with prebuilt binaries for macOS and Linux" ], "weaknesses": [ "The default agent auto-approves file edits, and there's no sandbox on the host. Isolation needs the experimental `--agent-socket` server or a container", "Six high-severity shell-permission bypasses (CVE-2026-87983 to CVE-2026-87988) were fixed in 2.25.4 on 12 September 2026, a day after HiddenLayer published them", "Telemetry is on by default, and the server-side experiments it enables can switch the default agent to the `smart-approve` classifier", "The docs disagree with the code. The safety page says `-p` falls back to auto-approve, and the offline guide names an `enable_auto_update` key the source doesn't define", "The repository takes no outside contributions, and its history is squashed release commits" ], "agentNotes": [ "Pass `--agent` on every `-p` run (`plan` is read-only). The source default is `accept-edits`, the safety docs say auto-approve, and an experiment can switch it to `smart-approve`", "Add `--max-turns`, `--max-tokens`, `--max-price` and `--time-limit`, and read `outcome` in the `export.json` that `--output-dir` writes. Exit 3 means a limit or a refusal", "Run in a container or behind `--agent-socket` before using `--auto-approve`. Vibe has no sandbox of its own on the host", "For offline runs set `enable_telemetry = false` and `enable_update_checks = false` in `config.toml`. The docs' `enable_auto_update` isn't the key the code reads", "Use 2.25.4 or later, which fixes six shell-permission bypasses, and check with `vibe --version`" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 4, "avgRating": 3.3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 63 } ], "editorialScores": { "ergonomics": 84, "maintenance": 75, "payments": 60, "reliability": 69, "schema": 76, "security": 58, "transparency": 68 }, "provenanceScore": 91, "checked": { "categories": { "ergonomics": "2026-10-18", "maintenance": "2026-10-18", "payments": "2026-10-18", "reliability": "2026-10-18", "schema": "2026-10-18", "security": "2026-10-18", "transparency": "2026-10-18" }, "last": "2026-10-18", "lastMoved": "2026-10-27", "oldest": "2026-10-18", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "uv tool install mistral-vibe # or: curl -LsSf https://mistral.ai/vibe/install.sh | bash", "headless": { "command": "vibe --prompt-file task.md --agent accept-edits --output json --max-turns 30 --max-price 1.0 --time-limit 1800 --output-dir out/", "env": { "MISTRAL_API_KEY": "\u003ckey\u003e" } } }, "letme": { "capability": "https://letme.dev/agent.harness", "tool": "https://letme.dev/mistral-vibe-cli" }, "sameCompany": [ "mistral-api", "mistral-embeddings", "mistral-moderation", "mistral-voxtral-transcribe", "voxtral-mini-4b-realtime-2602", "mistral-ocr", "mistral-large-4" ], "area": "frameworks", "provenance": { "legalEntity": "Mistral AI (RCS Paris 952 418 325)", "domain": "mistral.ai", "domainRegistered": "2019-05-15", "endpointOnVendorDomain": null, "terms": "https://legal.mistral.ai/terms/commercial-terms-of-service", "privacy": "https://legal.mistral.ai/terms/privacy-policy", "statusPage": "https://status.mistral.ai", "changelog": "https://github.com/mistralai/mistral-vibe/blob/main/CHANGELOG.md", "securityTxt": "valid", "checked": "2026-10-18", "notes": [ "security.txt read on 2026-10-18, a Mistral security contact, Expires 2027-05-05, Policy a HackerOne submission form. SECURITY.md in the repository points to the same contact and programme", "Privacy policy effective 3 September 2026 and commercial terms effective 25 September 2026, both read on 2026-10-18. Both name Vibe among the Mistral AI products they cover", "The legal entity and domain date are carried from the mistral-api listing's 17 October check", "status.mistral.ai covers the hosted API, answered with a bot check on 17 October per the mistral-api listing and wasn't read again. It doesn't cover the local CLI" ], "score": 91 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/mistral-vibe-cli.json", "live": { "slug": "mistral-vibe-cli", "vendorStatus": { "page": "https://status.mistral.ai", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-01T05:14:59.071965115Z" }, "versions": [ { "registry": "github", "name": "mistralai/mistral-vibe", "version": "v3.0.4", "released": "2026-10-30", "seenAt": "2026-10-31T16:09:39.876915405Z" }, { "registry": "pypi", "name": "mistral-vibe", "version": "3.0.4", "released": "2026-10-30", "seenAt": "2026-10-31T16:09:39.68801335Z" } ], "githubStars": 5260, "pypiWeekly": 355798, "securityTxt": { "url": "https://mistral.ai/.well-known/security.txt", "state": "valid", "expires": "2027-05-05T23:59:59.000Z", "checkedAt": "2026-10-31T15:41:38.574797026Z" }, "llmsTxt": { "url": "https://docs.mistral.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-31T15:11:22.470473579Z" }, "domain": { "domain": "mistral.ai", "registered": "2019-05-15", "source": "https://rdap.identitydigital.services/rdap/domain/mistral.ai", "checkedAt": "2026-10-25T14:03:13.400772123Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/mistralai/mistral-vibe/main/CHANGELOG.md", "kind": "deprecations", "status": 200, "checkedAt": "2026-10-31T06:21:55.264964477Z", "changedAt": "2026-10-31T06:21:55.264964477Z", "fingerprint": "32482e7688f4" } ], "github": { "repo": "mistralai/mistral-vibe", "checkedAt": "2026-10-26T07:47:02.037729335Z", "stars": 5200, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-22T20:42:31Z", "openIssues": 219, "openPRs": 204, "issuesOpened90d": 209, "issuesClosed90d": 182, "prsMerged90d": 28, "ci": { "branch": "main", "runs": 50, "success": 40, "failure": 10, "other": 0, "latest": "failure", "latestAt": "2026-10-22T21:03:30Z" }, "replies": { "sampled": 25, "unanswered": 17, "medianDays": 1.6 } }, "updatedAt": "2026-11-01T05:14:59.071965115Z" } }, "edges": [ { "by": 54, "category": "reliability", "leads": "mistral-vibe-cli", "name": "Reliability", "reasons": { "a": "Local-package reading, since it runs as a DSH bundle on the operator's machine. Not published to npm (`private: true` in package.json, and the registry has no `dsh-superagent`). It installs from a git clone with `pnpm install \u0026\u0026 pnpm build` on top of `@deepseek-ai/dsh@0.2.1-rc.3`, with Node 22.19+ or 24+, git 2.32+, Python 3.8+, tmux and gh 2.48+ stated, so half credit (10). A vitest suite of about 25 spec files is listed in docs/007, and `pnpm check` runs the typecheck, tests and build. Two spec files were read on raw.githubusercontent.com. No CI workflow was found at five common paths under .github/workflows, and the directory couldn't be listed (5). Open issues couldn't be read, because github.com and api.github.com weren't reachable from our network. Unchecked, so scored absent (0). Version 0.1.0 with no tag, release or changelog found, so no semver record (0). A research prototype, not stable (0).", "b": "Local-package reading. PyPI, uv, pip, Homebrew at 2.26.1 and an install script, with Python 3.12 or later stated and UNIX the supported target (20). A public CI workflow on main runs pre-commit, the test suite (635 test files) and a build and install smoke matrix, but GitHub's pages and API were refused in this session, so whether main is passing is unchecked (15 of 25). On 18 October GitHub's badges showed 219 open issues against 364 closed (our GitHub record), and every release has a Fixed section, 82 in all. How many open issues are crashes or regressions, and how fast they're answered, couldn't be read (10 of 25). The changelog states Keep a Changelog and semver and marks breaking changes, but the hooks rename shipped in minor 2.21.0, patch 2.11.1 changed the `-p` approval default, and patch 2.26.1 removed the bundled local model (9). 2.26.1, classified Production/Stable (15). 20+15+10+9+15 = 69." }, "scores": { "a": 15, "b": 69 } }, { "by": 41, "category": "maintenance", "leads": "mistral-vibe-cli", "name": "Maintenance \u0026 community", "reasons": { "a": "Published on 31 October 2026, within 30 days, read as the last published change since no tag or release was found (30). One publication, so not three releases in 90 days (0). Issues, pull requests and Discussions couldn't be read, and the README frames the code as a reference prototype adapted from an internal version (0). No official SDK or registry entry (0). Exact dependency pins and a lockfile, but no CI workflow found, and the docs pin DSH 0.2.1-rc.3 (23 October 2026) while npm `latest` is 0.2.1-rc.5 (29 October 2026) (4).", "b": "2.26.1 on 9 October 2026 (30). 