{ "data": { "a": { "slug": "cursor-agent-sdk", "name": "Cursor Agent SDK", "vendor": "Cursor", "vendorUrl": "https://cursor.com/docs/agent-sdk", "kind": "framework", "category": "frameworks", "summary": "Cursor's TypeScript framework for defining an agent as a folder of instructions, typed tools, skills, MCP connections and channels, testing it with evals, and running it on your own server or on Cursor's hosting.", "url": "https://www.anchorterminal.com/tools/cursor-agent-sdk", "markdownUrl": "https://www.anchorterminal.com/tools/cursor-agent-sdk.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cursor-agent-sdk.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cursor-agent-sdk.json", "dns": "cursor-agent-sdk.grade.anchorterminal.com", "license": "Proprietary. The package's LICENSE.md reads \"© Anysphere Inc. All rights reserved\", with use subject to Cursor's Terms of Service (updated 3 September 2026). No source repository is published", "transports": [], "packages": [ { "registry": "npm", "name": "@grok/agent-sdk" } ], "auth": "mixed", "authNotes": "Model turns need a Cursor credential. `agent-sdk login` opens a browser sign-in and stores the key it creates, or pass a user API key from the dashboard or a team service-account key as `--api-key`, `CURSOR_API_KEY`, `CURSOR_API_KEY_FILE` or `CURSOR_SERVICE_ACCOUNT_KEY`. `logout` doesn't revoke the key. Direct tool calls without a model turn need no Cursor key. A self-hosted server is protected with `--bearer-token`, and a deployment's routes with an alias token.", "pricing": "byo-plan", "pricingNotes": "The package is free to install. Model turns draw on the Cursor plan of the key's owner, Free ($0, limited agent requests) to Ultra ($200 a month), and beyond the weekly pool the default model, Grok 4.5 with Fast on, is $4 per million input tokens and $18 per million output tokens. No price for Cursor-managed hosting and no statement of which plans include the Agent SDK were found (checked 2026-10-27).", "priceSummary": "Your plan", "where": "library", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Agent SDK docs, the npm package or the pricing page (checked 2026-10-27).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-27" }, "docsUrl": "https://cursor.com/docs/agent-sdk", "llmsTxt": "https://cursor.com/llms.txt", "capabilities": [ "agent.framework", "agent.mcp-client", "agent.durable", "agent.multi-agent", "obs.evals" ], "tags": [ "official", "framework", "typescript", "closed-source", "mcp", "llms-txt", "pre-1.0", "self-hosted", "hosted", "new" ], "lastRelease": "2026-10-25", "graded": true, "anchor": { "graded": true, "score": 63.7, "grade": "B", "agentReady": false, "rank": 501, "ranked": true, "rankOf": 1486, "categoryRank": 15, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 80, "maintenance": 74, "payments": 30, "reliability": 45, "schema": 82, "security": 68, "transparency": 71 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-02" }, "negative": 0, "verdict": "An agent-as-code framework with typed tools, declared read and write effects that drive retries and dry runs, an approval gate per tool and evals that assert on tool calls. It's closed source, every model turn runs through Cursor's backend on a Cursor plan, local sandboxing is off by default, and the changelog has two entries.", "bestFor": "Teams already on Cursor who want version-controlled agents for pull request review, triage and Slack, with evals in CI and one-command hosting.", "strengths": [ "Tools declare a read, write or idempotent effect. Only reads and idempotent calls retry, and dry-run sessions stub writes", "`needsApproval` on a tool parks the call until a person approves, and `ctx.approvedBy` records who did", "Evals assert which tools ran, with what input, and the reply's shape, and `github replay` turns a real pull request into signed test deliveries", "Every page has a Markdown twin listed in cursor.com/llms.txt, and the package ships the same docs and an llms.txt", "Sessions keep a record of every message and tool call, and OpenTelemetry export stays off until an endpoint is set" ], "weaknesses": [ "Closed source under Cursor's terms, with no public repository, CI or issue tracker", "Every model turn