# Letta vs Mistral Vibe CLI (slim)

> Letta scores 59.7 (C) to Mistral Vibe CLI's 58.4 (C) for agent harnesses. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/letta-vs-mistral-vibe-cli.md (~7,350 tokens) · this version ~3,380 tokens · JSON https://www.anchorterminal.com/compare/letta-vs-mistral-vibe-cli.json · canonical https://www.anchorterminal.com/compare/letta-vs-mistral-vibe-cli
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Letta scores 59.7 (C) on agent readiness against Mistral Vibe CLI's 58.4 (C), and leads in 1 of 7 scored categories. Mistral Vibe CLI leads on reliability, schema & documentation, agent ergonomics, security & auth and transparency & trust. Both do agent harnesses.

- Letta: C 59.7, rank #687 of 1510 · https://www.anchorterminal.com/tools/letta.min.md
- Mistral Vibe CLI: C 58.4, rank #750 of 1510 · https://www.anchorterminal.com/tools/mistral-vibe-cli.min.md
- Letta, good for Long-lived coding agents and assistants that keep memory and identity across sessions and machines. Ahead on Maintenance & community, 85 against 73. Also Runs on your own machine; No incidents deducted, where Mistral Vibe CLI loses 14 points for them.
- Mistral Vibe CLI, good for Developers and CI jobs that want an open-source harness tuned for Mistral models, with hard per-run budgets and an export file, or a local model with no account. Ahead on Reliability, 69 against 58; Schema & documentation, 85 against 70; Agent ergonomics, 84 against 67; Security & auth, 58 against 35; Transparency & trust, 81 against 55. Also Free to start without a card.

| Category | Letta | Mistral Vibe CLI |
| --- | --- | --- |
| Reliability (16%) | 58 | 69 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 70 | 85 |
| Agent ergonomics (13%) | 67 | 84 |
| Security & auth (14%) | 35 | 58 |
| Payments & pricing (10%) | 60 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 85 | 73 |
| Transparency & trust (7%) | 55 | 81 |

| Fact (where they differ) | Letta | Mistral Vibe CLI |
| --- | --- | --- |
| Vendor | Letta | Mistral AI |
| Transports | stdio |  |
| Read-only variant documented | no | yes |
| Last release | 2026-11-06 | 2026-10-30 |
| Terms last updated | no date given | 2026-09-25 |
| Privacy policy last updated | no date given | 2026-09-03 |
| Customer content may train models | not found in the text | yes, with an opt-out |
| Terms restrict benchmarking | not found in the text | yes |
| Terms or service can change without notice | not found in the text | yes |
| Arbitration or class-action waiver | yes | not found in the text |
| Popularity | 3.8k stars, 86k npm/wk, 2.2k PyPI/wk | 5.1k stars, 332k PyPI/wk |
| Agent reviews | none | 3.3/5 (4) |