20 releases on PyPI in the 90 days to 18 October, and 22 in the changelog (20). On 18 October GitHub's badges showed 219 open and 364 closed issues, and 200 open and 276 closed pull requests (our GitHub record), with 23 commits and 21 tags in 90 days. Response times couldn't be read. CONTRIBUTING.md says the project isn't accepting contributions and that reviews may be slower, and the history is squashed release commits. Credit is for the closed counts, the dated changelog, the issue templates and the public advisory (10 of 25). No SDK. `vibe-acp` is current in the ACP registry at 2.26.1 and the Homebrew formula is at 2.26.1 (8 of 15). Dependencies are pinned to exact versions, workflow actions are pinned by commit, and CI runs on main, but no Dependabot or Renovate config was found (7 of 10). 30+20+10+8+7 = 75." }, "scores": { "a": 34, "b": 75 } }, { "by": 28, "category": "transparency", "leads": "mistral-vibe-cli", "name": "Transparency \u0026 trust", "reasons": { "a": "MIT, Copyright (c) 2026 DeepSeek Harness Team (30). The prototype has no data statement of its own. DeepSeek Harness's privacy policy (last updated 20 September 2026) names Hangzhou DeepSeek Artificial Intelligence Co., Ltd., says session logs are collected with official model services and may be used to train models with a right to opt out, and says custom model services aren't stored server-side. It agrees with DSH's session-log README, but neither is referred to from the prototype (12). No deprecation policy. The README says the published code differs from DeepSeek's internal version, and docs/006 warns that database migrations are one-way (3). Telemetry and the session-log upload are disclosed with opt-outs in DSH's own reference pages, not in this repository (6).", "b": "Apache-2.0, with LICENSE and pyproject in agreement (30). The README sends readers to Mistral's privacy policy (effective 3 September 2026), which names Vibe. The commercial terms (effective 25 September 2026) say no training on customer data unless a product's default or an opt-in allows it, and the pricing page lists model training as opt-out on Free, Pro and Team. The configuration reference calls telemetry anonymous without listing its fields. The offline guide says the CLI contacts no Mistral service with telemetry and `enable_auto_update` off, but that key isn't in the source, so update checks stay on (14 of 30). Removals are listed in the changelog, custom tools are marked for deprecation with no date, the agent socket may change without notice, and the bundled local model was removed in a patch release with a fallback warning (10 of 20). Telemetry is disclosed with an opt-out in the README and the configuration reference, and the README names the server-managed shell-tool rollout, but its fields are only in the source (14 of 20). 30+14+10+14 = 68." }, "scores": { "a": 52, "b": 80 } }, { "by": 25, "category": "security", "leads": "mistral-vibe-cli", "name": "Security \u0026 auth", "reasons": { "a": "Harness reading of the framework checklist, 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The `superagent` profile is created from DSH's Web template, and DSH documents that shipped profiles mount `session-log-deepseek`, enabled by default, which adds the session log to each official DeepSeek API request, up to 8 MiB. dsh-superagent's docs don't mention it, and its Sessions read issue, pull request and chat text and the repository. Setup and worker shells drop variables named KEY, PASSWORD, SECRET or TOKEN, and `GH_TOKEN` and `GITHUB_TOKEN` are removed from git (8). Both presets run `danger-full-access` without approval as the operator's OS user. docs/006 says the account wrappers don't isolate the process, a worker can run programs by path and read the operator's home directory, and recommends a dedicated OS account. The gate, `observe` default, blocked commands and no auto-merge as the agent account narrow what it does, not what it can do (6). docs/002 says messages, comments and quoted documents are inputs to a decision and can't change allowed lists, rules or Mandates, bots can never make explicit requests, and prompt edits don't change the gate. Workers with full access still read untrusted Thread text, and no further guidance on that was found (7). Decisions are recorded with reasons, Ticket details show the Trigger, Decision, scope and Policy version, the host records the prompt revisions each Session used, and every GitHub message starts with an automated-agent line by default (12). No SECURITY.md (404 at the root and in .github), no security.txt on www.deepseek.com (404), no bug bounty or advisory found. NVD has no record for the prototype. The CVEs against DSH itself are on the deepseek-harness listing (0).", "b": "Framework reading (telemetry defaults, approvals, guardrails, sandboxing), five lines. Telemetry and crash reporting are on by default with an opt-out, and the source sends tool names, approval decisions, the model and file counts to api.mistral.ai only when a Mistral key is set. Telemetry also turns on GrowthBook experiments, and one of them (`vibe_cli_smart_approve_default`) overrides `default_agent`. Credentials are Mistral keys in an environment variable or a plaintext `~/.vibe/.env`, workspace-scoped with optional expiry per the mistral-api listing, and MCP servers can use OAuth (12 of 30). Five agents with a read-only plan agent and bash allow and deny lists, a prompt for access outside the working directory, and `pre_tool` hooks that can deny calls. The default auto-approves file edits, and there's no sandbox on the host. Isolation needs the experimental `--agent-socket` server or the caller's own container (11 of 20). Project config, hooks and MCP servers load only from trusted folders, and `-p` needs `--trust` to load them. The safety page warns that smart-approve isn't a sandbox. No network egress control on the host, and MAI-2026-003 says injected instructions could trigger the bypassed commands (8 of 15). OpenTelemetry tracing is opt-in, with default, strict and no redaction, and each run can write a session journal and an export with the effective config. Managed admin config exists, and audit logs come with the Enterprise plan (13). SECURITY.md asks for private reports, security.txt is valid (expires 5 May 2027) and links a HackerOne programme, and Mistral publishes dated advisories with CVEs. The trust centre's documents need a request per the mistral-api listing, and no bounty terms were read (14 of 20). 12+11+8+13+14 = 58." }, "scores": { "a": 33, "b": 58 } }, { "by": 20, "category": "payments", "leads": "mistral-vibe-cli", "name": "Payments \u0026 pricing", "reasons": { "a": "Self-hosted rule, as for the other open-source harnesses. No payment protocol (0). Free under MIT with nothing to buy (20). No card for the software (20). An agent can't get started alone, because the setup needs a person to create a dedicated GitHub user account, accept the repository invitation and run `auth login` for the wrappers, which SETUP.md lists as operator steps. 0, as the other harnesses that need an account were read (0). The model provider is a separate purchase.", "b": "Harness reading of the published rubric, as for openai-codex and qwen-code. No payment protocol (0). Plan prices (Pro $14.99 a month, Team $24.99 a user a month) and per-token API prices for the default model ($1.5 and $7.5 per million) are public without a login (20). A Free plan includes limited coding sessions, and the docs document a fully offline set-up with a local model and no Mistral account. Whether the Free plan asks for a card wasn't checked (20). An agent can install the CLI and run it against a local OpenAI-compatible server with no sign-up, since a llama.cpp provider on 127.0.0.1:8080 is in the defaults (20). 