runs through Cursor's backend with a Cursor credential, including on a self-hosted server", "Local sandboxing is off by default, so shell commands auto-approve with the host's credentials", "The changelog has two entries, 0.2.29 and 0.3.0, both dated 23 October 2026. The 27 earlier @cursor/bdk versions have none", "The launch post's install command names a package that doesn't exist on npm" ], "agentNotes": [ "Install `@grok/agent-sdk`, not `@cursor/agent-sdk` from the launch post. That name answers 404 on npm", "Set `local.sandbox` before a turn reads webhook payloads, pull request diffs or chat. Without it shell commands auto-approve with the host's credentials", "Give every tool an `effect`. A tool without one counts as a write, runs once and is stubbed in dry runs", "Start `agent-sdk serve` with `--bearer-token` on any shared host. `--allow-anonymous` admits every caller as one principal", "Delete bot/hooks/memory.ts when sessions serve different people. The journal shares each turn's message and result with later turns" ], "metrics": { "kind": "library", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 63.7 } ], "editorialScores": { "ergonomics": 80, "maintenance": 74, "payments": 30, "reliability": 45, "schema": 82, "security": 68, "transparency": 49 }, "provenanceScore": 92, "checked": { "categories": { "ergonomics": "2026-11-02", "maintenance": "2026-11-02", "payments": "2026-11-02", "reliability": "2026-11-02", "schema": "2026-11-02", "security": "2026-11-02", "transparency": "2026-11-02" }, "last": "2026-11-02", "lastMoved": "2026-10-28", "oldest": "2026-11-02", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install --global @grok/agent-sdk", "headless": { "run": "agent-sdk run --dir . --message \"Introduce yourself in one sentence.\"" } }, "letme": { "capability": "https://letme.dev/agent.framework", "tool": "https://letme.dev/cursor-agent-sdk" }, "sameCompany": [ "cursor-cli", "grok-bot" ], "area": "frameworks", "unitPrices": [ { "item": "Grok 4.5 Fast (the default model) input, beyond the weekly pool", "unit": "1m-tokens", "usd": 4, "note": "cache reads $1" }, { "item": "Grok 4.5 Fast (the default model) output, beyond the weekly pool", "unit": "1m-tokens", "usd": 18 }, { "item": "Grok 4.5 input, Fast off, beyond the weekly pool", "unit": "1m-tokens", "usd": 2, "note": "cache reads $0.50" }, { "item": "Grok 4.5 output, Fast off, beyond the weekly pool", "unit": "1m-tokens", "usd": 6 }, { "item": "Premium plan (first plan with Cloud Agents and third-party models)", "unit": "month", "usd": 30 } ], "provenance": { "legalEntity": "Anysphere, Inc.", "domain": "cursor.com", "domainRegistered": "1995-12-20", "endpointOnVendorDomain": null, "terms": "https://cursor.com/terms-of-service", "privacy": "https://cursor.com/privacy", "statusPage": "https://status.cursor.com", "changelog": "https://cursor.com/docs/agent-sdk/changelog", "securityTxt": "valid", "checked": "2026-11-02", "notes": [ "The package's LICENSE.md and the site footer name Anysphere, Inc. The terms of service are dated 3 September 2026 and the privacy policy 11 October 2026.", "RDAP (Verisign) gives cursor.com a registration date of 1995-12-20.", "cursor.com/.well-known/security.txt has a Contact line pointing to github.com/getcursor/cursor/security and a secondary email, and no Expires line. The site's tracker reads a file with a Contact and no Expires as valid, as on the Cursor CLI listing.", "The footer links status.cursor.com. Its robots.txt answered with a Cloudflare challenge on 27 October 2026, so the status page wasn't read.", "The npm package's repository field points to github.com/cursor/cursor, which holds only a README and SECURITY.md.", "On 2 November 2026 status.cursor.com answered with a redirect to status.x.ai, whose page answered a Cloudflare block, so the status page couldn't be read." ], "score": 92 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cursor-agent-sdk.json", "live": { "slug": "cursor-agent-sdk", "vendorStatus": { "page": "https://status.cursor.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:21:00.20473918Z" }, "versions": [ { "registry": "npm", "name": "@grok/agent-sdk", "version": "0.6.0", "seenAt": "2026-11-06T23:19:06.91158327Z" } ], "npmWeekly": 9330, "securityTxt": { "url": "https://cursor.