All 160 Dependencies

Every package Mistle depends on, ranked by repo health score.

Mistle is an open-source platform for running and automating background coding agents inside secure sandboxes. Rather than a single chat interface bolted onto an LLM, it's infrastructure: a control plane for configuring integrations, sandbox profiles, and triggers, and a data plane that provisions sandboxes, mediates every outbound request, and streams sessions back to a dashboard. Teams self-host it with a single Docker Compose installer, or point it at remote sandbox providers when they need more scale than a laptop or local server can offer.

The design centers on credentialless sandboxes: agents never receive raw secrets. Instead, the data-plane gateway loads a sandbox's active runtime plan, matches outbound HTTP requests against compiled egress routes, and injects the right credential at request time, mediated through scoped bootstrap, egress, MCP, and PTY-transport tokens issued by dedicated auth packages. Combined with identity attribution (so agent actions trace back to the human account behind them), sandbox profiles, reusable snapshots, and event-driven triggers, Mistle reads like an attempt to bring the governance a large engineering org would want around autonomous agents, closer to what a hosted product like Devin offers, into a project you run yourself.

Under the hood it's a TypeScript monorepo (pnpm workspaces, Turborepo) split into control-plane and data-plane services built on Hono, Drizzle ORM over Postgres, and the openworkflow library for durable workflows, with a React 19 dashboard. Performance- and security-sensitive pieces, including the in-sandbox daemon, commit signing, and the CLI, are written in Rust. Sandbox execution is provider-agnostic, supporting local Docker as well as remote providers including E2B, Modal, Freestyle, Tensorlake, and OpenComputer.

Mistle is young: the repository was created in February 2026, and the project describes itself as early with bugs to be expected. It ships under the MIT license with no enterprise tier or self-hosting restrictions, but the maintainers are not yet accepting external code contributions, only issues and discussion. For teams that want an open, self-hosted alternative to hosted autonomous-coding-agent products, it's worth watching closely rather than betting production workflows on it today.