0+20+20+20 = 60." }, "scores": { "a": 40, "b": 60 } }, { "by": 17, "category": "ergonomics", "leads": "mistral-vibe-cli", "name": "Agent ergonomics", "reasons": { "a": "Harness reading, scored on what a team or pipeline driving it has to supply. The worker preset is DSH's `standard` with web fetch, plan mode, questions, scheduling and workflows left out, the main Session can't write files, and tool results over 8,192 characters are pruned (18). A concurrency limit with one extra slot for a person's message, a 5-second foreground shell, a 10-minute prepare limit and 30 minutes for background work after a turn. No cost or turn limit per Ticket was found (12). Ticket stages, health entries per part, Reports of `blocked` or `failed`, API refusals with codes, and three retries with growing backoff on 408, 429, 5xx and dropped connections (17). Saves carry a revision and a stale one gets 409, state and Sessions survive a restart, and a restarted Assignment gets a recovery note to check git and GitHub before repeating any outside action (16). Sensible defaults (observe mode, port 3082, branch prefix `agent/`), but setup needs a dedicated GitHub user account, CLI wrappers, tmux and a profile, and there is no SDK. Work is requested by mentioning the agent account on GitHub or Feishu (4).", "b": "Framework reading, adapted to a harness driven by a pipeline. `--enabled-tools` and `--disabled-tools` with globs and regex (in `-p` the first disables everything else), per-tool and per-MCP-tool permissions, and switches for subagents and background processes (20 of 25). `--max-turns`, `--max-tokens`, `--max-price` and `--time-limit`, with text, json and streaming output and an export file with usage and cost (20). Exit codes 0 to 4 with named outcomes, refusals reported with a code, and config problems listed under `warnings` (18). `--resume SESSION_ID` and `--continue`, SIGTERM stops a run so it can be resumed, and model API failures are retried before exit 2 (16). One required input (the prompt), a GitHub Action and the ACP server, but no SDK, and the app-server's JSON-RPC protocol isn't documented for outside use (10). 20+20+18+16+10 = 84." }, "scores": { "a": 67, "b": 84 } } ], "facts": [ { "a": "Agent harness", "b": "Agent harness", "name": "Kind" }, { "a": "DeepSeek", "b": "Mistral AI", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "", "name": "Transports" }, { "a": "Token", "b": "OAuth or key", "name": "Auth" }, { "a": "Free", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT", "b": "Apache-2.0", "name": "Licence" }, { "a": "no", "b": "yes", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-31", "b": "2026-10-09", "name": "Last release" }, { "a": "no document linked", "b": "2026-09-25", "name": "Terms last updated" }, { "a": "2026-09-20", "b": "2026-09-03", "name": "Privacy policy last updated" }, { "a": "not read yet", "b": "yes, with an opt-out", "name": "Customer content may train models" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "5.1k stars, 332k PyPI/wk", "name": "Popularity" }, { "a": "none", "b": "3.3/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Mistral Vibe CLI scores 63 (B) on agent readiness against dsh-superagent (DeepSeek)'s 42.1 (E), and leads in every scored category.", "question": "Which is better for AI agents, dsh-superagent (DeepSeek) or Mistral Vibe CLI?" }, { "answer": "Yes. dsh-superagent (DeepSeek) is open source (MIT). Mistral Vibe CLI is open source (Apache-2.0).", "question": "Are dsh-superagent (DeepSeek) and Mistral Vibe CLI open source?" } ], "goodFor": [ { "aheadOn": null, "also": [ "No incidents deducted, where Mistral Vibe CLI loses 8 points for them" ], "goodFor": "Teams on github.com that want a DeepSeek Harness agent to turn allowed people's issue requests into pull requests, run on an isolated machine or OS account.", "slug": "deepseek-superagent", "watchFor": "Executor and main Sessions run with `danger-full-access` as the operator's OS user, and the docs say a worker can read the operator's home directory" }, { "aheadOn": [ "Reliability, 69 against 15", "Schema \u0026 documentation, 76 against 61", "Agent ergonomics, 84 against 67", "Security \u0026 auth, 58 against 33", "Payments \u0026 pricing, 60 against 40", "Maintenance \u0026 community, 75 against 34", "Transparency \u0026 trust, 80 against 52" ], "also": null, "goodFor": "Developers and CI jobs that want an open-source harness tuned for Mistral models, with hard per-run budgets and an export file, or a local model with no account.", "slug": "mistral-vibe-cli", "watchFor": "The default agent auto-approves file edits, and there's no sandbox on the host. Isolation needs the experimental `--agent-socket` server or a container" } ], "history": { "deepseek-superagent": null, "mistral-vibe-cli": [ { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 62.9, "fromGrade": "B", "to": 63, "toGrade": "B" } ] }, "job": { "capability": "agent.harness", "name": "Agent harnesses" }, "others": [ { "json": "https://www.anchorterminal.com/compare/agent-zero-vs-deepseek-superagent.json", "title": "Agent Zero vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/agent-zero-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/agent-zero-vs-mistral-vibe-cli.json", "title": "Agent Zero vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/agent-zero-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/aider-vs-deepseek-superagent.json", "title": "Aider vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/aider-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/aider-vs-mistral-vibe-cli.json", "title": "Aider vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/aider-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/amp-vs-deepseek-superagent.json", "title": "Amp vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/amp-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/amp-vs-mistral-vibe-cli.json", "title": "Amp vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/amp-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/antigravity-cli-vs-deepseek-superagent.json", "title": "Antigravity CLI vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/antigravity-cli-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/antigravity-cli-vs-mistral-vibe-cli.json", "title": "Antigravity CLI vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/antigravity-cli-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/auggie-vs-deepseek-superagent.json", "title": "Auggie CLI vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/auggie-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/auggie-vs-mistral-vibe-cli.json", "title": "Auggie CLI vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/auggie-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/claude-code-vs-deepseek-superagent.json", "title": "Claude Code vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/claude-code-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/claude-code-vs-mistral-vibe-cli.json", "title": "Claude Code vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/claude-code-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/cline-vs-deepseek-superagent.json", "title": "Cline vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/cline-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/cline-vs-mistral-vibe-cli.json", "title": "Cline vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/cline-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/crush-vs-deepseek-superagent.json", "title": "Crush vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/crush-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/crush-vs-mistral-vibe-cli.json", "title": "Crush vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/crush-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/cursor-cli-vs-deepseek-superagent.json", "title": "Cursor CLI vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/cursor-cli-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/cursor-cli-vs-mistral-vibe-cli.json", "title": "Cursor CLI vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/cursor-cli-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-harness-vs-deepseek-superagent.json", "title": "DeepSeek Harness (dsh) vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/deepseek-harness-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/deepseek-harness-vs-mistral-vibe-cli.json", "title": "DeepSeek Harness (dsh) vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/deepseek-harness-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-devin.json", "title": "dsh-superagent (DeepSeek) vs Devin", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-devin" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-droid-cli.json", "title": "dsh-superagent (DeepSeek) vs Droid CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-droid-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-earendil-pi.json", "title": "dsh-superagent (DeepSeek) vs Pi", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-earendil-pi" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-gemini-cli.json", "title": "dsh-superagent (DeepSeek) vs Gemini CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-gemini-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-github-copilot-cli.json", "title": "dsh-superagent (DeepSeek) vs GitHub Copilot CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-github-copilot-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-goose.json", "title": "dsh-superagent (DeepSeek) vs goose", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-goose" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-harness2.json", "title": "dsh-superagent (DeepSeek) vs Harness²", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-harness2" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-harnessrouter.json", "title": "dsh-superagent (DeepSeek) vs HarnessRouter", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-harnessrouter" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-jules.json", "title": "dsh-superagent (DeepSeek) vs Jules", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-jules" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-junie.json", "title": "dsh-superagent (DeepSeek) vs Junie CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-junie" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-kilo-code-cli.json", "title": "dsh-superagent (DeepSeek) vs Kilo Code CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-kilo-code-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-kimi-code-cli.json", "title": "dsh-superagent (DeepSeek) vs Kimi Code CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-kimi-code-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-kiro-cli.json", "title": "dsh-superagent (DeepSeek) vs Kiro CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-kiro-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-mini-swe-agent.json", "title": "dsh-superagent (DeepSeek) vs mini-swe-agent", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-mini-swe-agent" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-minimax-code.json", "title": "dsh-superagent (DeepSeek) vs MiniMax Code", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-minimax-code" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-muse-code.json", "title": "dsh-superagent (DeepSeek) vs Muse Code", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-muse-code" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-openai-codex.json", "title": "dsh-superagent (DeepSeek) vs OpenAI Codex", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-openai-codex" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-opencode.json", "title": "dsh-superagent (DeepSeek) vs OpenCode", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-opencode" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-openhands.json", "title": "dsh-superagent (DeepSeek) vs OpenHands", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-openhands" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-openmausbot.json", "title": "dsh-superagent (DeepSeek) vs OpenMausBot", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-openmausbot" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-prime-agent.json", "title": "dsh-superagent (DeepSeek) vs Prime Agent", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-prime-agent" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-qoder-cli.json", "title": "dsh-superagent (DeepSeek) vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-qwen-code.json", "title": "dsh-superagent (DeepSeek) vs Qwen Code", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-qwen-code" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-reflection-mirror.json", "title": "dsh-superagent (DeepSeek) vs Mirror CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-reflection-mirror" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-rovo-dev-cli.json", "title": "dsh-superagent (DeepSeek) vs Rovo Dev CLI", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-rovo-dev-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-unstoppable.json", "title": "dsh-superagent (DeepSeek) vs Unstoppable", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-unstoppable" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-vibe-trading.json", "title": "dsh-superagent (DeepSeek) vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-warp.json", "title": "dsh-superagent (DeepSeek) vs Warp (Warp Agent CLI and the Oz Agent API)", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-warp" }, { "json": "https://www.anchorterminal.com/compare/devin-vs-mistral-vibe-cli.json", "title": "Devin vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/devin-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/droid-cli-vs-mistral-vibe-cli.json", "title": "Droid CLI vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/droid-cli-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/earendil-pi-vs-mistral-vibe-cli.json", "title": "Pi vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/earendil-pi-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/gemini-cli-vs-mistral-vibe-cli.json", "title": "Gemini CLI vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/gemini-cli-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/github-copilot-cli-vs-mistral-vibe-cli.json", "title": "GitHub Copilot CLI vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/github-copilot-cli-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/goose-vs-mistral-vibe-cli.json", "title": "goose vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/goose-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/harness2-vs-mistral-vibe-cli.json", "title": "Harness² vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/harness2-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/harnessrouter-vs-mistral-vibe-cli.json", "title": "HarnessRouter vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/harnessrouter-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/jules-vs-mistral-vibe-cli.json", "title": "Jules vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/jules-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/junie-vs-mistral-vibe-cli.json", "title": "Junie CLI vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/junie-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/kilo-code-cli-vs-mistral-vibe-cli.json", "title": "Kilo Code CLI vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/kilo-code-cli-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/kimi-code-cli-vs-mistral-vibe-cli.json", "title": "Kimi Code CLI vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/kimi-code-cli-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/kiro-cli-vs-mistral-vibe-cli.json", "title": "Kiro CLI vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/kiro-cli-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/mini-swe-agent-vs-mistral-vibe-cli.json", "title": "mini-swe-agent vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/mini-swe-agent-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/minimax-code-vs-mistral-vibe-cli.json", "title": "MiniMax Code vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/minimax-code-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-muse-code.json", "title": "Mistral Vibe CLI vs Muse Code", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-muse-code" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-openai-codex.json", "title": "Mistral Vibe CLI vs OpenAI Codex", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-openai-codex" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-opencode.json", "title": "Mistral Vibe CLI vs OpenCode", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-opencode" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-openhands.json", "title": "Mistral Vibe CLI vs OpenHands", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-openhands" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-openmausbot.json", "title": "Mistral Vibe CLI vs OpenMausBot", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-openmausbot" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-prime-agent.json", "title": "Mistral Vibe CLI vs Prime Agent", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-prime-agent" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-qoder-cli.json", "title": "Mistral Vibe CLI vs Qoder CLI", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-qoder-cli" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-qwen-code.json", "title": "Mistral Vibe CLI vs Qwen Code", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-qwen-code" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-reflection-mirror.json", "title": "Mistral Vibe CLI vs Mirror CLI", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-reflection-mirror" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-rovo-dev-cli.json", "title": "Mistral Vibe CLI vs Rovo Dev CLI", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-rovo-dev-cli" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-unstoppable.json", "title": "Mistral Vibe CLI vs Unstoppable", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-unstoppable" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-vibe-trading.json", "title": "Mistral