Codestral is Mistral AI’s specialized model family for fast, high-frequency code completion, especially fill-in-the-middle (FIM). The current production alias codestral-latest points to the supported generation selected by Mistral; the current documented version is Codestral 25.08 (codestral-2508) with a 128K context window. It can also perform code generation and chat-style tasks.
Codestral is not the whole Mistral developer product line. Vibe Code is the current CLI, IDE and web coding agent; Devstral is optimized for multi-step agentic software engineering; Codestral Embed creates vectors for code search; and the earlier Mistral Code product announcement described an enterprise IDE stack. Choosing the right layer prevents an autocomplete model from being evaluated as if it were an autonomous agent.
Map the task to the correct Mistral coding component
| Component | Primary job | Typical input/output | Do not confuse it with |
|---|---|---|---|
| Codestral 25.08 | Low-latency FIM and code generation | Prefix + suffix → missing code | A full repository agent |
| Devstral | Agentic coding and software-engineering tasks | Issue + tools/repository → multi-step change | Inline completion |
| Codestral Embed | Code/search vector representation | Code/query → embedding | Text generation |
| Vibe Code | User-facing CLI/IDE/web agent experience | Developer task → edits, commands, PR | One model endpoint |
| Studio | API keys, playground, evaluation and monitoring | Developer control plane | End-user coding assistant |
| Le Chat legacy URL | Earlier chat entry point | Conversation | The official Codestral model page |
The listing’s stored URL points to chat.mistral.ai/chat, but the current Mistral platform describes Vibe, Studio and Admin. For API evaluation, use the model card and Studio rather than treating a consumer chat page as Codestral’s canonical product surface.
How FIM works
file before cursor file after cursor
| |
v v
[prefix] + FIM markers + [suffix]
|
v
Codestral
|
v
proposed middle span
|
syntax/type/test/security gate
|
developer accepts
Ordinary next-token completion sees only what precedes the cursor. FIM also supplies the suffix, allowing the model to close a function, respect following calls and insert code without rewriting the rest. An IDE integration should send only the context required for the completion, preserve exact prefix/suffix boundaries and stop generation before duplicated suffix content.
Current version, context and price
As reviewed July 26, 2026, the Codestral 25.08 model card lists a 128K context and API pricing of $0.30 per million input tokens and $0.90 per million output tokens. Mistral’s pricing page shows the same rates for codestral-latest, with batch processing advertised at 50% off and cached input at a large discount where applicable. Confirm the live invoice currency, region and endpoint.
| Example API workload | Input | Output | Approximate model cost |
|---|---|---|---|
| 1,000 small completions | 4M tokens | 0.5M tokens | $1.20 + $0.45 = $1.65 |
| 1,000 broad-context completions | 20M | 1M | $6.00 + $0.90 = $6.90 |
| Batch offline generation | 20M | 2M | About half standard token charge if eligible |
| Waste from low acceptance | Same tokens | Same tokens | Cost unchanged even when developers reject suggestions |
These arithmetic examples exclude IDE/plugin fees, gateways, retrieval, network, self-hosted infrastructure and engineering. Track cost per accepted completion and retained code, not calls alone. Aggressively sending 128K on every keystroke is slow, costly and unnecessary.
Model lifecycle: aliases versus pinned IDs
codestral-latest simplifies upgrades but can change behavior. A pinned ID such as codestral-2508 improves reproducibility until retirement. Mistral’s model catalog places Codestral 25.01, Codestral 24.05 and Codestral Mamba among legacy/deprecated models; the 25.01 card recorded a retirement date in 2025.
| Strategy | Benefit | Risk | Recommended control |
|---|---|---|---|
Use latest | Automatic supported upgrade | Silent quality/latency change | Canary traffic and continuous benchmark |
| Pin version | Reproducible behavior | Retirement outage | Lifecycle alert and migration window |
| Self/VPC deploy | Residency and control | License, hardware and operations | Contract plus capacity/security testing |
| Fallback model | Availability | Different FIM markers/quality/data terms | Explicit compatible adapter and user signal |
License and “open weight” history
The original Codestral 22B weights were released under the Mistral AI Non-Production License for research/testing, with commercial licenses offered separately. Do not generalize that license to every Codestral version, API use or enterprise deployment. Codestral 25.08 is documented as a Premier model and enterprise self-deployment is a commercial offering.
Record the exact artifact/API terms, permitted use, derivative/fine-tuning rights, geographic restrictions and support. “Downloadable” and “open source” are not synonyms. Downstream generated code also needs normal license, dependency and provenance review.
Code privacy and context minimization
Autocomplete may send code around the cursor, imports, symbols, open tabs, repository maps, filenames and developer prompts. This can include secrets, customer data and proprietary algorithms. Inspect the IDE extension or integration’s actual context builder, not only the model provider’s policy.
| Context source | Value | Risk | Minimization |
|---|---|---|---|
| Current file prefix/suffix | Essential FIM structure | Secrets and unrelated regions | Bound window; redact secret patterns |
| Imported definitions | Type/API accuracy | Broad proprietary code | Send signatures/docs before implementations |
| Repository retrieval | Conventions and cross-file calls | Larger disclosure/index retention | Path allowlist and local retrieval |
| Terminal/test output | Failure context | Tokens, environment paths and user data | Scrub logs and select relevant lines |
| Git diff/issue | Intent and recent change | Untrusted prompt injection | Label as data; never grant tool authority |
Use separate API keys per environment, least-privilege workspaces, spending limits and rotation. Do not embed keys in editor settings committed to Git. Confirm Mistral’s current data-processing, retention and training controls for Free, paid API, Team and Enterprise because product plans differ.