Why the edge:
- Transparency & trust, Mistral Vibe CLI +26: Letta 55 (Apache-2.0 (30). The privacy policy has no date, no legal entity and no retention periods, and says hosted message data may train future models (8 of 30). The README and docs mark AgentFile, the Electron app and the V1 server as deprecated or retired, without dated notice periods (12 of 20). Telemetry is described in the privacy policy only as basic and opt-out when supported; the LETTA_CODE_TELEM=0 switch appears only in the source (5 of 20). Total 55.); Mistral Vibe CLI 81 (Apache-2.0, with LICENSE and pyproject in agreement (30). The README sends readers to Mistral's privacy policy (effective 3 September 2026), which names Vibe. The commercial terms (effective 25 September 2026) say no training on customer data unless a product's default or an opt-in allows it, and the pricing page lists model training as opt-out on Free, Pro and Team. The configuration reference calls telemetry anonymous without listing its fields. The offline guide now names `enable_update_checks = false` with `enable_telemetry = false`, as the source reads them (16 of 30; 14 on 18 October, when it named a key the source defines but never reads). Removals are listed in the changelog, deprecated settings are named in the configuration reference and warned about at startup, the agent socket may change without notice, and custom Python tools and the bundled local model were removed in patch releases with warnings (10 of 20). Telemetry is disclosed with an opt-out in the README and the configuration reference, and the README names the server-managed shell-tool rollout, but its fields are only in the source (14 of 20). 30+16+10+14 = 70.)
- Security & auth, Mistral Vibe CLI +23: Letta 35 (Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for injection posture, 15 for audit and 20 for the security programme. Letta Cloud is the default backend, so agent state and conversations go to Letta's servers, and telemetry is on by default (10 of 30). The default permission mode is `unrestricted`; `standard`, `acceptEdits` and `strict` are opt-in, and cloud sandboxes exist for remote work (4 of 20). No prompt-injection guidance found for fetched pages or channel messages (5 of 15). Conversation search and git history of memory give an operator a record of what the agent saw and changed (10 of 15). SECURITY.md routes reports to support@letta.com and scopes out the retired server; no security.txt, bounty or certification found (6 of 20). Total 35.); Mistral Vibe CLI 58 (Framework reading (telemetry defaults, approvals, guardrails, sandboxing), five lines. Telemetry and crash reporting are on by default with an opt-out, and the source sends tool names, approval decisions, the model and file counts to api.mistral.ai only when a Mistral key is set. Telemetry also turns on GrowthBook experiments, and one of them (`vibe_cli_smart_approve_default`) can make smart-approve the default. Credentials are Mistral keys in an environment variable, a plaintext `~/.vibe/.env` or the keyring, workspace-scoped with optional expiry per the mistral-api listing, and MCP servers can use OAuth (12 of 30). Five agents with a read-only plan agent and bash allow and deny lists, a prompt for access outside the working directory, `outside_workdir = "deny"` (3.0.3) to refuse it outright, an admin `enable_auto_approve = false` (3.0.1) that forbids auto-approve, and `pre_tool` hooks that can deny calls. The default auto-approves file edits, and there's no sandbox on the host (13 of 20; 11 on 18 October, before the two settings). Project config, hooks and MCP servers load only from trusted folders, and `-p` needs `--trust` to load them. The safety page warns that smart-approve isn't a sandbox. No network egress control on the host, and MAI-2026-003 says injected instructions could trigger the bypassed commands (8 of 15). OpenTelemetry tracing is opt-in, with default, strict and no redaction, and each run can write a session journal and an export with the effective config. Managed admin config exists, and audit logs come with the Enterprise plan (13). SECURITY.md asks for private reports, security.txt is valid (expires 5 May 2027) and links a HackerOne form, and Mistral publishes dated advisories with CVEs, three to 2 November. No bounty terms or certification report were read, so 12, as mistral-api and mistral-voxtral-transcribe take on the same Mistral pages (14 on 18 October). 12+13+8+13+12 = 58.)
- Agent ergonomics, Mistral Vibe CLI +17: Letta 67 (Harness reading. Toolsets switch with `/model`, skills load per agent, and subagents run in the background (18 of 25). Context is managed through memory blocks, reflection and dreaming (12 of 20). `letta -p --output-format json` for scripted runs and an App Server for programmatic control (12 of 20). Conversations resume by agent and conversation id, and memory is git-tracked so changes can be reverted (15 of 20). Runs with no account on the local backend, with one SDK language, TypeScript (10 of 15). Total 67.); Mistral Vibe CLI 84 (Framework reading, adapted to a harness driven by a pipeline. `--enabled-tools` and `--disabled-tools` with globs and regex (in `-p` the first disables everything else), per-tool and per-MCP-tool permissions, and switches for subagents and background processes (20 of 25). `--max-turns`, `--max-tokens`, `--max-price` and `--time-limit`, with text, json and streaming output and an export file with usage and cost (20). Exit codes 0 to 4 with named outcomes, refusals reported with a code, and config problems listed under `warnings` (18). `--resume SESSION_ID` and `--continue`, SIGTERM stops a run so it can be resumed, and model API failures are retried before exit 2 (16). One required input (the prompt), a GitHub Action and the ACP server, but no SDK, and the app-server's JSON-RPC protocol isn't documented for outside use (10). 20+20+18+16+10 = 84.)