Vibe CLI vs Vibe-Trading", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-vibe-trading" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-warp.json", "title": "Mistral Vibe CLI vs Warp (Warp Agent CLI and the Oz Agent API)", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-warp" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-deepseek-superagent.json", "title": "Clawboo vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/clawboo-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/clawboo-vs-mistral-vibe-cli.json", "title": "Clawboo vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/clawboo-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/cli-manager-vs-deepseek-superagent.json", "title": "CLI Manager vs dsh-superagent (DeepSeek)", "url": "https://www.anchorterminal.com/compare/cli-manager-vs-deepseek-superagent" }, { "json": "https://www.anchorterminal.com/compare/cli-manager-vs-mistral-vibe-cli.json", "title": "CLI Manager vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/cli-manager-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-harness-autonomous.json", "title": "dsh-superagent (DeepSeek) vs Harness", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-harness-autonomous" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-paperclip.json", "title": "dsh-superagent (DeepSeek) vs Paperclip", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-paperclip" }, { "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-parallax-agents.json", "title": "dsh-superagent (DeepSeek) vs Parallax", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-parallax-agents" }, { "json": "https://www.anchorterminal.com/compare/harness-autonomous-vs-mistral-vibe-cli.json", "title": "Harness vs Mistral Vibe CLI", "url": "https://www.anchorterminal.com/compare/harness-autonomous-vs-mistral-vibe-cli" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-paperclip.json", "title": "Mistral Vibe CLI vs Paperclip", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-paperclip" }, { "json": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-parallax-agents.json", "title": "Mistral Vibe CLI vs Parallax", "url": "https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-parallax-agents" } ], "panel": null, "scores": [ { "by": 54, "deepseek-superagent": 15, "edge": "mistral-vibe-cli", "key": "reliability", "mistral-vibe-cli": 69, "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 15, "deepseek-superagent": 61, "edge": "mistral-vibe-cli", "key": "schema", "mistral-vibe-cli": 76, "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 17, "deepseek-superagent": 67, "edge": "mistral-vibe-cli", "key": "ergonomics", "mistral-vibe-cli": 84, "name": "Agent ergonomics", "weight": 13 }, { "by": 25, "deepseek-superagent": 33, "edge": "mistral-vibe-cli", "key": "security", "mistral-vibe-cli": 58, "name": "Security \u0026 auth", "weight": 14 }, { "by": 20, "deepseek-superagent": 40, "edge": "mistral-vibe-cli", "key": "payments", "mistral-vibe-cli": 60, "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 41, "deepseek-superagent": 34, "edge": "mistral-vibe-cli", "key": "maintenance", "mistral-vibe-cli": 75, "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 28, "deepseek-superagent": 52, "edge": "mistral-vibe-cli", "key": "transparency", "mistral-vibe-cli": 80, "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Mistral Vibe CLI scores 63 (B) on agent readiness against dsh-superagent (DeepSeek)'s 42.1 (E), and leads in every scored category. Both do agent harnesses.", "tasks": null, "tutorials": [], "verdicts": { "deepseek-superagent": "The authorization design is careful, with allowed lists, Mandates and a Policy enforced in code, proactive work only recorded by default and auto-merge off. Executors run every command without approval under the operator's OS user, and the README calls it a research prototype with no release, changelog or security policy.", "mistral-vibe-cli": "Apache-2.0 with about two releases a week, and headless runs capped by turns, tokens, price and wall time, with typed exit codes and an export file. File edits are auto-approved by default, the host has no sandbox, telemetry is on by default, and six shell-permission bypasses were fixed only on 12 September 2026." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-mistral-vibe-cli", "json": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-mistral-vibe-cli.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-mistral-vibe-cli.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-mistral-vibe-cli.min.md" }, "markdown": "Mistral Vibe CLI scores 63 (B) on agent readiness against dsh-superagent (DeepSeek)'s 42.1 (E), and leads in every scored category. Both do agent harnesses.\n\n- dsh-superagent (DeepSeek): grade E, 42.1/100, rank #1108 of 1251. Markdown https://www.anchorterminal.com/tools/deepseek-superagent.md · JSON https://www.anchorterminal.com/api/v1/tools/deepseek-superagent.json\n- Mistral Vibe CLI: grade B, 63/100, rank #483 of 1251. Markdown https://www.anchorterminal.com/tools/mistral-vibe-cli.md · JSON https://www.anchorterminal.com/api/v1/tools/mistral-vibe-cli.json\n- Best agent harnesses and coding agents: https://www.anchorterminal.com/best/agent-harnesses/index.md\n- All 955 harnesses comparisons: https://www.anchorterminal.com/compare/agent-harnesses/index.md\n\n## Which one, for what\n\n### dsh-superagent (DeepSeek) (E)\n\nGood for: Teams on github.com that want a DeepSeek Harness agent to turn allowed people's issue requests into pull requests, run on an isolated machine or OS account.\n\nAlso in its favour:\n- No incidents deducted, where Mistral Vibe CLI loses 8 points for them\n\nWatch for: Executor and main Sessions run with `danger-full-access` as the operator's OS user, and the docs say a worker can read the operator's home directory\n\n### Mistral Vibe CLI (B)\n\nGood for: Developers and CI jobs that want an open-source harness tuned for Mistral models, with hard per-run budgets and an export file, or a local model with no account.\n\nAhead on:\n- Reliability, 69 against 15\n- Schema \u0026 documentation, 76 against 61\n- Agent ergonomics, 84 against 67\n- Security \u0026 auth, 58 against 33\n- Payments \u0026 pricing, 60 against 40\n- Maintenance \u0026 community, 75 against 34\n- Transparency \u0026 trust, 80 against 52\n\nWatch for: The default agent auto-approves file edits, and there's no sandbox on the host. Isolation needs the experimental `--agent-socket` server or a container\n\n\n## Why the edge\n\n### Reliability: Mistral Vibe CLI +54\n\n- dsh-superagent (DeepSeek) (15): Local-package reading, since it runs as a DSH bundle on the operator's machine. Not published to npm (`private: true` in package.json, and the registry has no `dsh-superagent`). It installs from a git clone with `pnpm install \u0026\u0026 pnpm build` on top of `@deepseek-ai/dsh@0.2.1-rc.3`, with Node 22.19+ or 24+, git 2.32+, Python 3.8+, tmux and gh 2.48+ stated, so half credit (10). A vitest suite of about 25 spec files is listed in docs/007, and `pnpm check` runs the typecheck, tests and build. Two spec files were read on raw.githubusercontent.com. No CI workflow was found at five common paths under .github/workflows, and the directory couldn't be listed (5). Open issues couldn't be read, because github.com and api.github.com weren't reachable from our network. Unchecked, so scored absent (0). Version 0.1.0 with no tag, release or changelog found, so no semver record (0). A research prototype, not stable (0).\n- Mistral Vibe CLI (69): Local-package reading. PyPI, uv, pip, Homebrew at 2.26.1 and an install script, with Python 3.12 or later stated and UNIX the supported target (20). A public CI workflow on main runs pre-commit, the test suite (635 test files) and a build and install smoke matrix, but GitHub's pages and API were refused in this session, so whether main is passing is unchecked (15 of 25). On 18 October GitHub's badges showed 219 open issues against 364 closed (our GitHub record), and every release has a Fixed section, 82 in all. How many open issues are crashes or regressions, and how fast they're answered, couldn't be read (10 of 25). The changelog states Keep a Changelog and semver and marks breaking changes, but the hooks rename shipped in minor 2.21.0, patch 2.11.1 changed the `-p` approval default, and patch 2.26.1 removed the bundled local model (9). 2.26.1, classified Production/Stable (15). 20+15+10+9+15 = 69.\n\n### Maintenance \u0026 community: Mistral Vibe CLI +41\n\n- dsh-superagent (DeepSeek) (34): Published on 31 October 2026, within 30 days, read as the last published change since no tag or release was found (30). One publication, so not three releases in 90 days (0). Issues, pull requests and Discussions couldn't be read, and the README frames the code as a reference prototype adapted from an internal version (0). No official SDK or registry entry (0). Exact dependency pins and a lockfile, but no CI workflow found, and the docs pin DSH 0.2.1-rc.3 (23 October 2026) while npm `latest` is 0.2.1-rc.5 (29 October 2026) (4).\n- Mistral Vibe CLI (75): 2.26.1 on 9 October 2026 (30). 20 releases on PyPI in the 90 days to 18 October, and 22 in the changelog (20). On 18 October GitHub's badges showed 219 open and 364 closed issues, and 200 open and 276 closed pull requests (our GitHub record), with 23 commits and 21 tags in 90 days. Response times couldn't be read. CONTRIBUTING.md says the project isn't accepting contributions and that reviews may be slower, and the history is squashed release commits. Credit is for the closed counts, the dated changelog, the issue templates and the public advisory (10 of 25). No SDK. `vibe-acp` is current in the ACP registry at 2.26.1 and the Homebrew formula is at 2.26.1 (8 of 15). Dependencies are pinned to exact versions, workflow actions are pinned by commit, and CI runs on main, but no Dependabot or Renovate config was found (7 of 10). 30+20+10+8+7 = 75.\n\n### Transparency \u0026 trust: Mistral Vibe CLI +28\n\n- dsh-superagent (DeepSeek) (52): MIT, Copyright (c) 2026 DeepSeek Harness Team (30). The prototype has no data statement of its own. DeepSeek Harness's privacy policy (last updated 20 September 2026) names Hangzhou DeepSeek Artificial Intelligence Co., Ltd., says session logs are collected with official model services and may be used to train models with a right to opt out, and says custom model services aren't stored server-side. It agrees with DSH's session-log README, but neither is referred to from the prototype (12). No deprecation policy. The README says the published code differs from DeepSeek's internal version, and docs/006 warns that database migrations are one-way (3). Telemetry and the session-log upload are disclosed with opt-outs in DSH's own reference pages, not in this repository (6).\n- Mistral Vibe CLI (80): Apache-2.0, with LICENSE and pyproject in agreement (30). The README sends readers to Mistral's privacy policy (effective 3 September 2026), which names Vibe. The commercial terms (effective 25 September 2026) say no training on customer data unless a product's default or an opt-in allows it, and the pricing page lists model training as opt-out on Free, Pro and Team. The configuration reference calls telemetry anonymous without listing its fields. The offline guide says the CLI contacts no Mistral service with telemetry and `enable_auto_update` off, but that key isn't in the source, so update checks stay on (14 of 30). Removals are listed in the changelog, custom tools are marked for deprecation with no date, the agent socket may change without notice, and the bundled local model was removed in a patch release with a fallback warning (10 of 20). Telemetry is disclosed with an opt-out in the README and the configuration reference, and the README names the server-managed shell-tool rollout, but its fields are only in the source (14 of 20). 30+14+10+14 = 68.\n\n### Security \u0026 auth: Mistral Vibe CLI +25\n\n- dsh-superagent (DeepSeek) (33): Harness reading of the framework checklist, 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for prompt-injection posture, 15 for audit and 20 for the security programme. The `superagent` profile is created from DSH's Web template, and DSH documents that shipped profiles mount `session-log-deepseek`, enabled by default, which adds the session log to each official DeepSeek API request, up to 8 MiB. dsh-superagent's docs don't mention it, and its Sessions read issue, pull request and chat text and the repository. Setup and worker shells drop variables named KEY, PASSWORD, SECRET or TOKEN, and `GH_TOKEN` and `GITHUB_TOKEN` are removed from git (8). Both presets run `danger-full-access` without approval as the operator's OS user. docs/006 says the account wrappers don't isolate the process, a worker can run programs by path and read the operator's home directory, and recommends a dedicated OS account. The gate, `observe` default, blocked commands and no auto-merge as the agent account narrow what it does, not what it can do (6). docs/002 says messages, comments and quoted documents are inputs to a decision and can't change allowed lists, rules or Mandates, bots can never make explicit requests, and prompt edits don't change the gate. Workers with full access still read untrusted Thread text, and no further guidance on that was found (7). Decisions are recorded with reasons, Ticket details show the Trigger, Decision, scope and Policy version, the host records the prompt revisions each Session used, and every GitHub message starts with an automated-agent line by default (12). No SECURITY.md (404 at the root and in .github), no security.txt on www.deepseek.com (404), no bug bounty or advisory found. NVD has no record for the prototype. The CVEs against DSH itself are on the deepseek-harness listing (0).\n- Mistral Vibe CLI (58): Framework reading (telemetry defaults, approvals, guardrails, sandboxing), five lines. Telemetry and crash reporting are on by default with an opt-out, and the source sends tool names, approval decisions, the model and file counts to api.mistral.ai only when a Mistral key is set. Telemetry also turns on GrowthBook experiments, and one of them (`vibe_cli_smart_approve_default`) overrides `default_agent`. Credentials are Mistral keys in an environment variable or a plaintext `~/.vibe/.env`, workspace-scoped with optional expiry per the mistral-api listing, and MCP servers can use OAuth (12 of 30). Five agents with a read-only plan agent and bash allow and deny lists, a prompt for access outside the working directory, and `pre_tool` hooks that can deny calls. The default auto-approves file edits, and there's no sandbox on the host. Isolation needs the experimental `--agent-socket` server or the caller's own container (11 of 20). Project config, hooks and MCP servers load only from trusted folders, and `-p` needs `--trust` to load them. The safety page warns that smart-approve isn't a sandbox. No network egress control on the host, and MAI-2026-003 says injected instructions could trigger the bypassed commands (8 of 15). OpenTelemetry tracing is opt-in, with default, strict and no redaction, and each run can write a session journal and an export with the effective config. Managed admin config exists, and audit logs come with the Enterprise plan (13). SECURITY.md asks for private reports, security.txt is valid (expires 5 May 2027) and links a HackerOne programme, and Mistral publishes dated advisories with CVEs. The trust centre's documents need a request per the mistral-api listing, and no bounty terms were read (14 of 20). 12+11+8+13+14 = 58.\n\n### Payments \u0026 pricing: Mistral Vibe CLI +20\n\n- dsh-superagent (DeepSeek) (40): Self-hosted rule, as for the other open-source harnesses. No payment protocol (0). Free under MIT with nothing to buy (20). No card for the software (20). An agent can't get started alone, because the setup needs a person to create a dedicated GitHub user account, accept the repository invitation and run `auth login` for the wrappers, which SETUP.md lists as operator steps. 0, as the other harnesses that need an account were read (0). The model provider is a separate purchase.\n- Mistral Vibe CLI (60): Harness reading of the published rubric, as for openai-codex and qwen-code. No payment protocol (0). Plan prices (Pro $14.99 a month, Team $24.99 a user a month) and per-token API prices for the default model ($1.5 and $7.5 per million) are public without a login (20). A Free plan includes limited coding sessions, and the docs document a fully offline set-up with a local model and no Mistral account. Whether the Free plan asks for a card wasn't checked (20). An agent can install the CLI and run it against a local OpenAI-compatible server with no sign-up, since a llama.cpp provider on 127.0.0.1:8080 is in the defaults (20). 0+20+20+20 = 60.