{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "tool": { "slug": "mastra", "name": "Mastra", "vendor": "Kepler Software, Inc.", "vendorUrl": "https://mastra.ai", "kind": "framework", "category": "frameworks", "summary": "Open-source TypeScript framework from Mastra for building agents and workflows, with memory, RAG, evals, tracing, an MCP client and server, and a local Studio. An optional hosted platform runs deployments and observability.", "url": "https://www.anchorterminal.com/tools/mastra", "markdownUrl": "https://www.anchorterminal.com/tools/mastra.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/mastra.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/mastra.json", "dns": "mastra.grade.anchorterminal.com", "repo": "https://github.com/mastra-ai/mastra", "license": "Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing", "transports": [], "packages": [ { "registry": "npm", "name": "@mastra/core" }, { "registry": "npm", "name": "@mastra/mcp" }, { "registry": "npm", "name": "mastra" } ], "auth": "api-key", "authNotes": "The framework has no account of its own. The model router takes `provider/model` strings and each provider's own key. The hosted Mastra platform needs an account.", "pricing": "free", "pricingNotes": "Free and open source. You pay for model calls. The hosted platform has a $0 Starter plan with 100K observability events and 24 CPU hours, then $10 per 100K events and $0.35 a CPU hour, and Teams at $250 a month (https://mastra.ai/pricing, checked 2026-11-06).", "priceSummary": "Free · OSS", "where": "library", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Mastra docs, the repository or the pricing page (checked 2026-10-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 29383, "npmWeekly": 3116983, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://mastra.ai/docs", "llmsTxt": "https://mastra.ai/llms.txt", "capabilities": [ "agent.framework", "agent.durable", "agent.mcp-client", "agent.multi-agent" ], "tags": [ "framework", "typescript", "open-source", "llms-txt", "mcp", "telemetry-default-on" ], "lastRelease": "2026-11-04", "graded": true, "anchor": { "graded": true, "score": 74.2, "grade": "BB", "agentReady": true, "rank": 91, "ranked": true, "rankOf": 1486, "categoryRank": 7, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 92, "maintenance": 96, "payments": 60, "reliability": 87, "schema": 98, "security": 67, "transparency": 72 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 87, "points": 17.4, "reason": "Official npm packages, Node 22.13 or newer (20). Public CI workflows for unit, store, workspace and e2e tests; on 6 November the newest runs on main (Version Packages, Trigger Cloud Integration Tests) succeeded, while the test workflows themselves run on pull requests (22). 436 open issues and 795 open issues and pull requests on 6 November from GitHub's API, with 2,077 issues opened in the 90 days to 3 November; all 50 newest had a comment and 24 were closed, with issue-triage automation (18). A changesets CHANGELOG per package, a CI gate that needs approval for any major bump and migration guides, but no written versioning policy found, and `.network()` is deprecated without a removal date (12). 1.82.0 (15). 20+22+18+12+15 = 87, up from 74 on 6 October, when GitHub couldn't be read.", "checked": "2026-11-06" }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 98, "points": 15.93, "reason": "Typed TypeScript API with a reference section (25). llms.txt with a when-to-use list and condensed instructions for coding agents (10). The docs say when to use durable agents, and point multi-agent users from `.network()` to supervisor agents (20). Tools take Zod schemas (15). Examples on every page, and MastraError with ids and categories documented, though errors are spread across pages (13). Per-package changelogs and migration guides (15).", "checked": "2026-11-06" }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 92, "points": 14.95, "reason": "An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10).", "checked": "2026-11-06" }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 