# BoxLang AI vs Mastra

> Mastra scores 74.2 (BB) to BoxLang AI's 65.8 (B) for agent frameworks. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra
- Markdown: https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra.md (~4,300 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Mastra scores 74.2 (BB) on agent readiness against BoxLang AI's 65.8 (B), and leads in 6 of 7 scored categories. Both do agent frameworks.

- BoxLang AI: grade B, 65.8/100, rank #403 of 1510. Markdown https://www.anchorterminal.com/tools/boxlang-ai.md · JSON https://www.anchorterminal.com/api/v1/tools/boxlang-ai.json
- Mastra: grade BB, 74.2/100, rank #91 of 1510. Markdown https://www.anchorterminal.com/tools/mastra.md · JSON https://www.anchorterminal.com/api/v1/tools/mastra.json
- Best agent frameworks and SDKs: https://www.anchorterminal.com/best/frameworks/index.md
- All 171 frameworks comparisons: https://www.anchorterminal.com/compare/frameworks/index.md

## Which one, for what

### BoxLang AI (B)

Good for: Teams already running BoxLang or modernising CFML on the JVM who want agents, RAG and MCP with approval and guardrails in the same language

Also in its favour:
- No key needed to call it

Watch for: Runs only on BoxLang, a JVM language, so it suits teams already on BoxLang or CFML rather than Python or TypeScript stacks

### Mastra (BB)

Good for: TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.

Ahead on:
- Reliability, 87 against 66
- Schema & documentation, 98 against 71
- Agent ergonomics, 92 against 74
- Payments & pricing, 60 against 50
- Maintenance & community, 96 against 83

Also in its favour:
- Agent-ready, a grade of BB or better

Watch for: Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026


## Why the edge

### Schema & documentation: Mastra +27

- BoxLang AI (71): Framework reading. A reference page for each built-in function with its arguments, and tool schemas generated from typed function arguments with required fields since 3.3.1. BoxLang is dynamically typed and no published API reference was found, though the repository builds DocBox API docs (15 of 25). llms.txt with about 150 entries and a Markdown copy of every page (10). The FAQ says when to use aiChat() or aiAgent() and the security guide says which guards to use when, though some FAQ links still say coming soon for pages that exist (14 of 20). Tool arguments are typed with required lists, and stdio options a server doesn't have throw InvalidArgument (11 of 15). About 100 example scripts in the repository and a gallery on ai.boxlang.io, but the production guide catches RateLimitException, TimeoutException and AuthenticationException, which the module's source never throws, and there is no exception reference (9 of 15). Keep a Changelog and a release-history page per version, but the 3.6.0 page still read unreleased on 1 November and two old versions appear twice in the changelog (12 of 15). 71 in all.
- Mastra (98): Typed TypeScript API with a reference section (25). llms.txt with a when-to-use list and condensed instructions for coding agents (10). The docs say when to use durable agents, and point multi-agent users from `.network()` to supervisor agents (20). Tools take Zod schemas (15). Examples on every page, and MastraError with ids and categories documented, though errors are spread across pages (13). Per-package changelogs and migration guides (15).