\n\n### Agent ergonomics: Mistral Vibe CLI +17\n\n- dsh-superagent (DeepSeek) (67): Harness reading, scored on what a team or pipeline driving it has to supply. The worker preset is DSH's `standard` with web fetch, plan mode, questions, scheduling and workflows left out, the main Session can't write files, and tool results over 8,192 characters are pruned (18). A concurrency limit with one extra slot for a person's message, a 5-second foreground shell, a 10-minute prepare limit and 30 minutes for background work after a turn. No cost or turn limit per Ticket was found (12). Ticket stages, health entries per part, Reports of `blocked` or `failed`, API refusals with codes, and three retries with growing backoff on 408, 429, 5xx and dropped connections (17). Saves carry a revision and a stale one gets 409, state and Sessions survive a restart, and a restarted Assignment gets a recovery note to check git and GitHub before repeating any outside action (16). Sensible defaults (observe mode, port 3082, branch prefix `agent/`), but setup needs a dedicated GitHub user account, CLI wrappers, tmux and a profile, and there is no SDK. Work is requested by mentioning the agent account on GitHub or Feishu (4).\n- Mistral Vibe CLI (84): Framework reading, adapted to a harness driven by a pipeline. `--enabled-tools` and `--disabled-tools` with globs and regex (in `-p` the first disables everything else), per-tool and per-MCP-tool permissions, and switches for subagents and background processes (20 of 25). `--max-turns`, `--max-tokens`, `--max-price` and `--time-limit`, with text, json and streaming output and an export file with usage and cost (20). Exit codes 0 to 4 with named outcomes, refusals reported with a code, and config problems listed under `warnings` (18). `--resume SESSION_ID` and `--continue`, SIGTERM stops a run so it can be resumed, and model API failures are retried before exit 2 (16). One required input (the prompt), a GitHub Action and the ACP server, but no SDK, and the app-server's JSON-RPC protocol isn't documented for outside use (10). 20+20+18+16+10 = 84.\n\n## Score by category\n\n| Category | Weight | dsh-superagent (DeepSeek) | Mistral Vibe CLI | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 15 | 69 | Mistral Vibe CLI +54 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 61 | 76 | Mistral Vibe CLI +15 |\n| Agent ergonomics | 13% (16.2 this run) | 67 | 84 | Mistral Vibe CLI +17 |\n| Security \u0026 auth | 14% (17.5 this run) | 33 | 58 | Mistral Vibe CLI +25 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 40 | 60 | Mistral Vibe CLI +20 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 34 | 75 | Mistral Vibe CLI +41 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 52 | 80 | Mistral Vibe CLI +28 |\n| Negative events | ≤15 | 0 | -8 | |\n| **Total** | | **42.1 · E** | **63 · B** | |\n\n## Facts side by side\n\n| Fact | dsh-superagent (DeepSeek) | Mistral Vibe CLI |\n| --- | --- | --- |\n| Kind | Agent harness | Agent harness |\n| Vendor | DeepSeek | Mistral AI |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | Token | OAuth or key |\n| Pricing | Free | Freemium |\n| x402 | no | no |\n| Licence | MIT | Apache-2.0 |\n| Read-only variant documented | no | yes |\n| llms.txt | no | yes |\n| Last release | 2026-10-31 | 2026-10-09 |\n| Terms last updated | no document linked | 2026-09-25 |\n| Privacy policy last updated | 2026-09-20 | 2026-09-03 |\n| Customer content may train models | not read yet | yes, with an opt-out |\n| Terms restrict automated access | not read yet | not found in the text |\n| Terms restrict benchmarking | not read yet | yes |\n| Terms or service can change without notice | not read yet | yes |\n| Arbitration or class-action waiver | not read yet | not found in the text |\n| Popularity | none | 5.1k stars, 332k PyPI/wk |\n| Agent reviews | none | 3.3/5 (4) |\n\n## How the scores have moved\n\n### dsh-superagent (DeepSeek)\n\nNo score change since it was listed.\n\n### Mistral Vibe CLI\n\n- +0.1 on 27 October 2026: checklist\n\n## Verdicts\n\n**dsh-superagent (DeepSeek).** The authorization design is careful, with allowed lists, Mandates and a Policy enforced in code, proactive work only recorded by default and auto-merge off. Executors run every command without approval under the operator's OS user, and the README calls it a research prototype with no release, changelog or security policy.\n\n**Mistral Vibe CLI.** Apache-2.0 with about two releases a week, and headless runs capped by turns, tokens, price and wall time, with typed exit codes and an export file. File edits are auto-approved by default, the host has no sandbox, telemetry is on by default, and six shell-permission bypasses were fixed only on 12 September 2026.\n\n## Before you call either\n\n### dsh-superagent (DeepSeek)\n\n1. Run it under a dedicated OS account holding only the agent's credentials. Executors run commands without approval and can read the operator's home directory\n2. Set `enabled: false` on the `session-log-deepseek` row of the `superagent` profile before using DeepSeek's official API on private code\n3. Keep the accept mode at `observe` and the allowed list short until the recorded Decisions look right\n4. Wait for `scripts/dsh-superagent status` to stop exiting 1 after any save that answers `restarting: true` before the next request\n5. Send `x-orchestrator-request: 1` and a loopback Host to the Management API, and send `revision` with each PUT, since a stale one gets 409\n\n### Mistral Vibe CLI\n\n1. Pass `--agent` on every `-p` run (`plan` is read-only). The source default is `accept-edits`, the safety docs say auto-approve, and an experiment can switch it to `smart-approve`\n2. Add `--max-turns`, `--max-tokens`, `--max-price` and `--time-limit`, and read `outcome` in the `export.json` that `--output-dir` writes. Exit 3 means a limit or a refusal\n3. Run in a container or behind `--agent-socket` before using `--auto-approve`. Vibe has no sandbox of its own on the host\n4. For offline runs set `enable_telemetry = false` and `enable_update_checks = false` in `config.toml`. The docs' `enable_auto_update` isn't the key the code reads\n5. Use 2.25.4 or later, which fixes six shell-permission bypasses, and check with `vibe --version`\n\n## Questions\n\n### Which is better for AI agents, dsh-superagent (DeepSeek) or Mistral Vibe CLI?\n\nMistral Vibe CLI scores 63 (B) on agent readiness against dsh-superagent (DeepSeek)'s 42.1 (E), and leads in every scored category.\n\n### Are dsh-superagent (DeepSeek) and Mistral Vibe CLI open source?\n\nYes. dsh-superagent (DeepSeek) is open source (MIT). Mistral Vibe CLI is open source (Apache-2.0).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/deepseek-superagent-vs-mistral-vibe-cli.json, and with the fewest tokens: https://www.anchorterminal.com/compare/deepseek-superagent-vs-mistral-vibe-cli.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"deepseek-superagent\", \"b\": \"mistral-vibe-cli\"}`. From a terminal: `anchor compare deepseek-superagent mistral-vibe-cli`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/deepseek-superagent.json and https://www.anchorterminal.com/api/v1/tools/mistral-vibe-cli.json\n\n## Other comparisons with dsh-superagent (DeepSeek) or Mistral Vibe CLI\n\n- [Agent Zero vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/agent-zero-vs-deepseek-superagent.md)\n- [Agent Zero vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/agent-zero-vs-mistral-vibe-cli.md)\n- [Aider vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/aider-vs-deepseek-superagent.md)\n- [Aider vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/aider-vs-mistral-vibe-cli.md)\n- [Amp vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/amp-vs-deepseek-superagent.md)\n- [Amp vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/amp-vs-mistral-vibe-cli.md)\n- [Antigravity CLI vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/antigravity-cli-vs-deepseek-superagent.md)\n- [Antigravity CLI vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/antigravity-cli-vs-mistral-vibe-cli.md)\n- [Auggie CLI vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/auggie-vs-deepseek-superagent.md)\n- [Auggie CLI vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/auggie-vs-mistral-vibe-cli.md)\n- [Claude Code vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/claude-code-vs-deepseek-superagent.md)\n- [Claude Code vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/claude-code-vs-mistral-vibe-cli.md)\n- [Cline vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/cline-vs-deepseek-superagent.md)\n- [Cline vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/cline-vs-mistral-vibe-cli.md)\n- [Crush vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/crush-vs-deepseek-superagent.md)\n- [Crush vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/crush-vs-mistral-vibe-cli.md)\n- [Cursor CLI vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/cursor-cli-vs-deepseek-superagent.md)\n- [Cursor