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-07T16:01:25.031295704Z" }, "llmsTxt": { "url": "https://cursor.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:13.986094369Z" }, "domain": { "domain": "cursor.com", "registered": "1995-12-20", "source": "https://rdap.verisign.com/com/v1/domain/cursor.com", "checkedAt": "2026-11-01T14:10:15.995316039Z" }, "pages": [ { "url": "https://cursor.com/docs/agent-sdk/changelog", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:02:17.860421755Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e878680a2c18" }, { "url": "https://cursor.com/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:02:21.713695997Z", "changedAt": "2026-10-21T00:22:04.890633076Z", "fingerprint": "60c67a53fa8c" }, { "url": "https://cursor.com/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:02:23.744923691Z", "changedAt": "2026-10-21T00:22:07.052190293Z", "fingerprint": "d31f70e876bc" } ], "updatedAt": "2026-11-07T18:21:00.20473918Z" } }, "answer": "Mastra scores 74.2 (BB) on agent readiness against Cursor Agent SDK's 63.7 (B), and leads in 6 of 7 scored categories.", "b": { "slug": "mastra", "name": "Mastra", "vendor": "Kepler Software, Inc.", "vendorUrl": "https://mastra.ai", "kind": "framework", "category": "frameworks", "summary": "Open-source TypeScript framework from Mastra for building agents and workflows, with memory, RAG, evals, tracing, an MCP client and server, and a local Studio. An optional hosted platform runs deployments and observability.", "url": "https://www.anchorterminal.com/tools/mastra", "markdownUrl": "https://www.anchorterminal.com/tools/mastra.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/mastra.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/mastra.json", "dns": "mastra.grade.anchorterminal.com", "repo": "https://github.com/mastra-ai/mastra", "license": "Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing", "transports": [], "packages": [ { "registry": "npm", "name": "@mastra/core" }, { "registry": "npm", "name": "@mastra/mcp" }, { "registry": "npm", "name": "mastra" } ], "auth": "api-key", "authNotes": "The framework has no account of its own. The model router takes `provider/model` strings and each provider's own key. The hosted Mastra platform needs an account.", "pricing": "free", "pricingNotes": "Free and open source. You pay for model calls. The hosted platform has a $0 Starter plan with 100K observability events and 24 CPU hours, then $10 per 100K events and $0.35 a CPU hour, and Teams at $250 a month (https://mastra.ai/pricing, checked 2026-11-06).", "priceSummary": "Free · OSS", "where": "library", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Mastra docs, the repository or the pricing page (checked 2026-10-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 29383, "npmWeekly": 3116983, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://mastra.ai/docs", "llmsTxt": "https://mastra.ai/llms.txt", "capabilities": [ "agent.framework", "agent.durable", "agent.mcp-client", "agent.multi-agent" ], "tags": [ "framework", "typescript", "open-source", "llms-txt", "mcp", "telemetry-default-on" ], "lastRelease": "2026-11-04", "graded": true, "anchor": { "graded": true, "score": 74.2, "grade": "BB", "agentReady": true, "rank": 91, "ranked": true, "rankOf": 1486, "categoryRank": 7, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 92, "maintenance": 96, "payments": 60, "reliability": 87, "schema": 98, "security": 67, "transparency": 72 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": -8, "negativeNotes": [ "2026-06-17. Malicious versions of Mastra's npm packages were published, among them @mastra/core 1.42.1 at 01:15 UTC, and GitHub malware advisories that day (GHSA-pp62-grrw-hvfp and others) say any machine that installed one should be treated as fully compromised. All 21 Mastra packages we checked on OSV carry one. Mastra published clean versions the same day and the changelogs name an \"easy-day-js\" supply-chain incident, but we found no advisory or post-mortem from Mastra. Fixed and under four months old, so 8 