### Reliability: Mastra +21

- BoxLang AI (66): Read with the local-software lines. Official package on ForgeBox, installed with `install-bx-module bx-ai` or `box install bx-ai`, with BoxLang 1.14.0 or later in box.json and JDK 21 in CONTRIBUTING.md, but the 3.6 announcement says BoxLang 1.18 or later (18 of 20). tests.yml runs about 140 test classes against Ollama and the vector stores in Docker Compose, and against paid providers on development and releases, on pull requests and pushes to development. Whether runs pass wasn't read, since WebFetch refused github.com (15 of 25). Open issues and replies weren't read for the same reason. The changelog closes issues #182 to #259 in 3.3.1 to 3.4.0, and bugs also go to Ortus's Jira (10 of 25). Keep a Changelog with semantic versioning stated and Migration sections, but breaking changes ship in minor releases (8 of 15). 3.6.0, past 1.0 (15). 66 in all.
- Mastra (87): Official npm packages, Node 22.13 or newer (20). Public CI workflows for unit, store, workspace and e2e tests; on 6 November the newest runs on main (Version Packages, Trigger Cloud Integration Tests) succeeded, while the test workflows themselves run on pull requests (22). 436 open issues and 795 open issues and pull requests on 6 November from GitHub's API, with 2,077 issues opened in the 90 days to 3 November; all 50 newest had a comment and 24 were closed, with issue-triage automation (18). A changesets CHANGELOG per package, a CI gate that needs approval for any major bump and migration guides, but no written versioning policy found, and `.network()` is deprecated without a removal date (12). 1.82.0 (15). 20+22+18+12+15 = 87, up from 74 on 6 October, when GitHub couldn't be read.

### Agent ergonomics: Mastra +18

- BoxLang AI (74): Framework reading, scored on what a tool-calling agent with MCP takes. An agent with an MCP server is one `aiAgent()` call with `mcpServers`, and `toolFilter` and `prefix` limit what each server adds. Skills can load lazily, but `autoLoadSkills` is on by default and injects every SKILL.md under /.agents/skills into every agent (20 of 25). MaxToolCallsMiddleware caps tool calls, window and summary memory bound history by messages or tokens, `withMaxResponseBytes` caps MCP answers and `listTools( cursor )` pages tools (17 of 20). Named exceptions (ProviderError, UnsupportedCapability, InvalidArgument, MCPCommandRefused, BXAI.SecurityViolation) but no reference page, and the changelog says a timed-out call still surfaces as a JSON parse error (12 of 20). RetryMiddleware with exponential backoff, approval resumes that don't replay the model call or rerun executed tools, and a stdio client that never repeats an in-flight call. MCP tool annotations such as readOnlyHint aren't read (15 of 20). An agent needs a name and works with defaults, and a mock provider runs with no key, but it is one language (10 of 15). 74 in all.
- Mastra (92): An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10).

### Maintenance & community: Mastra +13

- BoxLang AI (83): 3.6.0 on 2026-10-20 (30). Three releases in the 90 days to 1 November, 3.4.0 on 1 September, 3.5.0 on 11 September and 3.6.0 on 20 October (20). 79 commits on the development branch in those 90 days from Luis Majano, Doug Cain, Copilot and dependency bots, with pull requests up to #326 merged on 1 November. Issue reply times couldn't be read (10 of 25). The ForgeBox package is current at 3.6.0 (15). Dependabot for Gradle monthly and Actions quarterly, tests on pull requests and development, and a format check (8 of 10). 83 in all.
- Mastra (96): @mastra/core 1.82.0 on 2026-11-04 (30). 27 stable releases in the 90 days to 6 November, 8 of them since 6 October (20). 436 open issues on 6 November, all 50 newest issues commented and 24 of them closed (22). Client, MCP and store packages are current, and @mastra/mcp 1.x stays supported beside 2.x (15). Renovate and CI configured, with the newest runs on main passing (9). 30+20+22+15+9 = 96.

### Payments & pricing: Mastra +10

- BoxLang AI (50): Self-hosted rule, scored on the paid option. No payment protocol (0). BoxLang runtime plans are public without a login, Starter $749 a year and BoxLang+ and BoxLang++ from $1,999 to $4,999 a server or node a year, plan pricing rather than per unit (10). The Apache-2.0 module installs with no card (20) and no account or sign-up (20). 50 in all.
- Mastra (60): No payment protocol (0). Scored on the hosted platform, whose per-unit prices are public without a login ($10 per 100K observability events and $0.35 a CPU hour on Starter) (20). The Apache 2.0 packages install with no card (20) and no account, and run any model (20).

