Codestral FIM Guide: Versioned Evaluation Checklist

What the current model card says

Mistral's Codestral model card (docs.mistral.ai/models/codestral-25-08, reviewed October 27, 2026) describes a code model released at the end of July 2025 for low-latency, high-frequency tasks such as fill-in-the-middle (FIM) and code generation. It lists the model ID codestral-2508, a 128k context window, and features that include Structured Outputs, Function Calling, Predicted Outputs, Prefix, Document QnA, Batching, Chat Completions and FIM. The card attaches endpoints to each feature: function calling is listed for /v1/chat/completions and /v1/conversations, while FIM is listed for /v1/fim/completions. Not every feature is available on every endpoint, so check the card for the specific combination you plan to use. This guide does not state a parameter count, a supported-language count, open-weight availability or a licence for the current hosted model, because the current primary sources reviewed here do not state them.

Older Codestral releases are different models

Earlier write-ups, including a previous version of this page, described Codestral as a 22B model with a 32k context window and pointed to Codestral Mamba as a self-hosted equivalent. Those descriptions refer to older, separately versioned releases. Codestral Mamba is a specific, different model; it is not a self-hosted copy of the current hosted codestral-2508, and results from one should not be assumed to transfer to the other. Treat each model ID as its own evaluation subject and check Mistral's model lifecycle page for availability before relying on any release.

Pin the model version explicitly

The FIM API reference (docs.mistral.ai/api/endpoint/fim) shows a legacy default value of codestral-2404 for the model field, and its code samples use the alias codestral-latest. The default is a legacy version, and an alias such as codestral-latest can move to a different underlying model over time, so neither tells you which version a given request will use. In an evaluation, send model: "codestral-2508" explicitly, record the model value returned in the response, and re-check the model card and your account's model list before each evaluation round, because aliases and availability can change.

How a FIM request is shaped

Per the API reference, /v1/fim/completions takes a prompt (the code before the cursor) and an optional suffix (the code after it); when both are given, the model fills what lies between them. The token count of the prompt plus max_tokens cannot exceed the model's context length, so budget prefix, suffix and output together. An illustrative request body, with a placeholder rather than a real key and not meant to be run from this page: header Authorization: Bearer $MISTRAL_API_KEY (read from your own environment, never committed to source); body { "model": "codestral-2508", "prompt": "<code before cursor>", "suffix": "<code after cursor>", "max_tokens": 64 }. Never paste an API key into this site or any public page.

FIM evaluation worksheet

• Requested model and returned model/version: e.g. requested codestral-2508; record exactly what the response reports.
• Date and time of the run, and the endpoint used (/v1/fim/completions or /v1/chat/completions).
• Editor, provider and plugin name with exact version, if testing through an editor integration rather than a direct call.
• Permissions and source policy: which repositories or files may be sent, who approved it, and which organization privacy settings were in effect.
• Context token budget: prompt tokens + suffix tokens + max_tokens, and confirmation that the total fits the model's context window.
• Test fixture: the prefix, the suffix and the expected property the fill should satisfy (not an exact expected string).
• Checks applied: compiles or parses, unit tests pass, linters and security tests (static analysis, secrets scan, dependency policy) pass.
• Decision: accept or reject, with the reason.
• Latency definition: state which timer you used, for example request start to first streamed chunk, request start to full response, or end-to-end from keystroke to rendered suggestion including debounce and network.
• Usage and cost: actual uncached input, cached input and output tokens from the response or billing data, the price per million tokens current on the run date, and the resulting total.
• No invented benchmarks: record only numbers you measured, with the harness and settings used.

Toy fixtures (hypothetical, local only)

These small fixtures need no API call and no network access to read. They are hypothetical test inputs; the expected property describes what a correct fill must satisfy and is not a guaranteed or observed model output.

def sum_even(nums):
    return sum(

)

function sumEven(nums: number[]): number {
  return nums.filter(

).reduce((a, b) => a + b, 0);
}

Evaluation protocol

• Use the same fixtures, the same harness and the same settings (model ID, temperature, max_tokens, stop sequences) for every model or configuration you compare.
• Compare only like task types: FIM against FIM, chat-style code generation against chat-style code generation.
• Repeat each fixture enough times to sample latency, then report p50 and p95 only after you have collected the data, alongside the latency definition you used.
• Report pass rates per check (compiles, tests, security scan) rather than a single blended score.
• Record failures and rejections with the same detail as successes.
• This page reports no measured results; it describes a protocol you can run yourself.

Illustrative token cost

Mistral's pricing page (docs.mistral.ai/inference/pricing, reviewed October 27, 2026) lists Codestral at $0.30 input, $0.03 cached input and $0.90 output per million tokens. As a simple illustration, one request with 800 uncached input tokens and 200 output tokens costs 800 × $0.30/1M + 200 × $0.90/1M = $0.00024 + $0.00018 = $0.00042. If all 800 input tokens were billed as cached input, it would be 800 × $0.03/1M + $0.00018 = $0.000204. Whether input is billed as cached depends on what your billed usage actually reports; do not assume cache eligibility. These are single-request illustrations, not monthly totals. For workload estimates, use the existing workload cost planner on the La Plateforme pricing guide and check current prices before quoting.

Security review of generated code

• Treat every completion as untrusted code from an unknown contributor.
• Passing tests is not proof that code is safe; tests only cover what they check.
• Do not execute generated code automatically; run it only in a sandboxed harness you control.
• Never place API keys or other secrets in source files, prompts or fixtures; load them from your environment or a secrets manager.
• Apply the same code review, static analysis, secrets scanning and dependency policy you use for human commits.

Data controls depend on your organization and plan

Mistral's privacy and data-control documentation (reviewed October 27, 2026) says input and output data may, in certain cases, be included in training programs, with opt-out controls that differ by product; API and Vibe opt-out toggles are separate. Zero data retention (ZDR) is described as available on paid plans for supported stateless endpoints, including /v1/fim/completions and /v1/chat/completions, must be requested and approved, excludes Labs models, and does not cover stateful features such as batch files, conversations, agents or files. Training opt-out and ZDR are separate controls. Because these terms depend on your organization, plan, model and endpoint, verify the actual terms and the settings in your own admin console before sending proprietary code. This page does not claim that data is never stored, never used for training, or kept in any particular region.

Editor integrations

This guide does not give step-by-step setup for specific editors or plugins, because those instructions were not confirmed against current primary sources. If you test through an editor, record the plugin name and version in the worksheet and confirm in the plugin's own current documentation which endpoint and model ID it sends.