goose vs Mistral Vibe CLI

goose

Telemetry off until the user opts in, with the collected fields listed. Autonomous mode, which approves every tool call, is the default.

Mistral Vibe CLI

Apache-2.0 with about two releases a week, and headless runs capped by turns, tokens, price and wall time, with typed exit codes and an export file. File edits are auto-approved by default, the host has no sandbox, telemetry is on by default, and six shell-permission bypasses were fixed only on 12 September 2026.

goose

1. Set GOOSE_MODE=smart_approve or approve before a run. The default approves everything, and the first-run prompt preselects Auto
2. Pass --max-turns with a real limit. The default is 1000
3. Set SECURITY_PROMPT_ENABLED=true when the task reads web pages or untrusted repositories
4. Use --output-format json and --no-session in CI, and check the exit code
5. Point remotes and links at aaif-goose/goose and goose-docs.ai. The block/goose paths redirect

Mistral Vibe CLI

1. Pass --agent on every -p run (plan is read-only). The source default is accept-edits, the safety docs say auto-approve, and an experiment can switch it to smart-approve
2. Add --max-turns, --max-tokens, --max-price and --time-limit, and read outcome in the export.json that --output-dir writes. Exit 3 means a limit or a refusal
3. Run in a container or behind --agent-socket before using --auto-approve. Vibe has no sandbox of its own on the host
4. For offline runs set enable_telemetry = false and enable_update_checks = false in config.toml. The docs' enable_auto_update isn't the key the code reads
5. Use 2.25.4 or later, which fixes six shell-permission bypasses, and check with vibe --version