## Score by category

| Category | Weight | BoxLang AI | Mastra | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 66 | 87 | Mastra +21 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 71 | 98 | Mastra +27 |
| Agent ergonomics | 13% (16.2 this run) | 74 | 92 | Mastra +18 |
| Security & auth | 14% (17.5 this run) | 71 | 67 | BoxLang AI +4 |
| Payments & pricing | 10% (12.5 this run) | 50 | 60 | Mastra +10 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 83 | 96 | Mastra +13 |
| Transparency & trust | 7% (8.8 this run) | 70 | 72 | Mastra +2 |
| Negative events | ≤15 | -3 | -8 | |
| **Total** | | **65.8 · B** | **74.2 · BB** | |

## Facts side by side

| Fact | BoxLang AI | Mastra |
| --- | --- | --- |
| Kind | Agent framework | Agent framework |
| Vendor | Ortus Solutions | Kepler Software, Inc. |
| Hosted endpoint | no (local only) | no (local only) |
| Transports |  |  |
| Auth | None | API key |
| Pricing | Free | Free |
| x402 | no | no |
| Licence | Apache-2.0 | Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing |
| Read-only variant documented | no | no |
| llms.txt | yes | yes |
| Last release | 2026-10-20 | 2026-11-04 |
| Terms last updated | no date given | 2026-10-26 |
| Privacy policy last updated | no date given | no date given |
| Customer content may train models | not found in the text | yes |
| Terms restrict automated access | not found in the text | yes |
| Terms restrict benchmarking | not found in the text | not found in the text |
| Terms or service can change without notice | not found in the text | yes |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | none | 29k stars, 3.1M npm/wk |

## Verdicts

**BoxLang AI.** A JVM agent framework with human approval, guardrail middleware and an MCP client over HTTP and stdio, all enforced in code, with three releases in the 90 days to 1 November 2026. It runs only on BoxLang, the stronger guards are opt-in, and minor releases have renamed public classes without a deprecation period.

**Mastra.** A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes.

## Before you call either

### BoxLang AI

1. Set `mcp.stdio.allowedCommands` to the executables you need. The default empty list lets any command start as a stdio MCP server.
2. Pass `allowedPaths` when you create FileSystemTools. With none, its tools can read, write and delete anywhere the JVM user can.
3. Attach HumanInTheLoopMiddleware with a checkpointer for tools that write or spend. Approval is opt-in.
4. Create MCP clients with `MCP()` rather than the class, since 3.6.0 renamed MCPClient to MCPHttpClient without an alias.
5. Use the `mock` provider to test agent wiring and guardrails with no API key or network.

### Mastra

1. Set MASTRA_TELEMETRY_DISABLED=1 in every environment that runs the CLI, the server or Studio
2. Pin exact versions with a lockfile, and make sure no 17 June 2026 release such as @mastra/core 1.42.1 is installed
3. Set requireToolApproval on MCP servers that write, and allowedHosts when server URLs come from configuration
4. Add PromptInjectionDetector as an input processor when tools return web or user content
5. Use supervisor agents through generate() or stream(). `.network()` is deprecated

## Questions

### Which is better for AI agents, BoxLang AI or Mastra?

Mastra scores 74.2 (BB) on agent readiness against BoxLang AI's 65.8 (B), and leads in 6 of 7 scored categories.

### Are BoxLang AI and Mastra open source?

Yes. BoxLang AI is open source (Apache-2.0). Mastra is open source (Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing).


