Mistral Vibe: MCP and Connector Tools Now Respect the Permission System

Mistral VibeSep 18, 2026View original changelog

Mistral Vibe's v2.25.5 release fixed a significant gap in which MCP and connector tool calls did not respect the configured permission system. They now honor each tool's configured permission, ask before running by default, and remember a developer's approval for later calls. A related fix made the enabled_tools and disabled_tools config globs, which developers use to restrict what an agent can touch, apply to MCP tools rather than only connector tools.

Key Takeaways

MCP and connector tool calls previously did not honor Mistral Vibe's permission system and could run without the usual approval prompt.
They now ask before running by default and remember a developer's approval decision for later calls.
A companion fix makes the enabled_tools/disabled_tools config globs apply to MCP tools, not just connectors, closing a second enforcement gap.
This is a trust-boundary fix: it closes a path where the agent could act outside a developer's configured permission rules.
The fix ships in the same release, v2.25.5, that also narrowed shell command approval scope, suggesting a broader permission-hardening pass this release.
No independent third-party coverage exists yet for this specific fix.

MCP and Connector Tools Were Bypassing Vibe's Permission System

Two Fixed entries in Mistral Vibe's v2.25.5 changelog describe a real gap in how the agent's permission model applied to external tools. The changelog states: "MCP and connector tool calls now respect the permission system: they honor each tool's configured permission, ask before running by default, and remember your approval for later calls." Read literally, this means that before this fix, calls to MCP servers and connectors could run without going through the same approval gate that governs Mistral Vibe's own built-in tools.

Config Globs Now Actually Cover MCP Tools

A second, related fix closes an adjacent gap: "the enabled_tools and disabled_tools config globs now apply to MCP tools, not just connector tools." Developers who used these globs to restrict which tools an agent is allowed to call were, before this fix, only getting that restriction enforced for connectors, not for MCP servers, even though the setting is presented as a general tool restriction.

Why This Matters

Mistral Vibe's permission system exists specifically to keep an agent from taking actions a developer has not authorized, whether that's running a shell command or reaching out to an external server through MCP. A gap where an entire category of tool calls, MCP and connectors, could execute without that gate being enforced is exactly the kind of trust-boundary issue that matters regardless of how it is phrased in a one-line changelog entry: it means the agent could act outside what the developer's permission configuration was supposed to authorize. This fix, together with the config-glob fix, closes that gap for both ad-hoc approval prompts and standing tool restrictions.