Mistral AI API vs SWE-2 Flash

Mistral AI API 91

Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors), per the 2 and 12 October checks. Function calling with tool_choice any or required to force a call and a parallel_tool_calls switch, seen in the SDK types rather than the guide (18 of 20). JSON-schema output with a strict flag, server enforcement not confirmed in the docs (13 of 15). Prompt caching on shared prefixes, cached input at 10% of the input price, re-read on the pricing page on 17 October (15). 256,000-token context on Medium 3.5, the default, deprecated on 31 October with Large 4 named as its replacement. Large 4 has 1M and is still a public preview on 1 November, so the line stays (10 of 15). A stateless Responses API (/v1/responses) arrived in the 23 October SDKs. Batch at half price (10). Official SDKs for Python and TypeScript (10). Error glossary (15). 18+13+15+10+10+10+15 = 91.

SWE-2 Flash 10

Model reading (tool use, structured output, caching, context, batch, SDKs). Tool use is Devin's harness, not something a caller configures; no context length, output limit or cache price is published for SWE-2 Flash (5 of 25). No documented output-size or reasoning controls for this model; SWE-2's effort levels aren't stated for Flash (0 of 20). No model-level error documentation (0 of 20). No idempotency or retry guidance (0 of 20). One flag or picker selects it and devin -p runs a single turn and prints to stdout, but there is no SDK or direct endpoint (5 of 15). 5 + 0 + 0 + 0 + 5 = 10.

Mistral AI API 93

Public OpenAPI 3.1.0 document at docs.mistral.ai/openapi.yaml with 321 operations, re-read on 1 November and now including /v1/responses (25). llms.txt with Markdown twins of every page, re-read on 1 November (10). Reference not read in full (15 of 20). Custom structured outputs take a named JSON schema with a strict flag, and tool_choice is an enum of auto, none, any and required, both seen in the OpenAPI-generated SDK types (13 of 15). Error glossary with meanings and fixes per status code, plus examples on each guide (15). Release notes and dated model versions (15). 25+10+15+13+15+15 = 93.

SWE-2 Flash 29

Model reading. No model API, so no OpenAPI entry; the Devin v3 OpenAPI file lists SWE-2 agents only, and no model card was found (0). docs.devin.ai serves llms.txt and Markdown copies of every page (10). The launch post says what it is for (automations, code review, feature development, documentation) and the CLI docs say when to pick a SWE model, but the models pages don't list SWE-2 Flash yet (6 of 20). No documented model ID, reasoning settings, context or output limits to type (0 of 15). The CLI pages show --model and /model examples, with no model-specific errors (3 of 15). Named, dated model versions on Cognition's blog and public release notes, but no release note for SWE-2 Flash yet; the newest is 2 November (10 of 15). 0 + 10 + 6 + 0 + 3 + 10 = 29.

Mistral AI API 80

Model reading. DeepSeek V4.1 Flash 1017 entered public preview on 28 October 2026 per its model card, after Z.ai GLM 5.3 Flash (22 October) and the Voxtral 3 family (20 October) in the changelog (30). Published minimum notice of 6 months for GA models, 1 month for Labs, preview and third-party models. Medium 3.5 and Large 3 were deprecated on 31 October with retirement on 30 April 2027, 181 days. But Mistral Medium 3 (mistral-medium-2505) and Medium 3.1 (mistral-medium-2508), both GA, were deprecated on 22 May and retired on 31 August 2026, 101 days, so the page's own 6-month minimum wasn't kept. 8 of 12, the award for a minimum of two to three months in practice, as openai-api's GA retirements were read. Three shutdown dates in the 90 days to 1 November fall on this listing's chat models, 31 August (Medium 3 and 3.1), 30 September (Leanstral 1.5, Labs, dated at release) and 31 October (Z.ai GLM 5.2, third-party, 32 days). Two of the three kept the published notice, so 4 of 8, as openai-api was read. The 17 October count missed 31 August. OCR 4.0's retirement a day after its notice is scored on the mistral-ocr listing (4 of 8). Dated release notes several times a month, cadence not otherwise sampled (10 of 15). SDK repo replies not sampled (5 of 10). mistralai 3.6.0 and @mistralai/mistralai 3.4.0 on 27 October per each repository's RELEASES.md (git tags stop at 3.2.0 and 3.0.0 of 9 October), with a v2 to v3 migration guide (15 of 15). Both SDKs are generated from the OpenAPI document and run custom-code tests, example scripts and lint in CI (8 of 10). 30+8+4+10+5+15+8 = 80.

SWE-2 Flash 53

Model reading. Released 4 November 2026 (30). Churn and notice in place of release counts: SWE-1.6, SWE-1.7, SWE-1.7 Lightning, SWE-2 (10 September) and now SWE-2 Flash in a few months, with no model deprecation notice period found and short names that move to the newest model (10 of 20). Public release notes and a support address, no public tracker (10 of 25). No official SDK for the model (0 of 15). The docs are kept current but don't yet cover this model (3 of 10). 30 + 10 + 10 + 0 + 3 = 53.