67, "points": 11.73, "reason": "The CLI sends PostHog analytics, server startup sends token counts per model and a count of registered agents, tools and MCP servers, and Studio sends browser analytics, all on by default and documented, with one opt-out, MASTRA_TELEMETRY_DISABLED=1. Since #26986 (16 October 2026) each server process also reports token use per provider and model every 15 minutes, and the telemetry reference read on 6 November says server events carry a project identifier that is a raw Platform UUID or a hash of the Git origin remote, so they \"aren't anonymous\" (12). requireToolApproval on agents and MCP servers, allowedHosts for MCP HTTP, a curated environment for stdio servers, and sandboxed workspaces (20). PromptInjectionDetector, PII and moderation processors, and docs that call tool results untrusted model input (15). Built-in tracing with OpenTelemetry and other exporters (15). No SECURITY.md, no security.txt and no bug bounty found. A blog post says Mastra is SOC 2 Type II audited, which isn't scored for a framework, and we found no public advisory from Mastra about the June incident (5). Framework reading. 15+20+15+15+5 = 70 on 6 October, 12+20+15+15+5 = 67 on 6 November.", "checked": "2026-11-06" }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 60, "points": 7.5, "reason": "No payment protocol (0). Scored on the hosted platform, whose per-unit prices are public without a login ($10 per 100K observability events and $0.35 a CPU hour on Starter) (20). The Apache 2.0 packages install with no card (20) and no account, and run any model (20).", "checked": "2026-11-06" }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 96, "points": 8.4, "reason": "@mastra/core 1.82.0 on 2026-11-04 (30). 27 stable releases in the 90 days to 6 November, 8 of them since 6 October (20). 436 open issues on 6 November, all 50 newest issues commented and 24 of them closed (22). Client, MCP and store packages are current, and @mastra/mcp 1.x stays supported beside 2.x (15). Renovate and CI configured, with the newest runs on main passing (9). 30+20+22+15+9 = 96.", "checked": "2026-11-06" }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 72, "points": 6.3, "note": "editorial 72, provenance 71", "reason": "Apache 2.0 for the core, with ee/ directories source-available under the Mastra Enterprise License (25). The privacy policy (last published 25 April 2025) covers the website, the Teams plan states six months' retention, and the subprocessor list sits in a trust centre our reader couldn't render (15). Migration guides and deprecation warnings, without dated removal windows (12). Every telemetry stream is documented with links to its source and one opt-out, and the reference now spells out what the project identifiers can be correlated with (20).", "checked": "2026-11-06" } ], "assessment": { "date": "2026-11-06", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10).", "maintenance": "@mastra/core 1.82.0 on 2026-11-04 (30). 27 stable releases in the 90 days to 6 November, 8 of them since 6 October (20). 436 open issues on 6 November, all 50 newest issues commented and 24 of them closed (22). Client, MCP and store packages are current, and @mastra/mcp 1.x stays supported beside 2.x (15). Renovate and CI configured, with the newest runs on main passing (9). 30+20+22+15+9 = 96.", "payments": "No payment protocol (0). Scored on the hosted platform, whose per-unit prices are public without a login ($10 per 100K observability events and $0.35 a CPU hour on Starter) (20). The Apache 2.0 packages install with no card (20) and no account, and run any model (20).", "reliability": "Official npm packages, Node 22.13 or newer (20). Public CI workflows for unit, store, workspace and e2e tests; on 6 November the newest runs on main (Version Packages, Trigger Cloud Integration Tests) succeeded, while the test workflows themselves run on pull requests (22). 