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra.json, and with the fewest tokens: https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "boxlang-ai", "b": "mastra"}`. From a terminal: `anchor compare boxlang-ai mastra`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/boxlang-ai.json and https://www.anchorterminal.com/api/v1/tools/mastra.json

## Other comparisons with BoxLang AI or Mastra

- [AgentOS vs BoxLang AI](https://www.anchorterminal.com/compare/agentos-vs-boxlang-ai.md)
- [AgentOS vs Mastra](https://www.anchorterminal.com/compare/agentos-vs-mastra.md)
- [Agno vs BoxLang AI](https://www.anchorterminal.com/compare/agno-vs-boxlang-ai.md)
- [Agno vs Mastra](https://www.anchorterminal.com/compare/agno-vs-mastra.md)
- [BoxLang AI vs Claude Agent SDK](https://www.anchorterminal.com/compare/boxlang-ai-vs-claude-agent-sdk.md)
- [BoxLang AI vs CrewAI](https://www.anchorterminal.com/compare/boxlang-ai-vs-crewai.md)
- [BoxLang AI vs Cursor Agent SDK](https://www.anchorterminal.com/compare/boxlang-ai-vs-cursor-agent-sdk.md)
- [BoxLang AI vs Docker Agent](https://www.anchorterminal.com/compare/boxlang-ai-vs-docker-agent.md)
- [BoxLang AI vs Agent Development Kit (ADK)](https://www.anchorterminal.com/compare/boxlang-ai-vs-google-adk.md)
- [BoxLang AI vs guilds.run](https://www.anchorterminal.com/compare/boxlang-ai-vs-guilds-run.md)
- [BoxLang AI vs LangGraph](https://www.anchorterminal.com/compare/boxlang-ai-vs-langgraph.md)
- [BoxLang AI vs LlamaIndex Framework](https://www.anchorterminal.com/compare/boxlang-ai-vs-llamaindex.md)
- [BoxLang AI vs Microsoft Agent Framework](https://www.anchorterminal.com/compare/boxlang-ai-vs-microsoft-agent-framework.md)
- [BoxLang AI vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/boxlang-ai-vs-openai-agents-sdk.md)
- [BoxLang AI vs Pydantic AI](https://www.anchorterminal.com/compare/boxlang-ai-vs-pydantic-ai.md)
- [BoxLang AI vs smolagents](https://www.anchorterminal.com/compare/boxlang-ai-vs-smolagents.md)
- [BoxLang AI vs Strands Agents](https://www.anchorterminal.com/compare/boxlang-ai-vs-strands-agents.md)
- [BoxLang AI vs TradingAgents](https://www.anchorterminal.com/compare/boxlang-ai-vs-tradingagents.md)
- [BoxLang AI vs AI SDK](https://www.anchorterminal.com/compare/boxlang-ai-vs-vercel-ai-sdk.md)
- [Claude Agent SDK vs Mastra](https://www.anchorterminal.com/compare/claude-agent-sdk-vs-mastra.md)
- [CrewAI vs Mastra](https://www.anchorterminal.com/compare/crewai-vs-mastra.md)
- [Cursor Agent SDK vs Mastra](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra.md)
- [Docker Agent vs Mastra](https://www.anchorterminal.com/compare/docker-agent-vs-mastra.md)
- [Agent Development Kit (ADK) vs Mastra](https://www.anchorterminal.com/compare/google-adk-vs-mastra.md)
- [guilds.run vs Mastra](https://www.anchorterminal.com/compare/guilds-run-vs-mastra.md)
- [LangGraph vs Mastra](https://www.anchorterminal.com/compare/langgraph-vs-mastra.md)
- [LlamaIndex Framework vs Mastra](https://www.anchorterminal.com/compare/llamaindex-vs-mastra.md)
- [Mastra vs Microsoft Agent Framework](https://www.anchorterminal.com/compare/mastra-vs-microsoft-agent-framework.md)
- [Mastra vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk.md)
- [Mastra vs Pydantic AI](https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai.md)
- [Mastra vs smolagents](https://www.anchorterminal.com/compare/mastra-vs-smolagents.md)
- [Mastra vs Strands Agents](https://www.anchorterminal.com/compare/mastra-vs-strands-agents.md)
- [Mastra vs TradingAgents](https://www.anchorterminal.com/compare/mastra-vs-tradingagents.md)
- [Mastra vs AI SDK](https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp