Mistral Vibe CLI vs Qoder CLI

Mistral Vibe CLI

Apache-2.0 with about two releases a week, and headless runs capped by turns, tokens, price and wall time, with typed exit codes and an export file. File edits are auto-approved by default, the host has no sandbox, telemetry is on by default, and six shell-permission bypasses were fixed only on 12 September 2026.

Qoder CLI

A closed-source terminal agent with a documented headless mode, an ACP server, typed TypeScript and Python SDKs and near-daily releases. Permission rules and modes are detailed, but no local sandbox is documented, usage statistics are on by default, and security fixes appear only as one-line release notes with no advisories or disclosure policy.

Mistral Vibe CLI

1. Pass --agent on every -p run (plan is read-only). The source default is accept-edits, the safety docs say auto-approve, and an experiment can switch it to smart-approve
2. Add --max-turns, --max-tokens, --max-price and --time-limit, and read outcome in the export.json that --output-dir writes. Exit 3 means a limit or a refusal
3. Run in a container or behind --agent-socket before using --auto-approve. Vibe has no sandbox of its own on the host
4. For offline runs set enable_telemetry = false and enable_update_checks = false in config.toml. The docs' enable_auto_update isn't the key the code reads
5. Use 2.25.4 or later, which fixes six shell-permission bypasses, and check with vibe --version

Qoder CLI

1. Set QODER_PERSONAL_ACCESS_TOKEN in CI. The browser sign-in can't complete in a headless run
2. Pass --permission-mode with --allowed-tools in headless runs. Every ask is denied, and --yolo removes all checks
3. Set --max-turns on unattended runs, and branch on exit codes 41 (authentication) and 53 (turn limit)
4. Set privacy.usageStatisticsEnabled and aiCodeStatistics.enabled to false in ~/.qoder/settings.json if usage data must stay local
5. Don't pass --model lite. The Lite tier was removed on 18 September 2026 and headless requests naming it fail