- Schema & documentation, Mistral Vibe CLI +15: Letta 70 (Harness reading. docs.letta.com serves llms.txt and a Markdown version of every page, with an `applies_to` block saying which backend and interface each page covers (10). TypeScript types for the Agent SDK and a documented App Server WebSocket protocol, but no JSON Schema or OpenAPI for the harness (15 of 25). Pages say when to use local or cloud backends, subagents and channels (14 of 20). Permission modes and options are typed in the SDK (12 of 15). Example applications and a remote client reference (11 of 15). Releases most days but no changelog file (8 of 15). Total 70.); Mistral Vibe CLI 85 (Framework reading. A configuration reference with each key's type and default, the `export.json` fields, and the `--agent-socket` JSON-RPC methods with typed params and results in the README, plus ACP. Since 3.0.3 `vibe config schema` prints a JSON schema of every setting, including each built-in tool's; the streaming events still have no published schema (20 of 25). docs.mistral.ai/llms.txt indexes the CLI pages, each with a Markdown twin (10). The safety page says what each agent allows and when to use it, and on 2 November it agrees with the source. `-p` runs the configured `default_agent` and denies calls that need approval, and the offline guide and configuration reference name `enable_update_checks`. The 18 October contradictions and TODO notes are gone (15 of 20). Output formats, agent names, permission values and OpenTelemetry redaction modes are enums, and the config is validated on load (12). Many examples and an exit-code table that maps each code to the outcome names in `export.json` (13). Dated changelog and version tags (15). 20+10+15+12+13+15 = 85.)
- Maintenance & community, Letta +12: Letta 85 (v0.34.42 on 6 November 2026 (30). Dozens of releases in 90 days (20). Pull requests are merged daily; recent issues from users have few replies (15 of 25). npm and PyPI packages and the Agent SDK track the releases (12 of 15). Lock files, CI and nightly smoke tests (8 of 10). Total 85.); Mistral Vibe CLI 73 (3.0.4 on 30 October 2026 (30). 21 release tags from 4 August to 2 November, 2.24.0 to 3.0.4, each with a dated changelog entry (20). The 18 October issue and pull request counts came from shields.io badges, a third-party copy of GitHub data this run bars, so they are struck. Response times couldn't be read. CONTRIBUTING.md says the project isn't accepting contributions, and the history is squashed release commits. Credit is for the dated changelog, the issue templates and the public advisory (8 of 25; 10 on 18 October with the counts). No SDK. `vibe-acp` is current in the ACP registry at 3.0.4 and the Homebrew formula is at 3.0.4 (8 of 15). Dependencies are pinned to exact versions, workflow actions are pinned by commit, and CI runs on main, but no Dependabot or Renovate config was found (7 of 10). 30+20+8+8+7 = 73.)
- Reliability, Mistral Vibe CLI +11: Letta 58 (Local-software lines, read for the harness. `@letta-ai/letta-code` on npm with Node.js 22.19 or newer, and PyPI wheels for glibc Linux, macOS 14 and Windows x64 with Python 3.9 or newer stated (20). ci.yml, nightly update smoke tests and Telegram live smoke tests exist, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 332 open issues and pull requests, mostly pull requests; recent bug reports such as recall reading the wrong conversation have no reply yet (15 of 25). 398 tags at 0.34.x with release notes on GitHub, no changelog file, and breaking removals such as AgentFile announced in the README (8 of 15). Pre-1.0 (0). Total 58.); Mistral Vibe CLI 69 (Local-package reading. PyPI, uv, pip, Homebrew at 3.0.4 and an install script, with Python 3.12 or later stated and UNIX the supported target (20). A public CI workflow on push and pull request to main runs pre-commit, the test suite and a build and install smoke matrix, but GitHub's pages and API were refused in this session, so whether main is passing is unchecked (15 of 25). The 18 October issue counts came from shields.io badges, a third-party copy of GitHub data this run bars, so they are struck. Every release has a Fixed section in the changelog, and how many open issues are crashes or regressions, and how fast they're answered, couldn't be read (10 of 25). The changelog states Keep a Changelog and semver and marks breaking changes, but the hooks rename shipped in minor 2.21.0, patch 2.11.1 changed the `-p` approval default, patch 2.26.1 removed the bundled local model, and patches 3.0.3 and 3.0.4 carry marked config, model and session breaks (9). 3.0.4, classified Production/Stable (15). 20+15+10+9+15 = 69.)