points. https://osv.dev/vulnerability/MAL-2026-6011" ], "verdict": "A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes.", "bestFor": "TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.", "strengths": [ "MCP client with requireToolApproval per server or per tool, allowedHosts and a curated environment for stdio servers", "Guardrail processors for prompt injection, PII, moderation and cost limits, run on input and output", "Workflows with snapshots, suspend and resume, and durable agents on Inngest or an evented engine", "Apache 2.0 core, 1.0 since 20 January 2026, with 27 releases of @mastra/core in 90 days to 6 November", "llms.txt with a when-to-use section and condensed instructions for coding agents" ], "weaknesses": [ "Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026", "CLI, server and Studio send usage analytics by default, including token counts every 15 minutes, off with MASTRA_TELEMETRY_DISABLED=1", "No SECURITY.md, no security.txt and no bug bounty found", "Code under ee/ is source-available under the Mastra Enterprise License, not Apache 2.0", "TypeScript only, Node 22.13 or newer" ], "agentNotes": [ "Set MASTRA_TELEMETRY_DISABLED=1 in every environment that runs the CLI, the server or Studio", "Pin exact versions with a lockfile, and make sure no 17 June 2026 release such as @mastra/core 1.42.1 is installed", "Set requireToolApproval on MCP servers that write, and allowedHosts when server URLs come from configuration", "Add PromptInjectionDetector as an input processor when tools return web or user content", "Use supervisor agents through generate() or stream(). `.network()` is deprecated" ], "metrics": { "kind": "library", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 74.2 } ], "editorialScores": { "ergonomics": 92, "maintenance": 96, "payments": 60, "reliability": 87, "schema": 98, "security": 67, "transparency": 72 }, "provenanceScore": 71, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm create mastra@latest # or: npm i @mastra/core @mastra/mcp" }, "letme": { "capability": "https://letme.dev/agent.framework", "tool": "https://letme.dev/mastra" }, "area": "frameworks", "provenance": { "legalEntity": "Kepler Software, Inc.", "domain": "mastra.ai", "domainRegistered": "2024-10-01", "endpointOnVendorDomain": null, "terms": "https://mastra.ai/terms-of-service", "privacy": "https://mastra.ai/privacy-policy", "statusPage": "https://statuspage.incident.io/mastra-platform", "changelog": "https://github.com/mastra-ai/mastra/blob/main/packages/core/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The privacy policy names Kepler Software Inc as operator of mastra.ai and shows a last-published date of 25 April 2025.", "The licence file is copyright Kepler Software, Inc.", "mastra.ai/.well-known/security.txt returns 404 (rechecked 6 November 2026), and the repository has no SECURITY.md.", "RDAP gives mastra.ai a registration date of 2024-10-01.", "The status page covers the hosted platform, not the framework." ], "score": 71 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/mastra.json", "live": { "slug": "mastra", "vendorStatus": { "page": "https://statuspage.incident.io/mastra-platform", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:21:22.180687494Z" }, "versions": [ { "registry": "github", "name": "mastra-ai/mastra", "version": "@mastra/core@1.82.0", "released": "2026-11-04", "seenAt": "2026-11-06T23:43:05.299046627Z" }, { "registry": "npm", "name": "@mastra/core", "version": "1.82.0", "seenAt": "2026-11-06T23:43:01.102546802Z" }, { "registry": "npm", "name": "@mastra/mcp", "version": "2.8.0", "seenAt": "2026-11-06T23:43:01.962943277Z" }, { "registry": "npm", "name": "mastra", "version": "1.38.0", "seenAt": "2026-11-06T23:43:03.330470883Z" } ], "githubStars": 29384, "npmWeekly": 3116983, "securityTxt": { "url": "https://mastra.ai/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:45.130857018Z" }, "llmsTxt": { "url": "https://mastra.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:57.501317652Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/mastra-ai/mastra/main/packages/core/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:21:37.959722321Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "0bdb3498f7aa" }, { "url": "https://mastra.ai/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:13:54.312763229Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "0204673a21a8" }, { "url": "https://mastra.ai/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:13:56.829832485Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1621ce3063d8" }, { "url": "https://mastra.ai/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:13:58.580048861Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "edbcf520f26c" } ], "updatedAt": "2026-11-07T18:21:22.180687494Z" } }, "edges": [ { "by": 42, "category": "reliability", "leads": "mastra", "name": "Reliability", "reasons": { "a": "Local-package reading, since the owner runs the framework, with Cursor's hosting as an option. Official npm package with Node 22.13 or newer stated in engines and in the docs, which also say never Bun (20). Closed source, so no public CI or test suite (0). No public issue tracker. github.com/cursor/cursor holds a README and SECURITY.md, and forum.cursor.com has no Agent SDK tag, so there's nothing to count open crashes against. The troubleshooting page lists known failures with fixes (5). A dated changelog of two entries, 0.2.29 and 0.3.0, both 23 October 2026, and 0.3.0 calls out the removed `persistent` option, but the 27 earlier @cursor/bdk versions and 123 @cursor/july versions have no notes, and one build ships under three package names (5). Version 0.3.0, but the changelog post of 20 October says generally available and the docs changelog labels 0.3.0 the GA release, which we read as declared stable (15). 20+0+5+5+15 = 45.", "b": "Official npm packages, Node 22.13 or newer (20). Public CI workflows for unit, store, workspace and e2e tests; on 6 November the newest runs on main (Version Packages, Trigger Cloud Integration Tests) succeeded, while the test workflows themselves run on pull requests (22). 436 open issues and 795 open issues and pull requests on 6 November from GitHub's API, with 2,077 issues opened in the 90 days to 3 November; all 50 newest had a comment and 24 were closed, with issue-triage automation (18). A changesets CHANGELOG per package, a CI gate that needs approval for any major bump and migration guides, but no written versioning policy found, and `.network()` is deprecated without a removal date (12). 1.82.0 (15). 20+22+18+12+15 = 87, up from 74 on 6 October, when GitHub couldn't be read." }, "scores": { "a": 45, "b": 87 } }, { "by": 30, "category": "payments", "leads": "mastra", "name": "Payments \u0026 pricing", "reasons": { "a": "Framework reading of the published rubric. No payment protocol (0). Per-million-token prices for Cursor models, including the default Grok 4.5 with Fast, and plan prices are public, but no price for managed hosting and no statement of which plans cover the Agent SDK were found (15). The package is free and the Free plan needs no card, but its usage is only described as limited agent requests (15). A person signs in through a browser or creates an API key in the dashboard before a model turn runs (0). 0+15+15+0 = 30.", "b": "No payment protocol (0). Scored on the hosted platform, whose per-unit prices are public without a login ($10 per 100K observability events and $0.35 a CPU hour on Starter) (20). The Apache 2.0 packages install with no card (20) and no account, and run any model (20)." }, "scores": { "a": 30, "b": 60 } }, { "by": 22, "category": "maintenance", "leads": "mastra", "name": "Maintenance \u0026 community", "reasons": { "a": "0.3.0 on npm on 25 October 2026, per the 27 October check (npm not re-read on 2 November), and the docs changelog still ends at 0.3.0 of 23 October (30). Five @grok/agent-sdk versions from 22 to 25 October and 29 @cursor/bdk versions since 22 September, per the 27 October check (20). Closed product. A public changelog with two entries and a forum with no Agent SDK tag, so we couldn't see replies to SDK reports (8). The npm package is current and official, TypeScript only (12). Dependencies are current releases, but there's no public CI and the same build goes out under three names with a postinstall script (4). 30+20+8+12+4 = 74.", "b": "@mastra/core 1.82.0 on 2026-11-04 (30). 27 stable releases in the 90 days to 6 November, 8 of them since 6 October (20). 