436 open issues and 795 open issues and pull requests on 6 November from GitHub's API, with 2,077 issues opened in the 90 days to 3 November; all 50 newest had a comment and 24 were closed, with issue-triage automation (18). A changesets CHANGELOG per package, a CI gate that needs approval for any major bump and migration guides, but no written versioning policy found, and `.network()` is deprecated without a removal date (12). 1.82.0 (15). 20+22+18+12+15 = 87, up from 74 on 6 October, when GitHub couldn't be read.", "schema": "Typed TypeScript API with a reference section (25). llms.txt with a when-to-use list and condensed instructions for coding agents (10). The docs say when to use durable agents, and point multi-agent users from `.network()` to supervisor agents (20). Tools take Zod schemas (15). Examples on every page, and MastraError with ids and categories documented, though errors are spread across pages (13). Per-package changelogs and migration guides (15).", "security": "The CLI sends PostHog analytics, server startup sends token counts per model and a count of registered agents, tools and MCP servers, and Studio sends browser analytics, all on by default and documented, with one opt-out, MASTRA_TELEMETRY_DISABLED=1. Since #26986 (16 October 2026) each server process also reports token use per provider and model every 15 minutes, and the telemetry reference read on 6 November says server events carry a project identifier that is a raw Platform UUID or a hash of the Git origin remote, so they \"aren't anonymous\" (12). requireToolApproval on agents and MCP servers, allowedHosts for MCP HTTP, a curated environment for stdio servers, and sandboxed workspaces (20). PromptInjectionDetector, PII and moderation processors, and docs that call tool results untrusted model input (15). Built-in tracing with OpenTelemetry and other exporters (15). No SECURITY.md, no security.txt and no bug bounty found. A blog post says Mastra is SOC 2 Type II audited, which isn't scored for a framework, and we found no public advisory from Mastra about the June incident (5). Framework reading. 15+20+15+15+5 = 70 on 6 October, 12+20+15+15+5 = 67 on 6 November.", "transparency": "Apache 2.0 for the core, with ee/ directories source-available under the Mastra Enterprise License (25). The privacy policy (last published 25 April 2025) covers the website, the Teams plan states six months' retention, and the subprocessor list sits in a trust centre our reader couldn't render (15). Migration guides and deprecation warnings, without dated removal windows (12). Every telemetry stream is documented with links to its source and one opt-out, and the reference now spells out what the project identifiers can be correlated with (20)." }, "sources": [ { "what": "npm registry document for @mastra/core (versions and dates)", "url": "https://registry.npmjs.org/@mastra/core", "seen": "2026-11-06" }, { "what": "npm weekly downloads", "url": "https://api.npmjs.org/downloads/point/last-week/@mastra/core", "seen": "2026-11-06" }, { "what": "repository clone (docs source, CI workflows, LICENSE.md, CHANGELOGs)", "url": "https://github.com/mastra-ai/mastra", "seen": "2026-10-06" }, { "what": "OSV malware advisory for @mastra/core 1.42.1", "url": "https://osv.dev/vulnerability/MAL-2026-6011", "seen": "2026-11-06" }, { "what": "core changelog with the 17 June remediation", "url": "https://github.com/mastra-ai/mastra/blob/main/packages/core/CHANGELOG.md", "seen": "2026-10-06" }, { "what": "CLI reference, telemetry", "url": "https://mastra.ai/reference/cli/mastra", "seen": "2026-11-06" }, { "what": "MCP", "url": "https://mastra.ai/docs/connections/mcp", "seen": "2026-10-06" }, { "what": "guardrails", "url": "https://mastra.ai/docs/agents/guardrails", "seen": "2026-10-06" }, { "what": "licence", "url": "https://mastra.ai/docs/license", "seen": "2026-11-06" }, { "what": "llms.txt", "url": "https://mastra.ai/llms.txt", "seen": "2026-10-06" }, { "what": "pricing", "url": "https://mastra.ai/pricing", "seen": "2026-11-06" }, { "what": "privacy policy", "url": "https://mastra.ai/privacy-policy", "seen": "2026-10-06" }, { "what": "security.txt (404)", "url": "https://mastra.ai/.well-known/security.txt", "seen": "2026-11-06" }, { "what": "regulated