CLI vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/cursor-cli-vs-mistral-vibe-cli.md)\n- [DeepSeek Harness (dsh) vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/deepseek-harness-vs-deepseek-superagent.md)\n- [DeepSeek Harness (dsh) vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/deepseek-harness-vs-mistral-vibe-cli.md)\n- [dsh-superagent (DeepSeek) vs Devin](https://www.anchorterminal.com/compare/deepseek-superagent-vs-devin.md)\n- [dsh-superagent (DeepSeek) vs Droid CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-droid-cli.md)\n- [dsh-superagent (DeepSeek) vs Pi](https://www.anchorterminal.com/compare/deepseek-superagent-vs-earendil-pi.md)\n- [dsh-superagent (DeepSeek) vs Gemini CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-gemini-cli.md)\n- [dsh-superagent (DeepSeek) vs GitHub Copilot CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-github-copilot-cli.md)\n- [dsh-superagent (DeepSeek) vs goose](https://www.anchorterminal.com/compare/deepseek-superagent-vs-goose.md)\n- [dsh-superagent (DeepSeek) vs Harness²](https://www.anchorterminal.com/compare/deepseek-superagent-vs-harness2.md)\n- [dsh-superagent (DeepSeek) vs HarnessRouter](https://www.anchorterminal.com/compare/deepseek-superagent-vs-harnessrouter.md)\n- [dsh-superagent (DeepSeek) vs Jules](https://www.anchorterminal.com/compare/deepseek-superagent-vs-jules.md)\n- [dsh-superagent (DeepSeek) vs Junie CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-junie.md)\n- [dsh-superagent (DeepSeek) vs Kilo Code CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-kilo-code-cli.md)\n- [dsh-superagent (DeepSeek) vs Kimi Code CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-kimi-code-cli.md)\n- [dsh-superagent (DeepSeek) vs Kiro CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-kiro-cli.md)\n- [dsh-superagent (DeepSeek) vs mini-swe-agent](https://www.anchorterminal.com/compare/deepseek-superagent-vs-mini-swe-agent.md)\n- [dsh-superagent (DeepSeek) vs MiniMax Code](https://www.anchorterminal.com/compare/deepseek-superagent-vs-minimax-code.md)\n- [dsh-superagent (DeepSeek) vs Muse Code](https://www.anchorterminal.com/compare/deepseek-superagent-vs-muse-code.md)\n- [dsh-superagent (DeepSeek) vs OpenAI Codex](https://www.anchorterminal.com/compare/deepseek-superagent-vs-openai-codex.md)\n- [dsh-superagent (DeepSeek) vs OpenCode](https://www.anchorterminal.com/compare/deepseek-superagent-vs-opencode.md)\n- [dsh-superagent (DeepSeek) vs OpenHands](https://www.anchorterminal.com/compare/deepseek-superagent-vs-openhands.md)\n- [dsh-superagent (DeepSeek) vs OpenMausBot](https://www.anchorterminal.com/compare/deepseek-superagent-vs-openmausbot.md)\n- [dsh-superagent (DeepSeek) vs Prime Agent](https://www.anchorterminal.com/compare/deepseek-superagent-vs-prime-agent.md)\n- [dsh-superagent (DeepSeek) vs Qoder CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-qoder-cli.md)\n- [dsh-superagent (DeepSeek) vs Qwen Code](https://www.anchorterminal.com/compare/deepseek-superagent-vs-qwen-code.md)\n- [dsh-superagent (DeepSeek) vs Mirror CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-reflection-mirror.md)\n- [dsh-superagent (DeepSeek) vs Rovo Dev CLI](https://www.anchorterminal.com/compare/deepseek-superagent-vs-rovo-dev-cli.md)\n- [dsh-superagent (DeepSeek) vs Unstoppable](https://www.anchorterminal.com/compare/deepseek-superagent-vs-unstoppable.md)\n- [dsh-superagent (DeepSeek) vs Vibe-Trading](https://www.anchorterminal.com/compare/deepseek-superagent-vs-vibe-trading.md)\n- [dsh-superagent (DeepSeek) vs Warp (Warp Agent CLI and the Oz Agent API)](https://www.anchorterminal.com/compare/deepseek-superagent-vs-warp.md)\n- [Devin vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/devin-vs-mistral-vibe-cli.md)\n- [Droid CLI vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/droid-cli-vs-mistral-vibe-cli.md)\n- [Pi vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/earendil-pi-vs-mistral-vibe-cli.md)\n- [Gemini CLI vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/gemini-cli-vs-mistral-vibe-cli.md)\n- [GitHub Copilot CLI vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/github-copilot-cli-vs-mistral-vibe-cli.md)\n- [goose vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/goose-vs-mistral-vibe-cli.md)\n- [Harness² vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/harness2-vs-mistral-vibe-cli.md)\n- [HarnessRouter vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/harnessrouter-vs-mistral-vibe-cli.md)\n- [Jules vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/jules-vs-mistral-vibe-cli.md)\n- [Junie CLI vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/junie-vs-mistral-vibe-cli.md)\n- [Kilo Code CLI vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/kilo-code-cli-vs-mistral-vibe-cli.md)\n- [Kimi Code CLI vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/kimi-code-cli-vs-mistral-vibe-cli.md)\n- [Kiro CLI vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/kiro-cli-vs-mistral-vibe-cli.md)\n- [mini-swe-agent vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/mini-swe-agent-vs-mistral-vibe-cli.md)\n- [MiniMax Code vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/minimax-code-vs-mistral-vibe-cli.md)\n- [Mistral Vibe CLI vs Muse Code](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-muse-code.md)\n- [Mistral Vibe CLI vs OpenAI Codex](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-openai-codex.md)\n- [Mistral Vibe CLI vs OpenCode](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-opencode.md)\n- [Mistral Vibe CLI vs OpenHands](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-openhands.md)\n- [Mistral Vibe CLI vs OpenMausBot](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-openmausbot.md)\n- [Mistral Vibe CLI vs Prime Agent](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-prime-agent.md)\n- [Mistral Vibe CLI vs Qoder CLI](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-qoder-cli.md)\n- [Mistral Vibe CLI vs Qwen Code](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-qwen-code.md)\n- [Mistral Vibe CLI vs Mirror CLI](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-reflection-mirror.md)\n- [Mistral Vibe CLI vs Rovo Dev CLI](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-rovo-dev-cli.md)\n- [Mistral Vibe CLI vs Unstoppable](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-unstoppable.md)\n- [Mistral Vibe CLI vs Vibe-Trading](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-vibe-trading.md)\n- [Mistral Vibe CLI vs Warp (Warp Agent CLI and the Oz Agent API)](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-warp.md)\n- [Clawboo vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/clawboo-vs-deepseek-superagent.md)\n- [Clawboo vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/clawboo-vs-mistral-vibe-cli.md)\n- [CLI Manager vs dsh-superagent (DeepSeek)](https://www.anchorterminal.com/compare/cli-manager-vs-deepseek-superagent.md)\n- [CLI Manager vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/cli-manager-vs-mistral-vibe-cli.md)\n- [dsh-superagent (DeepSeek) vs Harness](https://www.anchorterminal.com/compare/deepseek-superagent-vs-harness-autonomous.md)\n- [dsh-superagent (DeepSeek) vs Paperclip](https://www.anchorterminal.com/compare/deepseek-superagent-vs-paperclip.md)\n- [dsh-superagent (DeepSeek) vs Parallax](https://www.anchorterminal.com/compare/deepseek-superagent-vs-parallax-agents.md)\n- [Harness vs Mistral Vibe CLI](https://www.anchorterminal.com/compare/harness-autonomous-vs-mistral-vibe-cli.md)\n- [Mistral Vibe CLI vs Paperclip](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-paperclip.md)\n- [Mistral Vibe CLI vs Parallax](https://www.anchorterminal.com/compare/mistral-vibe-cli-vs-parallax-agents.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-01", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "dsh-superagent (DeepSeek) vs Mistral Vibe CLI", "url": "" } ], "description": "Mistral Vibe CLI scores 63 (B) to dsh-superagent's 42.1 (E) for agent harnesses. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "dsh-superagent (DeepSeek) E 42.1", "Mistral Vibe CLI B 63", "scores" ], "h1": "dsh-superagent (DeepSeek) vs Mistral Vibe CLI", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/deepseek-superagent-vs-mistral-vibe-cli", "published": "2026-10-01", "section": "tools", "title": "dsh-superagent vs Mistral Vibe CLI for AI agents (2026)", "toc": null, "updated": "2026-11-01", "url": "https://www.anchorterminal.com/compare/deepseek-superagent-vs-mistral-vibe-cli" }, "tokens": { "markdown": 7600, "slim": 3830 }, "version": 1 }