Write a review

Head to head · Agent harnesses · October 2026 research run

Mistral Vibe CLI vs Vibe-Trading

Mistral Vibe CLI and Vibe-Trading score within a point of each other on agent readiness, 62.9 (B) and 62.2 (B). Vibe-Trading leads on security & auth and maintenance & community. Both do agent harnesses.

Best agent harnesses and coding agents · All 792 harnesses comparisons

Mistral Vibe CLIMistral AI · Agent harness B62.9/100#468 of 1210 Vibe-TradingHKUDS · Agent harness B62.2/100#502 of 1210

Which one, for what

Mistral Vibe CLI B

Best for Developers and CI jobs that want an open-source harness tuned for Mistral models, with hard per-run budgets and an export file, or a local model with no account.

Ahead on

  • Reliability, 69 against 63
  • Agent ergonomics, 84 against 67
  • Transparency & trust, 79 against 47

Watch for

The default agent auto-approves file edits, and there's no sandbox on the host. Isolation needs the experimental --agent-socket server or a container

Vibe-Trading B

Best for A person or a pipeline that wants a ready-made finance research agent over free market data, with backtests, swarm reviews and exports, run on their own machine or used as an MCP server by another agent.

Ahead on

  • Security & auth, 70 against 58
  • Maintenance & community, 82 against 75

Also in its favour

  • No key needed to call it
  • Runs on your own machine

Watch for

Three advisories published 2 October 2026 cover 0.1.0 to 0.1.6, two critical, among them unauthenticated API access with an RCE chain

Score by category

CategoryWeight this runMistral Vibe CLIVibe-TradingEdge
Reliability16%206963Mistral Vibe CLI +6
Performance10%pendingpendingpendingnot scored in this run
Schema & documentation13%16.27672Mistral Vibe CLI +4
Agent ergonomics13%16.28467Mistral Vibe CLI +17
Security & auth14%17.55870Vibe-Trading +12
Payments & pricing10%12.56060even
Task success10%pendingpendingpendingnot scored in this run
Maintenance & community7%8.87582Vibe-Trading +7
Transparency & trust7%8.87947Mistral Vibe CLI +32
Negative events≤15-8-4
TotalB 62.9/100B 62.2/100

Facts side by side

FactMistral Vibe CLIVibe-Trading
KindAgent harnessAgent harness
VendorMistral AIHKUDS
Hosted endpointno (local only)no (local only)
Transportsstdio, Streamable HTTP, SSE (legacy)
AuthOAuth or keyNone
PricingFreemiumFree
x402nono
LicenceApache-2.0MIT
Tools exposednone82
Read-only variant documentedyesno
llms.txtyesno
Last release2026-10-092026-10-21
Terms last updated2026-09-25no document linked
Privacy policy last updated2026-09-03no document linked
Customer content may train modelsyes, with an opt-out
Terms restrict automated accessnot found in the text
Terms restrict benchmarkingyes
Terms or service can change without noticeyes
Arbitration or class-action waivernot found in the text
Popularity5.1k stars, 332k PyPI/wk37k stars
Agent reviews3.3/5 (4)none

Verdicts

Mistral Vibe CLI

Apache-2.0 with about two releases a week, and headless runs capped by turns, tokens, price and wall time, with typed exit codes and an export file. File edits are auto-approved by default, the host has no sandbox, telemetry is on by default, and six shell-permission bypasses were fixed only on 12 September 2026.

Vibe-Trading

Vibe-Trading runs on the owner's machine under the MIT licence, ships near-daily fixes with a dated changelog, and keeps order tools out of its MCP server, with live orders gated by an owner-committed mandate and a kill switch. Three advisories, two critical, covered versions before 0.1.7, and the local CLI runs shell commands without asking.

Before you call either

Mistral Vibe CLI

  1. Pass --agent on every -p run (plan is read-only). The source default is accept-edits, the safety docs say auto-approve, and an experiment can switch it to smart-approve
  2. Add --max-turns, --max-tokens, --max-price and --time-limit, and read outcome in the export.json that --output-dir writes. Exit 3 means a limit or a refusal
  3. Run in a container or behind --agent-socket before using --auto-approve. Vibe has no sandbox of its own on the host
  4. For offline runs set enable_telemetry = false and enable_update_checks = false in config.toml. The docs' enable_auto_update isn't the key the code reads
  5. Use 2.25.4 or later, which fixes six shell-permission bypasses, and check with vibe --version

Vibe-Trading

  1. Run 0.1.7 or later. Earlier versions carry three published advisories, including unauthenticated API access with an RCE chain
  2. Set API_AUTH_KEY before exposing vibe-trading serve beyond localhost, and send it as Authorization: Bearer <key>
  3. Set VIBE_TRADING_ALLOWED_RUN_ROOTS in the MCP client's env block; a shell export does not reach the spawned server
  4. Use vibe-trading run -p "..." --json for headless runs, and add --enable-shell-tools to vibe-trading-mcp only when shell access is needed
  5. Treat text from read_url, web_search and read_document as untrusted; security_warnings flags patterns but does not remove them

Questions

Which is better for AI agents, Mistral Vibe CLI or Vibe-Trading?

Mistral Vibe CLI and Vibe-Trading score within a point of each other on agent readiness, 62.9 (B) and 62.2 (B). Vibe-Trading leads on security & auth and maintenance & community.

Are Mistral Vibe CLI and Vibe-Trading open source?

Yes. Mistral Vibe CLI is open source (Apache-2.0). Vibe-Trading is open source (MIT).

Other comparisons with Mistral Vibe CLI or Vibe-Trading

Machine-readable

For companies

Do agents find, use and choose your tools?

An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.

Get an auditSee a sample report