enterprise post (SOC 2 claim)", "url": "https://mastra.ai/blog/secure-governed-agents-regulated-enterprise", "seen": "2026-10-06" }, { "what": "telemetry source history (model usage telemetry, #26986)", "url": "https://github.com/mastra-ai/mastra/blob/main/packages/core/src/telemetry/model-usage-telemetry.ts", "seen": "2026-11-06" }, { "what": "OSV advisories for @mastra/core and @mastra/mcp", "url": "https://osv.dev/list?q=%40mastra%2Fcore\u0026ecosystem=npm", "seen": "2026-11-06" }, { "what": "GitHub API, repository, issues and Actions runs on main", "url": "https://api.github.com/repos/mastra-ai/mastra", "seen": "2026-11-06" } ], "openQuestions": [ "Changed since 6 October 2026 (rechecked 6 November). @mastra/core went from 1.74.0 to 1.82.0 (4 November) and @mastra/mcp to 2.8.0; no new advisory on OSV for @mastra/core or @mastra/mcp beyond the June malware entries; server telemetry now also reports token use every 15 minutes (#26986, 16 October) and the reference describes correlatable project identifiers (security 70 to 67); GitHub's API answered this time, so CI on main and issue activity were read first-hand (reliability 74 to 87, maintenance 87 to 96); licence, pricing and the missing security.txt unchanged", "How long the malicious versions stayed on npm, how they were published and whether 1.43.0 (17 June, 08:23 UTC) was clean. We found no write-up from Mastra", "unchecked: the trust centre at trust.mastra.ai, which needs JavaScript, so the subprocessor list and SOC 2 report weren't read" ] }, "negative": -8, "negativeNotes": [ "2026-06-17. Malicious versions of Mastra's npm packages were published, among them @mastra/core 1.42.1 at 01:15 UTC, and GitHub malware advisories that day (GHSA-pp62-grrw-hvfp and others) say any machine that installed one should be treated as fully compromised. All 21 Mastra packages we checked on OSV carry one. Mastra published clean versions the same day and the changelogs name an \"easy-day-js\" supply-chain incident, but we found no advisory or post-mortem from Mastra. Fixed and under four months old, so 8 points. https://osv.dev/vulnerability/MAL-2026-6011" ], "verdict": "A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes.", "bestFor": "TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.", "strengths": [ "MCP client with requireToolApproval per server or per tool, allowedHosts and a curated environment for stdio servers", "Guardrail processors for prompt injection, PII, moderation and cost limits, run on input and output", "Workflows with snapshots, suspend and resume, and durable agents on Inngest or an evented engine", "Apache 2.0 core, 1.0 since 20 January 2026, with 27 releases of @mastra/core in 90 days to 6 November", "llms.txt with a when-to-use section and condensed instructions for coding agents" ], "weaknesses": [ "Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026", "CLI, server and Studio send usage analytics by default, including token counts every 15 minutes, off with MASTRA_TELEMETRY_DISABLED=1", "No SECURITY.md, no security.txt and no bug bounty found", "Code under ee/ is source-available under the Mastra Enterprise License, not Apache 2.0", "TypeScript only, Node 22.13 or newer" ], "agentNotes": [ "Set MASTRA_TELEMETRY_DISABLED=1 in every environment that runs the CLI, the server or Studio", "Pin exact versions with a lockfile, and make sure no 17 June 2026 release such as @mastra/core 1.42.1 is installed", "Set requireToolApproval on MCP servers that write, and allowedHosts when server URLs come from configuration", "Add PromptInjectionDetector as an input processor when tools return web or user content", "Use supervisor agents through generate() or stream(). `.network()` is deprecated" ], "metrics": { "kind": "library", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 74.2 } ], "editorialScores": { "ergonomics": 92, "maintenance": 96, "payments": 60, "reliability": 87, "schema": 98, "security": 67, "transparency": 72 }, "provenanceScore": 71, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 }, "scoreHistory": [ { "date": "2026-11-06", "grade": "BB", "kind": "listed", "method": "0.7", "score": 74.2 } ] }, "connect": { "install": "npm create mastra@latest # or: npm i @mastra/core @mastra/mcp" }, "letme": { "capability": "https://letme.dev/agent.framework", "tool": "https://letme.dev/mastra" }, "notable": [ "@mastra/core 1.82.0 on 2026-11-04, with 27 stable releases in the 90 days to 6 November 2026 (8 since 6 October), and 1.0.0 on 2026-01-20 (https://registry.npmjs.org/@mastra/core)", "GitHub malware advisories, published 17 June 2026, cover versions of Mastra packages such as @mastra/core 1.42.1, @mastra/mcp, @mastra/server and create-mastra, and advise treating any machine that installed one as compromised (https://osv.dev/vulnerability/MAL-2026-6011)", "The package changelogs record a 17 June 2026 remediation for the \"easy-day-js\" supply-chain incident, publishing clean versions that superseded those declaring the malicious dependency (https://github.com/mastra-ai/mastra/blob/main/packages/core/CHANGELOG.md)", "The CLI, server and Studio send usage analytics by default; since 16 October 2026 servers also report token use per model every 15 minutes, with a project identifier from a Platform UUID or a hashed Git remote, and MASTRA_TELEMETRY_DISABLED=1 turns all of it off (https://mastra.ai/reference/cli/mastra)", "@mastra/mcp 2.x serves only MCP 2026-07-28, while its client still connects to older servers and 1.x stays supported (https://mastra.ai/reference/migrations/mcp-v2)" ], "area": "frameworks", "details": [ { "label": "Languages", "value": "TypeScript, Node 22.13 or newer" }, { "label": "Models", "value": "Model router with `provider/model` strings, or AI SDK providers" }, { "label": "MCP client", "value": "@mastra/mcp 2.8.0, stdio and HTTP, OAuth, requireToolApproval, allowedHosts. Also an MCP server" }, { "label": "Multi-agent", "value": "Supervisor agents with subagents, A2A and ACP. `.network()` deprecated" }, { "label": "Durable state", "value": "Workflow snapshots with suspend and resume, durable agents in-process, evented or on Inngest" }, { "label": "Human approval", "value": "Tool approval on agents and MCP servers, workflow suspend and resume" }, { "label": "Guardrails", "value": "Processors for prompt injection, PII, moderation, system-prompt scrubbing and cost limits" }, { "label": "Tracing", "value": "Built-in observability with OpenTelemetry, Langfuse, PostHog and other exporters" }, { "label": "Telemetry", "value": "CLI, server and Studio analytics on by default, with server token-use reports every 15 minutes. `MASTRA_TELEMETRY_DISABLED=1`" }, { "label": "Releases in 90 days", "value": "27 stable releases of @mastra/core to 6 November 2026" } ], "provenance": { "legalEntity": "Kepler Software, Inc.", "domain": "mastra.ai", "domainRegistered": "2024-10-01", "endpointOnVendorDomain": null, "terms": "https://mastra.ai/terms-of-service", "privacy": "https://mastra.ai/privacy-policy", "statusPage": "https://statuspage.incident.io/mastra-platform", "changelog": "https://github.com/mastra-ai/mastra/blob/main/packages/core/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The privacy policy names Kepler Software Inc as operator of mastra.ai and shows a last-published date of 25 April 2025.", "The licence file is copyright Kepler Software, Inc.", "mastra.ai/.well-known/security.txt returns 404 (rechecked 6 November 2026), and the repository has no SECURITY.md.", "RDAP gives mastra.ai a registration date of 2024-10-01.", "The status page covers the hosted platform, not the framework." ], "score": 71, "checks": [ { "check": "Legal entity named", "value": "Kepler Software, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "mastra.ai, registered 2024-10-01 (2 years)", "points": 7, "max": 15, "state": "part" }, { "check": "Endpoint on the vendor's domain", "value": "no hosted endpoint", "points": 0, "max": 0, "state": "na" }, { "check": "Terms of service", "value": "read, states 6 of the 7 things a reader expects, and has 3 clauses that cost points", "points": 3.1, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 3 of the 8 things a reader expects", "points": 