Mistral Vibe: Plugin MCP Servers Get Credential Isolation
Mistral VibeMistral Vibe's new plugin-declared MCP servers, tagged and authenticated per plugin, introduced a credential-collision risk: a plugin server sharing a name with a user-configured server could inherit that server's credential. Mistral Vibe closed the gap in the same release: a colliding plugin server is now dropped with a warning instead of inheriting the credential, and related fixes stop sessions from stripping or deleting each other's plugin server connections. This is a trust-boundary fix, not routine polish, since it closes a path for a plugin to access credentials it was never granted.
Key Takeaways
- Plugins can now bundle their own MCP servers, tagged with the owning plugin and authenticated through
/mcp login, a new extension point for the plugin ecosystem. - Name collisions no longer leak credentials: a plugin server sharing a name with a user-configured
[[mcp_servers]]entry is dropped with a warning instead of silently inheriting that entry's credential. - Session isolation is tightened: a second session opening the same plugin server name no longer strips the first session's connection, and a name collision no longer deletes another session's stored credential.
- This closes a real trust-boundary gap, since a poorly named or malicious plugin could previously have gained access to credentials it was never granted.
- The fix pairs with Mistral Vibe's push toward a richer plugin ecosystem, indicating the team is hardening the extension surface as it grows.
- Anyone running third-party Vibe plugins alongside custom
[[mcp_servers]]entries should update promptly to pick up the isolation guarantee.
A New Extension Point, and a Credential Leak It Could Cause
Mistral Vibe's plugin system gained the ability to bundle MCP servers directly. A plugin can now declare its own MCP server, tagged with the plugin that owns it, and authenticate it through the existing /mcp login flow; a pending login is announced automatically when a session starts. This gives plugin authors a way to ship fully working integrations without asking users to hand-configure a separate [[mcp_servers]] entry.
Closing a Credential Collision Gap
That new capability introduced a real trust-boundary risk: if a plugin declared an MCP server with the same name as one a user had already configured directly, the plugin server could inherit that entry's credential. Mistral Vibe fixed this in the same release. A name collision between a plugin-declared server and a user-configured [[mcp_servers]] entry now causes the plugin server to be dropped, with a warning shown to the user, instead of silently reusing credentials that were never granted to it.
Tightening Session Isolation
Several related fixes shipped alongside this change. A second session opening a plugin server under a name already in use no longer strips the first session's connection to it, and each session's configured servers are now kept genuinely separate. A server whose name collides across sessions no longer causes one session's stored credential to be deleted because of an identity mismatch with another. Taken together, these changes mean a plugin, whether malicious or simply carelessly named, can no longer piggyback on credentials it was never authorized to use.
Anyone running third-party Vibe plugins that declare their own MCP servers, especially alongside custom [[mcp_servers]] configuration, should update to pick up this isolation guarantee.