436 open issues on 6 November, all 50 newest issues commented and 24 of them closed (22). Client, MCP and store packages are current, and @mastra/mcp 1.x stays supported beside 2.x (15). Renovate and CI configured, with the newest runs on main passing (9). 30+20+22+15+9 = 96." }, "scores": { "a": 74, "b": 96 } }, { "by": 16, "category": "schema", "leads": "mastra", "name": "Schema \u0026 documentation", "reasons": { "a": "Framework reading. Typed TypeScript declarations ship in the package, tools take Zod or JSON Schema, `agent-sdk help --json` describes every command's flags and exit codes, and `GET /v1/info` and `GET /v1/tools/:name` return the discovered surface and each tool's schemas. No OpenAPI document for the HTTP routes (20). cursor.com/llms.txt lists every Agent SDK page with a Markdown twin, and the package ships the docs and an llms.txt (10). The overview has a table of when to use the Agent SDK, Automations or Grok Bot, and the hooks page has a table of what to use instead of a hook for each job (18). Typed config, `effect` as an enum or predicate, `timeArgs` checked against the input schema, and slug patterns stated (13). Examples on every page, with error tables for direct tool calls, HTTP 401, 403 and 409, the limit error's JSON and seven exit codes (15). A dated changelog, but only two entries, both from 23 October 2026 (6). 20+10+18+13+15+6 = 82.", "b": "Typed TypeScript API with a reference section (25). llms.txt with a when-to-use list and condensed instructions for coding agents (10). The docs say when to use durable agents, and point multi-agent users from `.network()` to supervisor agents (20). Tools take Zod schemas (15). Examples on every page, and MastraError with ids and categories documented, though errors are spread across pages (13). Per-package changelogs and migration guides (15)." }, "scores": { "a": 82, "b": 98 } }, { "by": 12, "category": "ergonomics", "leads": "mastra", "name": "Agent ergonomics", "reasons": { "a": "Framework reading, scored on what it takes to run a tool-calling agent with MCP. One file per tool and one file per MCP connection, `tools` and `disallowedTools` filters with `effects: \"read\"`, and an allowlist for the harness's built-in tools (22). Concurrency caps with queued turns, `--fields`, page tokens and limits on list commands, and a per-session cost view. We found no turn cap or spend cap for a run (12). Built-in routes return `{ ok: false, error }` codes, direct tool calls have documented 400, 404, 409 and 500 codes, and the CLI has seven exit codes (18). Reads and idempotent calls retry up to three times, writes run once, MCP readOnlyHint and idempotentHint decide retries for connection tools, and dry-run sessions stub writes (20). `agent-sdk init` scaffolds a working project and every agent field is optional, but the framework is TypeScript only (8). 22+12+18+20+8 = 80.", "b": "An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10)." }, "scores": { "a": 80, "b": 92 } } ], "facts": [ { "a": "Agent framework", "b": "Agent framework", "name": "Kind" }, { "a": "Cursor", "b": "Kepler Software, Inc.", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "", "name": "Transports" }, { "a": "OAuth or key", "b": "API key", "name": "Auth" }, { "a": "Your plan", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Proprietary. The package's LICENSE.md reads \"© Anysphere Inc. All rights reserved\", with use subject to Cursor's Terms of Service (updated 3 September 2026). No source repository is published", "b": "Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-25", "b": "2026-11-04", "name": "Last release" }, { "a": "2026-09-03", "b": "2026-10-26", "name": "Terms last updated" }, { "a": "2026-09-29", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "yes", "name": "Customer content may train models" }, { "a": "yes", "b": "yes", "name": "Terms restrict automated access" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "29k stars, 3.1M npm/wk", "name": "Popularity" } ], "faq": [ { "answer": "Mastra scores 74.2 (BB) on agent readiness against Cursor Agent SDK's 63.7 (B), and leads in 6 of 7 scored categories.", "question": "Which is better for AI agents, Cursor Agent SDK or Mastra?" }, { "answer": "No open-source release