6.3, "max": 10, "state": "part" }, { "check": "Status page", "value": "statuspage.incident.io/mastra-platform", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "People named", "value": "3 named with their role, 3 with a public profile", "points": 10, "max": 10, "state": "ok" }, { "check": "Support route", "value": "help pages, a community", "points": 5, "max": 5, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://mastra.ai/terms-of-service", "state": "read", "readAt": "2026-11-06", "statedDate": "2026-10-26", "words": 16717, "points": 3.1, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: Oct 26, 2026", "says": "Last updated 2026-10-26" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "This Agreement and any action related thereto will be governed by and interpreted under the laws of the State of Delaware, without giving effect to any conflict-of-laws principles.", "says": "The law of the State of Delaware" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "Mastra's total aggregate liability for Beta Services is limited to $100.", "says": "Capped at $100" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "Upon cancellation, (i) your access to paid features will terminate at the end of the then-current billing period or, for a Subscription purchased under an Order Form, at the end of the then-current Subscription Term;" }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": false }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "IF YOU DO NOT AGREE TO BE BOUND BY THIS AGREEMENT, YOU MAY NOT ACCESS OR USE THE SERVICES." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": true, "quote": "The Basic and Teams Plans are provided without an uptime SLA and without service credits." } ], "toKnow": [ { "key": "training", "label": "Says it may use customer content to train or improve models, and no opt-out was found", "found": true, "quote": "(o) use the Services to train, fine-tune, or otherwise develop a product or service that competes with the Services, including by extracting Model outputs in bulk for the purpose of training a competing foundation model;", "costsPoints": true }, { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "(d) use any manual or automated software, devices, or other processes (including spiders, robots, scrapers, crawlers, avatars, or data-mining tools) to scrape, harvest, or download data from the Services, except that Mastra grants the operators of public search engines revocable permission to use spiders to copy mater…", "costsPoints": true }, { "key": "terms.nonotice", "label": "Says the terms or the service can change without notice", "found": true, "quote": "Mastra makes no representations that Beta Services will ever be made generally available and reserves the right to discontinue or modify Beta Services at any time without notice.", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "Mastra may terminate or reduce Customer's access under any trial (whether free or paid) at any time in its discretion, including where Customer exceeds the usage limits, feature scope, or duration set forth in the applicable Order Form." }, { "key": "terms.arbitration", "label": "Requires arbitration or waives class actions", "found": true, "quote": "EACH PARTY HEREBY KNOWINGLY, VOLUNTARILY, AND INTENTIONALLY WAIVES ITS RIGHT TO A TRIAL BY JURY IN ANY PROCEEDING ARISING OUT OF OR RELATING TO THIS AGREEMENT." } ] }, { "kind": "privacy", "url": "https://mastra.ai/privacy-policy", "state": "read", "readAt": "2026-11-06", "words": 905, "points": 6.3, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": false }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "The Personal Information that we collect are used for providing and improving the Service." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": false }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "We do not sell or share SMS opt-in data or consent, including mobile phone numbers collected for text messaging, with third parties or affiliates for their own marketing or promotional purposes." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": false }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": false }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have any questions or suggestions about our Privacy Policy, do not hesitate to contact us." }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": false } ] } ] }, "humans": { "slug": "mastra", "checked": "2026-11-06", "company": "Kepler Software, Inc. (Mastra)", "people": [ { "name": "Sam Bhagwat", "role": "Founder and CEO", "founder": true, "linkedin": "https://www.linkedin.com/in/sambhagwat", "x": "https://x.com/calcsam", "page": "/people/sam-bhagwat/" }, { "name": "Abhi Aiyer", "role": "Founder and CTO", "founder": true, "linkedin": "https://www.linkedin.com/in/abhi-aiyer-aa41bb42/", "x": "https://x.com/abhiaiyer", "page": "/people/abhi-aiyer/" }, { "name": "Shane Thomas", "role": "Founder", "founder": true, "linkedin": "https://www.linkedin.com/in/smthomas3", "x": "https://x.com/smthomas3", "page": "/people/shane-thomas/" } ], "peopleNote": "Founders, roles and their LinkedIn and X links from Mastra's Y Combinator page (Winter 2025, read 6 November 2026). The legal entity is Kepler Software, Inc., per the privacy policy and licence file. Investors from Mastra's own seed post (8 October 2025, $13m from more than 100 investors, no lead named) and Series A post (9 April 2026, $22M led by Spark Capital, $35M raised in total). The seed post names many more angels and funds than are listed here; only the institutional investors this site already knows and a few of the named founders are recorded. No valuation was found on 6 November 2026: neither Mastra's seed post nor its Series A post states one, and one search found only database and aggregator pages, which this run doesn't use, so none is recorded.", "companySocial": { "linkedin": "https://www.linkedin.com/company/mastra-ai/", "x": "https://x.com/mastra_ai", "github": "https://github.com/mastra-ai" }, "support": { "urls": [ "https://mastra.ai/docs" ], "community": [ { "label": "GitHub", "url": "https://github.com/mastra-ai/mastra", "kind": "github" } ] }, "sources": [ "https://www.ycombinator.com/companies/mastra", "https://mastra.ai/blog/seed-round", "https://mastra.ai/blog/series-a", "https://mastra.ai/privacy-policy" ], "ownership": { "status": "private", "totalRaised": { "amount": "$35M", "asOf": "2026-04", "source": "https://mastra.ai/blog/series-a" }, "checked": "2026-11-06", "sources": [ "https://mastra.ai/blog/series-a", "https://mastra.ai/blog/seed-round", "https://www.ycombinator.com/companies/mastra" ] }, "investors": [ { "name": "Y Combinator", "kind": "accelerator", "rounds": [ "Winter 2025 batch" ], "url": "https://www.ycombinator.com", "source": "https://www.ycombinator.com/companies/mastra", "quote": "Batch: Winter 2025", "page": "/investors/y-combinator/" }, { "name": "Spark Capital", "kind": "vc", "rounds": [ "Series A, April 2026" ], "lead": true, "url": "https://www.sparkcapital.com", "source": "https://mastra.ai/blog/series-a", "quote": "a $22M Series A led by Spark Capital", "page": "/investors/spark-capital/" }, { "name": "Gradient Ventures", "kind": "vc", "rounds": [ "Seed, October 2025" ], "url": "https://www.gradient.com", "source": "https://mastra.ai/blog/seed-round", "quote": "Institutionals: ... Gradient Ventures", "page": "/investors/gradient-ventures/" }, { "name": "Base Case", "firm": "Basecase Capital", "kind": "vc", "rounds": [ "Seed, October 2025" ], "url": "https://basecase.vc", "source": "https://mastra.ai/blog/seed-round", "quote": "Institutionals: ... basecase capital", "page": "/investors/basecase-capital/" }, { "name": "SV Angel", "kind": "vc", "rounds": [ "Seed, October 2025" ], "url": "https://svangel.com", "source": "https://mastra.ai/blog/seed-round", "quote": "Institutionals: ... SVAngel", "page": "/investors/sv-angel/" }, { "name": "Orange Collective", "kind": "vc", "rounds": [ "Seed, October 2025" ], "url": "https://www.orangecollective.vc", "source": "https://mastra.ai/blog/seed-round", "quote": "Institutionals: ... Orange Collective", "page": "/investors/orange-collective/" }, { "name": "Runa