A completion benchmark that reflects developer value
Create 200–1,000 cursor positions sampled from repositories and languages your team actually uses. Freeze the prefix, suffix, relevant context and hidden ground truth. Include boilerplate, API use, error handling, tests, SQL, shell, security-sensitive code and incomplete refactors. Remove cases already present in public benchmark corpora where leakage is plausible.
| Metric | Definition | Why it matters |
|---|---|---|
| Exact/semantic match | Matches target or passes behavior tests | Academic comparability |
| Acceptance rate | Suggestions accepted / shown | Immediate usefulness |
| Retention | Accepted code remaining after 1–7 days | Filters quick accept/rewrite behavior |
| Keystrokes/time saved | Controlled task comparison | Actual productivity |
| Defect/security rate | Accepted suggestions causing findings | Quality guardrail |
| Latency | P50/P95 cursor-to-render | Autocomplete must stay in flow |
| Cost/retained completion | All token/tool cost / retained accepts | Economic decision |
Mistral reported improved accepted and retained completions for 25.08 in its enterprise announcement. Treat vendor figures as a hypothesis and reproduce them using your extension, network and repositories.
Latency engineering
Debounce keystrokes, cancel stale requests and cache stable prefixes. Keep output length short for autocomplete. Use streaming only if partial candidates improve experience without encouraging premature acceptance. Separate interactive FIM traffic from batch test generation so long jobs do not saturate rate limits.
Measure end-to-end latency: editor context collection, retrieval, network, queue, first token, generation and rendering. A model benchmark that excludes extension overhead cannot predict developer experience.
Security and correctness gates
Never execute generated code merely because it compiles. Run formatter, parser/typechecker, unit tests, secret scan, dependency policy and language-specific security checks in a sandbox. For SQL and shell completions, require stricter confirmation and a non-production environment.
- Reject suggestions that introduce hard-coded credentials, disabled TLS or unsafe deserialization.
- Resolve package names against an approved registry to reduce hallucinated dependency attacks.
- Require human review for authentication, cryptography, payments, migrations and access control.
- Show the whole suggested span and affected suffix before acceptance.
- Attribute accepted AI code in internal telemetry only as permitted by employee/privacy policy.
FIM integration checklist
| Integration concern | Test | Failure symptom |
|---|---|---|
| Markers/tokenizer | Official FIM endpoint/SDK fixture | Markers leak into code or suffix repeats |
| Stop logic | Braces, indentation and following statement | Runaway generation |
| Unicode | Non-ASCII identifiers/comments | Corruption or offset mismatch |
| Context truncation | Very large file/repo | Critical suffix/import disappears |
| Cancellation | Rapid typing and file switch | Stale completion inserted |
| Telemetry | Inspect request/log payload | Code or secrets stored unexpectedly |
When Codestral is not the right choice
Use Devstral/Vibe Code or another agentic system when the job requires exploring a repository, planning, editing multiple files, running commands and opening a PR. Use Codestral Embed for semantic code retrieval. Use deterministic refactoring/linters when the transformation is known. Use a general reasoning model for architecture discussions that are not latency-sensitive completions.
Alternatives
| Option | Best fit | Tradeoff versus Codestral |
|---|---|---|
| Codestral | Low-latency multi-language FIM through Mistral | Premier model lifecycle and provider dependency |
| GitHub Copilot | Managed IDE/GitHub experience | Product subscription and less model-level control |
| Tabnine | Enterprise completion and deployment choices | Different ecosystem and pricing |
| Continue + selected model | Open-source IDE orchestration | You own context, providers and evaluation |
| Local open code model | Offline/residency and predictable control | GPU, latency, licensing and maintenance |
| Language server/snippet | Known symbols and deterministic boilerplate | Less generative flexibility, higher factual reliability |
Frequently asked questions
What is the current Codestral model?
The current model card lists Codestral 25.08 (codestral-2508) and the API alias codestral-latest.
How much does the API cost?
At review time, $0.30 per million input tokens and $0.90 per million output tokens. Confirm the live pricing page.
Is Codestral open source?
Do not use that blanket label. Original weights had a non-production license; the current Premier model and self-deployment use current Mistral terms/contracts.
Is it the same as Devstral?
No. Codestral targets completion/FIM; Devstral targets agentic software-engineering tasks.
Is it the same as Vibe Code?
No. Vibe Code is a user-facing coding agent across terminal, IDE and web that can use coding models.
Does a 128K window mean I should send the full repository?
No. Retrieve and minimize relevant context for latency, cost and privacy.
Can generated code be trusted?
No. Run independent tests, static/security checks and human review proportional to risk.
Primary sources
- Official Codestral 25.08 model card
- Official live API pricing
- Official model catalog and legacy list
- Official Codestral 25.08 announcement
- Official code-generation/FIM documentation
- Mistral Vibe, Studio and Admin product overview
- Mistral Code and coding-stack distinction
- Original Codestral and license history
- OWASP application security reference
Last reviewed July 26, 2026. Model aliases, prices, product naming and retirement dates change. Pin versions for production and monitor the live catalog and changelog.