is listed for Cursor Agent SDK. Mastra is open source (Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing).", "question": "Are Cursor Agent SDK and Mastra open source?" } ], "goodFor": [ { "aheadOn": null, "also": [ "No incidents deducted, where Mastra loses 8 points for them" ], "goodFor": "Teams already on Cursor who want version-controlled agents for pull request review, triage and Slack, with evals in CI and one-command hosting.", "slug": "cursor-agent-sdk", "watchFor": "Closed source under Cursor's terms, with no public repository, CI or issue tracker" }, { "aheadOn": [ "Reliability, 87 against 45", "Schema \u0026 documentation, 98 against 82", "Agent ergonomics, 92 against 80", "Payments \u0026 pricing, 60 against 30", "Maintenance \u0026 community, 96 against 74" ], "also": [ "Agent-ready, a grade of BB or better", "Open source" ], "goodFor": "TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.", "slug": "mastra", "watchFor": "Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026" } ], "history": { "cursor-agent-sdk": [ { "causes": [ "method" ], "date": "2026-10-28", "delta": 0.1, "from": 63.6, "fromGrade": "B", "to": 63.7, "toGrade": "B" } ], "mastra": null }, "job": { "capability": "agent.framework", "name": "Agent frameworks" }, "others": [ { "json": "https://www.anchorterminal.com/compare/agentos-vs-cursor-agent-sdk.json", "title": "AgentOS vs Cursor Agent SDK", "url": "https://www.anchorterminal.com/compare/agentos-vs-cursor-agent-sdk" }, { "json": "https://www.anchorterminal.com/compare/agentos-vs-mastra.json", "title": "AgentOS vs Mastra", "url": "https://www.anchorterminal.com/compare/agentos-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/agno-vs-cursor-agent-sdk.json", "title": "Agno vs Cursor Agent SDK", "url": "https://www.anchorterminal.com/compare/agno-vs-cursor-agent-sdk" }, { "json": "https://www.anchorterminal.com/compare/agno-vs-mastra.json", "title": "Agno vs Mastra", "url": "https://www.anchorterminal.com/compare/agno-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-cursor-agent-sdk.json", "title": "BoxLang AI vs Cursor Agent SDK", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-cursor-agent-sdk" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra.json", "title": "BoxLang AI vs Mastra", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-cursor-agent-sdk.json", "title": "Claude Agent SDK vs Cursor Agent SDK", "url": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-cursor-agent-sdk" }, { "json": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-mastra.json", "title": "Claude Agent SDK vs Mastra", "url": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/crewai-vs-cursor-agent-sdk.json", "title": "CrewAI vs Cursor Agent SDK", "url": "https://www.anchorterminal.com/compare/crewai-vs-cursor-agent-sdk" }, { "json": "https://www.anchorterminal.com/compare/crewai-vs-mastra.json", "title": "CrewAI vs Mastra", "url": "https://www.anchorterminal.com/compare/crewai-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-docker-agent.json", "title": "Cursor Agent SDK vs Docker Agent", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-docker-agent" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-google-adk.json", "title": "Cursor Agent SDK vs Agent Development Kit (ADK)", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-google-adk" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-guilds-run.json", "title": "Cursor Agent SDK vs guilds.run", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-guilds-run" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-langgraph.json", "title": "Cursor Agent SDK vs LangGraph", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-langgraph" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-llamaindex.json", "title": "Cursor Agent SDK vs LlamaIndex Framework", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-llamaindex" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-microsoft-agent-framework.json", "title": "Cursor Agent SDK vs Microsoft Agent Framework", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-microsoft-agent-framework" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-openai-agents-sdk.json", "title": "Cursor Agent SDK