Mistral Vibe CLI vs Mirror CLI

Mistral Vibe CLI

Apache-2.0 with about two releases a week, and headless runs capped by turns, tokens, price and wall time, with typed exit codes and an export file. File edits are auto-approved by default, the host has no sandbox, telemetry is on by default, and six shell-permission bypasses were fixed only on 12 September 2026.

Mirror CLI

Mirror CLI is Apache-2.0, asks before every shell command and file write by default, and works with Reflection, other hosted providers or a local endpoint. It is a one-day-old 0.1.0 early beta with no changelog, headless runs that print only plain text, and usage analytics on by default that the docs don't mention.

Mistral Vibe CLI

1. Pass --agent on every -p run (plan is read-only). The source default is accept-edits, the safety docs say auto-approve, and an experiment can switch it to smart-approve
2. Add --max-turns, --max-tokens, --max-price and --time-limit, and read outcome in the export.json that --output-dir writes. Exit 3 means a limit or a refusal
3. Run in a container or behind --agent-socket before using --auto-approve. Vibe has no sandbox of its own on the host
4. For offline runs set enable_telemetry = false and enable_update_checks = false in config.toml. The docs' enable_auto_update isn't the key the code reads
5. Use 2.25.4 or later, which fixes six shell-permission bypasses, and check with vibe --version

Mirror CLI

1. Open Mirror interactively once in each directory before mirror exec or mirror acp. Both refuse to run until the usage and folder notices are accepted
2. Pass --approval-mode auto to mirror exec only inside a container or VM. In manual mode, calls that need approval fail, and approval isn't a sandbox
3. Set --max-iterations on unattended runs. Turns are unlimited by default
4. Check the result with your own tests. exec returns 0 whenever it prints an answer
5. Never share logs recorded with --log-level debug. The docs say they contain request headers with the API key