25 @codemirror/lang-json 6.0.2 25 @codemirror/lint 6.9.7 26 @codemirror/commands 6.10.4 outdated 32 CodeMirror State 6.7.0 outdated 34 @codemirror/autocomplete 6.20.3 38 lang-markdown 6.5.0 outdated 39 typeid-js ^1.2.0 41 @codemirror/view 6.43.4 outdated 42 Phosphor Icons React ^2.1.7 42 clsx ^2.1.1 42 tw-animate-css ^1.4.0 43 node-sshpk ^1.18.0 44 cmdk ^1.1.1 45 next-themes ^0.4.6 46 @octokit/webhooks-methods ^6.0.0 46 nix 0.31.3 47 @cfworker/json-schema ^4.1.1 48 Vaul ^1.1.2 50 jsx-email ^3.2.1 51 rustls-pki-types 1.14.1 51 tungstenite 0.29.0 outdated 55 tokio-tungstenite 0.29.0 outdated 57 NATS Node Transport ^3.4.0 58 bpaf 0.9.26 58 tracing 0.1.44 58 tracing 0.3.20 outdated 59 getrandom 0.3.4 outdated 61 Croner ^10.0.1 62 tar 0.4.46 63 Sonner ^2.0.7 63 url 2.5.8 64 React Testing Library ^16.3.0 64 postgres ^3.4.9 64 ssh-key 0.7.0-rc.10 65 @rolldown/plugin-babel 0.2.3 outdated 65 jest-dom ^6.9.0 outdated 65 tracing-opentelemetry 0.33.0 outdated 66 base64 0.22.1 outdated 67 bytes 1.10.1 67 sha2 0.10.9 outdated 68 @octokit/webhooks-types ^7.6.1 68 tempfile 3.27.0 69 http-body 0.1.3 outdated 69 react-day-picker ^10.0.1 70 octokit.js ^5.0.5 71 dockerode ^5.0.0 72 serde_json 1.0.150 73 @octokit/auth-app ^8.2.0 73 flate2 1.1.9 73 hyper-rustls 0.27.9 74 TanStack Pacer ^0.22.1 outdated 74 ureq 3.3.0 75 React CodeMirror 4.25.10 outdated 75 elkjs ^0.11.1 outdated 75 input-otp ^1.4.2 75 yaml-rust2 0.11.0 outdated 76 TypeScript Native Preview latest 76 serde 1.0.228 77 request.js ^10.0.10 77 smol-toml ^1.6.1 78 date-fns ^4.3.0 78 node-postgres ^8.20.0 78 openapi-typescript ^0.17.0 outdated 78 openapi-typescript ^7.13.0 78 tokio-rustls 0.26.4 79 Drizzle ORM ^0.31.10 outdated 79 Drizzle ORM ^0.45.2 79 Drizzle ORM ^0.8.3 outdated 80 hyper-util 0.1.17 80 modal-client 0.7.6 outdated 81 GraphQL.js ^17.0.1 82 Embla Carousel React ^8.6.0 82 class-variance-authority ^0.7.1 82 reqwest 0.13.4 83 rcgen 0.14.8 84 React Resizable Panels ^4.11.2 84 Streamdown ^1.1.1 outdated 84 Streamdown ^1.0.2 outdated 84 Streamdown ^2.5.0 84 ws ^8.21.0 85 @hono/node-server ^2.0.4 85 Pino ^10.3.1 85 fff-search 0.9.1 outdated 86 tailwind-merge ^3.6.0 87 LiquidJS ^10.27.1 88 Base UI ^1.5.0 outdated 88 dockview-react ^7.0.2 outdated 88 jose ^6.2.3 88 tsx ^4.22.4 89 Better Auth 1.6.23 outdated 89 jsdom ^29.1.1 outdated 89 lint-staged ^17.0.8 89 testcontainers-node ^12.0.1 89 testcontainers-node ^12.0.1 89 time 0.3.47 89 xterm.js ^0.11.0 outdated 89 xterm.js ^6.0.0 90 @hono/zod-validator ^1.3.1 outdated 90 @hono/zod-validator ^1.4.0 outdated 90 E2B ^2.31.0 90 Hono 4.12.27 outdated 90 MCP TypeScript SDK 2.0.0-alpha.2 outdated 90 Nodemailer ^9.0.1 outdated 90 Oxlint ^1.70.0 90 Scalar API Reference ^0.11.8 outdated 90 Smithy Core (@smithy/core) ^4.3.5 outdated 90 Smithy Core (@smithy/core) ^5.5.2 outdated 90 Smithy Core (@smithy/core) ^5.4.6 outdated 90 Tailwind CSS ^4.3.1 90 Tailwind CSS ^4.3.1 90 futures 0.3.31 90 portable-pty 0.9.0 90 sharp 0.34.5 outdated 91 React Flow ^12.11.0 91 Recharts 3.8.1 outdated 92 OpenTelemetry Rust 0.32 outdated 92 OpenTelemetry Rust 0.32 outdated 92 Playwright ^1.61.1 92 TanStack Query ~5.101.2 outdated 92 Zod ^4.4.3 92 undici ^8.5.0 93 @vitejs/plugin-react ^6.0.3 93 OpenTelemetry Auto-Instrumentations for Node.js ^0.77.0 outdated 93 OpenTelemetry Auto-Instrumentations for Node.js ^0.69.0 outdated 93 Vitest ^4.1.8 outdated 93 hyper 1.10.1 93 posthog-js ^1.10.3 93 posthog-js ^1.393.4 94 AWS SDK for JavaScript (S3 Client) ^3.1079.0 94 AWS SDK for JavaScript (S3 Client) 3.1075.0 outdated 94 AWS SDK for JavaScript (S3 Client) ^3.1079.0 94 Node-Redis ^6.0.0 94 Stripe Node.js Library ^22.2.0 94 Vite ^8.0.16 95 @rjsf/core ~6.6.2 outdated 95 @rjsf/core ~6.6.2 outdated 95 @rjsf/core ~6.6.2 outdated 95 BuildKit v0.29.0 outdated 95 React Router ~8.1.0 outdated 95 Storybook ^10.4.6 95 Storybook ^10.4.6 95 Storybook ^10.4.6 95 Storybook ^10.4.6 95 Storybook ^10.4.6 95 Tokio 1.52.3 96 OpenTelemetry JavaScript (@opentelemetry/api) ^1.9.0 96 OpenTelemetry JavaScript (@opentelemetry/api) ^0.218.0 outdated 96 OpenTelemetry JavaScript (@opentelemetry/api) ^2.8.0 outdated 96 OpenTelemetry JavaScript (@opentelemetry/api) ^2.8.0 outdated 96 OpenTelemetry JavaScript (@opentelemetry/api) ^0.219.0 outdated 96 OpenTelemetry JavaScript (@opentelemetry/api) ^0.219.0 outdated 96 OpenTelemetry JavaScript (@opentelemetry/api) ^0.219.0 outdated 96 OpenTelemetry JavaScript (@opentelemetry/api) ^0.219.0 outdated 96 OpenTelemetry JavaScript (@opentelemetry/api) ^2.7.1 outdated 96 OpenTelemetry JavaScript (@opentelemetry/api) ^0.218.0 outdated 96 OpenTelemetry JavaScript (@opentelemetry/api) ^2.8.0 outdated 97 TypeScript ^6.0.3 outdated 98 React 1.0.0 outdated 98 React ^19.2.7 98 React DOM ^19.2.7

Join founders buildingwith open source

Opinionated takes, migration guides, cost-saving tips, and insights from the open source ecosystem.

Subscribe on Substack
Join 750+ subscribers