w3bs.AccountStart building
PACKAGES / Mistral AI

Mistral Vibe

Minimal command line coding agent from Mistral AI.

ThreatCrush · No malware found
INSTALLw3bs install mistral.ai/vibe

No w3bs yet? curl -fsSL https://w3bs.org/install.sh | sh

Get started

What to type once it is installed.

  1. w3bs install mistral.ai/vibeInstall Mistral Vibe and track it for updates
  2. vibe --setupConfigure your Mistral API key or sign in
  3. vibeStart an interactive session in the current project
  4. vibe "<task>"Start a session with an initial prompt
  5. vibe --continueResume the most recent session

Every option: vibe --help · docs ↗

Malware scan

ThreatCrush found no malware indicators in Mistral Vibe 3.1.0. The other findings below are ordinary code-review notes, not malware.

Scanned
2026-11-05 04:48 UTC · threatcrush 0.13.30
Files
4117 (installer + github.com/mistralai/mistral-vibe)
Findings
4 medium · 11 low
15 other findings (not malware)
  • medium
    stack trace returned to the callersource/vibe/app_server/_host.py:939py-stack-trace-returned · CWE-209
  • medium
    broken hash algorithmsource/vibe/app_server/_projection.py:358py-weak-hash · CWE-327
  • medium
    regex with nested unbounded quantifierssource/vibe/core/plugins/_claude.py:36redos-nested-quantifier · CWE-1333
  • medium
    template rendering with escaping disabledsource/vibe/core/skills/registry/_service.py:181py-template-autoescape-off · CWE-79
  • low
    outbound request to a non-constant URLsource/harness/runtimes/python/python/mistralai_vibe_local_harness/vibe/_runtime.py:5209py-ssrf-outbound-request · CWE-918
  • low
    Generic API Keysource/README.md:825secret-generic-api-key · CWE-798
  • low
    Hardcoded Credentialsource/tests/app_server/test_mcp_auth.py:169secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/tests/app_server/test_mcp_auth.py:481secret-generic-credential · CWE-798
  • low
    Generic API Keysource/tests/app_server/test_mcp_auth.py:785secret-generic-api-key · CWE-798
  • low
    Hardcoded Credentialsource/tests/app_server/test_mcp_auth.py:785secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/tests/core/config/test_session_credentials.py:127secret-generic-credential · CWE-798
  • low
    TLS certificate verification disabledsource/tests/core/platform_auth/test_http.py:166tls-verification-disabled · CWE-295
  • low
    regex with nested unbounded quantifierssource/tests/skills/registry/test_models.py:132redos-nested-quantifier · CWE-1333
  • low
    stack trace returned to the callersource/tests/stubs/fake_agent_server.py:195py-stack-trace-returned · CWE-209
  • low
    stack trace returned to the callersource/tests/stubs/fake_agent_server.py:197py-stack-trace-returned · CWE-209

Badge for your README

ThreatCrush: No malware found

[![ThreatCrush scan](https://w3bs.org/api/packages/mistral.ai/vibe/badge.svg)](https://w3bs.org/packages/mistral.ai/vibe)