mistral-mcp

mistral-mcp is a TypeScript MCP server (spec 2025-11-25) that exposes the full Mistral AI API surface: 22 tools: chat, OCR, audio (Voxtral), vision, agents, embeddings, moderation, classification, files, batch, sampling, FIM (Codestral), streaming 2 resources: mistral://models, mistral://voices 6 curated prompts (French + English) with MCP argument completion Dual transport: stdio (default) + Str

→ Swih/mistral-mcp · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

⚠️

Tool annotations don’t match behaviour

1 read-only tool performs write/delete/exec — process_document (line 414: mkdirSync(sub, { recursive: true }))

🚨

Known vulnerabilities in dependencies: 2 critical

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

🔐

You'll be asked for 1 credential: MISTRAL_API_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// known CVEs in dependencies2 critical

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@2.1.0GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

criticalvitest@2.1.0GHSA-9crc-q9x8-hgqq

Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

🔐 secretMISTRAL_API_KEY— "env": { "": "your_key_here" }

configMISTRAL_MCP_CACHE_DIR— process_document cache configurable per-call and via

configMISTRAL_MCP_PROFILE— controls how many tools are exposed (default: core).

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/swih-mistral-mcp-ne9u6j)](https://m8ven.ai/mcp/swih-mistral-mcp-ne9u6j)

commit: a74098cd4b8cf6ad25a0ed8c1f5b403bc3360180

code hash: db883350bdb3c169e752c1883503eb2577c1c1cc33b4885c82c9c7bee702c78b

verified: 6/11/2026, 11:17:10 AM

view raw JSON →