Capital", "kind": "vc", "rounds": [ "Seed, October 2025" ], "url": "https://runacap.com", "source": "https://mastra.ai/blog/seed-round", "quote": "Institutionals: ... Runa Capital", "page": "/investors/runa-capital/" }, { "name": "Pioneer Fund", "kind": "vc", "rounds": [ "Seed, October 2025" ], "url": "https://pioneerfund.vc", "source": "https://mastra.ai/blog/seed-round", "quote": "Institutionals: ... Pioneer Fund", "page": "/investors/pioneer-fund/" }, { "name": "Liquid 2", "firm": "Liquid 2 Ventures", "kind": "vc", "rounds": [ "Seed, October 2025" ], "url": "https://www.liquid2.vc", "source": "https://mastra.ai/blog/seed-round", "quote": "Institutionals: ... Liquid2", "page": "/investors/liquid-2-ventures/" }, { "name": "Moonfire", "firm": "Moonfire Ventures", "kind": "vc", "rounds": [ "Seed, October 2025" ], "url": "https://www.moonfire.com", "source": "https://mastra.ai/blog/seed-round", "quote": "Institutionals: ... Moonfire", "page": "/investors/moonfire-ventures/" }, { "name": "Paul Graham", "kind": "angel", "rounds": [ "Seed, October 2025" ], "source": "https://mastra.ai/blog/seed-round", "quote": "GOAT: Paul Graham (YC)", "page": "/investors/paul-graham/" }, { "name": "Guillermo Rauch", "kind": "angel", "rounds": [ "Seed, October 2025" ], "source": "https://mastra.ai/blog/seed-round", "quote": "Unicorn+ founders: ... Guillermo Rauch (Vercel)", "page": "/investors/guillermo-rauch/" }, { "name": "Amjad Masad", "kind": "angel", "rounds": [ "Seed, October 2025" ], "source": "https://mastra.ai/blog/seed-round", "quote": "Unicorn+ founders: ... Amjad Masad (Replit)", "page": "/investors/amjad-masad/" }, { "name": "Arash Ferdowsi", "kind": "angel", "rounds": [ "Seed, October 2025" ], "source": "https://mastra.ai/blog/seed-round", "quote": "Unicorn+ founders: Arash Ferdowsi (Dropbox)", "page": "/investors/arash-ferdowsi/" }, { "name": "Shay Banon", "kind": "angel", "rounds": [ "Seed, October 2025" ], "source": "https://mastra.ai/blog/seed-round", "quote": "Unicorn+ founders: ... Shay Banon (Elastic)", "page": "/investors/shay-banon/" }, { "name": "David Cramer", "kind": "angel", "rounds": [ "Seed, October 2025" ], "source": "https://mastra.ai/blog/seed-round", "quote": "Unicorn+ founders: ... David Cramer (Sentry)", "page": "/investors/david-cramer/" } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/mastra.json", "live": { "slug": "mastra", "vendorStatus": { "page": "https://statuspage.incident.io/mastra-platform", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:21:22.180687494Z" }, "versions": [ { "registry": "github", "name": "mastra-ai/mastra", "version": "@mastra/core@1.82.0", "released": "2026-11-04", "seenAt": "2026-11-06T23:43:05.299046627Z" }, { "registry": "npm", "name": "@mastra/core", "version": "1.82.0", "seenAt": "2026-11-06T23:43:01.102546802Z" }, { "registry": "npm", "name": "@mastra/mcp", "version": "2.8.0", "seenAt": "2026-11-06T23:43:01.962943277Z" }, { "registry": "npm", "name": "mastra", "version": "1.38.0", "seenAt": "2026-11-06T23:43:03.330470883Z" } ], "githubStars": 29384, "npmWeekly": 3116983, "securityTxt": { "url": "https://mastra.ai/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:45.130857018Z" }, "llmsTxt": { "url": "https://mastra.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:57.501317652Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/mastra-ai/mastra/main/packages/core/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:21:37.959722321Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "0bdb3498f7aa" }, { "url": "https://mastra.ai/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:13:54.312763229Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "0204673a21a8" }, { "url": "https://mastra.ai/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:13:56.829832485Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1621ce3063d8" }, { "url": "https://mastra.ai/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:13:58.580048861Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "edbcf520f26c" } ], "updatedAt": "2026-11-07T18:21:22.180687494Z" } } }