Mistral AI API 73

Model reading. Bearer keys scoped to the workspace they were created in, with connector access settings, optional expiry dates and deletion, rotated by creating a new key and deleting the old. Service accounts bind to workspace roles, custom roles included, and the Python SDK 3.0.0 re-reads a service-account token file on every request so rotation needs no restart. Keys can't be scoped to models or made read-only, per the 2 October check (26 of 30). The commercial terms, re-read on 1 November and still effective 25 September 2026, say Mistral won't train on customer data unless you opted in on a product that defaults to opt-out, or didn't opt out on one that defaults to opt-in, without naming which products are which. Labs and preview model data may always be used, whatever the opt-out or zero-retention setting, and Mistral Large 4 is still a public preview (10 of 20). 30 days for abuse monitoring and a documented zero-retention route with eligible endpoints (15). Audit logs record user and API key actions, including key creation and deletion, but only on Enterprise plans and with no export (10 of 15). security.txt re-read on 1 November, with a security@mistral.ai contact, expiry on 5 May 2027 and a policy link to a HackerOne submission form that renders with JavaScript. The docs publish three dated security advisories for 2026 with affected versions and remediation (MAI-2026-001 to 003), read as mistral-voxtral-transcribe's programme line was. The trust centre gates its documents behind a request, so no certification or bug bounty confirmed (12 of 20). 26+10+15+10+12 = 73.

SWE-2 Flash 53

Read as a hosted model reached through Devin's local clients. The CLI signs in through a browser, or the enterprise identity provider, and stores an API token in credentials.toml that by default is persistent and does not expire and carries the user's access, with no scopes found for it (10 of 30). Devin CLI documents an OS-level sandbox with network filtering, hooks that can block tool calls, and enterprise model allowlists and team settings (14 of 20). Guardrails against prompt injection are Enterprise only and cover user messages, as on the devin listing (8 of 15). Enterprise analytics count tool calls and consumption by model and user; no per-user audit log for the CLI was found (8 of 15). SOC 2 Type II and ISO/IEC 27001:2022, a disclosure address, no bug bounty and no security.txt, per the devin listing (13 of 20). Training: self-serve customer data may train Cognition's models by default, with an opt-out on paid plans that also turns on zero data retention at model providers. Cognition withheld the weights over cyber misuse, which is recorded as a fact, not scored. 10 + 14 + 8 + 8 + 13 = 53.

Mistral AI API 40

No machine payment protocol (0). Per-token prices published without a login, re-read on 1 November. Mistral Large 4 is now listed at $0.70/$2.10 with cached input at $0.07 (the 17 October check read $1.36/$4.18 with a launch sale), and cached input is 10% across the range (20). Timestral has no API price because it isn't served on the API. Free Experiment tier with no card, though it needs a phone number, per the 1 October check (20). Browser sign-up (0). 0+20+20+0 = 40.

SWE-2 Flash 20

Published rubric. No payment protocol (0). Plan prices are public, but no per-token price for SWE-2 Flash is on a readable page; the docs' cost table loads in the browser and the post gives only 'one-fifth the price' of SWE-2 (10). Free through 30 November 2026 on Devin Desktop and CLI, but the docs say Free tier users only have SWE-1.6, so whether the Free plan reaches it, and without a card, isn't confirmed; the in-between value used on the devin listing (10). A person signs in through a browser (0). 0 + 10 + 10 + 0 = 20.

Mistral AI API 80

Closed service with clear terms, SDKs Apache-2.0, and several models published as open weights. Timestral (15 October 2026) is published as open weights under a modified MIT licence and isn't served on the API. Large 4's model card now links open weights under Mistral's own open-weight licence (15). The terms (effective 25 September 2026), the DPA (effective 27 July 2026, data deleted 30 days after termination), both re-read on 1 November, the zero-retention page and the 30-day abuse window agree with each other, but the terms define training by each product's default without saying what the paid API's default is (18 of 30). Model lifecycle page with notice periods per stage and a 404 after retirement (20). The DPA points to a subprocessor list at trust.mistral.ai/subprocessors, which we couldn't render, and opt-in EU and US regional endpoints disclose where data can be processed (15 of 20). 15+18+20+15 = 68.

SWE-2 Flash 64

Editorial half. Closed model under Cognition's platform terms; the weights aren't public and the sharing programme isn't described yet (15). Terms, privacy policy, security page and DPA agree, with training on self-serve data by default and no retention periods, as read for the devin listing (18). The API versioning policy covers API endpoints, not models, and no model deprecation notice was found (5 of 20). Sub-processors listed with purpose and country, per the devin listing's 8 October check (18). 15 + 18 + 5 + 18 = 56.