vs OpenAI Agents SDK", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-openai-agents-sdk" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-pydantic-ai.json", "title": "Cursor Agent SDK vs Pydantic AI", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-pydantic-ai" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-smolagents.json", "title": "Cursor Agent SDK vs smolagents", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-smolagents" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-strands-agents.json", "title": "Cursor Agent SDK vs Strands Agents", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-strands-agents" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-tradingagents.json", "title": "Cursor Agent SDK vs TradingAgents", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-vercel-ai-sdk.json", "title": "Cursor Agent SDK vs AI SDK", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-vercel-ai-sdk" }, { "json": "https://www.anchorterminal.com/compare/docker-agent-vs-mastra.json", "title": "Docker Agent vs Mastra", "url": "https://www.anchorterminal.com/compare/docker-agent-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/google-adk-vs-mastra.json", "title": "Agent Development Kit (ADK) vs Mastra", "url": "https://www.anchorterminal.com/compare/google-adk-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/guilds-run-vs-mastra.json", "title": "guilds.run vs Mastra", "url": "https://www.anchorterminal.com/compare/guilds-run-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/langgraph-vs-mastra.json", "title": "LangGraph vs Mastra", "url": "https://www.anchorterminal.com/compare/langgraph-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/llamaindex-vs-mastra.json", "title": "LlamaIndex Framework vs Mastra", "url": "https://www.anchorterminal.com/compare/llamaindex-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-microsoft-agent-framework.json", "title": "Mastra vs Microsoft Agent Framework", "url": "https://www.anchorterminal.com/compare/mastra-vs-microsoft-agent-framework" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk.json", "title": "Mastra vs OpenAI Agents SDK", "url": "https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai.json", "title": "Mastra vs Pydantic AI", "url": "https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-smolagents.json", "title": "Mastra vs smolagents", "url": "https://www.anchorterminal.com/compare/mastra-vs-smolagents" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-strands-agents.json", "title": "Mastra vs Strands Agents", "url": "https://www.anchorterminal.com/compare/mastra-vs-strands-agents" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-tradingagents.json", "title": "Mastra vs TradingAgents", "url": "https://www.anchorterminal.com/compare/mastra-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk.json", "title": "Mastra vs AI SDK", "url": "https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk" } ], "panel": null, "scores": [ { "by": 42, "cursor-agent-sdk": 45, "edge": "mastra", "key": "reliability", "mastra": 87, "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 16, "cursor-agent-sdk": 82, "edge": "mastra", "key": "schema", "mastra": 98, "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 12, "cursor-agent-sdk": 80, "edge": "mastra", "key": "ergonomics", "mastra": 92, "name": "Agent ergonomics", "weight": 13 }, { "by": 1, "cursor-agent-sdk": 68, "edge": "cursor-agent-sdk", "key": "security", "mastra": 67, "name": "Security \u0026 auth", "weight": 14 }, { "by": 30, "cursor-agent-sdk": 30, "edge": "mastra", "key": "payments", "mastra": 60, "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 22, "cursor-agent-sdk": 74, "edge": "mastra", "key": "maintenance", "mastra": 96, "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 1, "cursor-agent-sdk": 71, "edge": "mastra", "key": "transparency", "mastra": 72, "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Mastra scores 74.2 (BB) on agent readiness against Cursor Agent SDK's 63.7 (B), and leads in 6 of 7 scored categories. Both do agent frameworks.", "tasks": null, "tutorials": [], "verdicts": { "cursor-agent-sdk": "An agent-as-code framework with typed tools, declared read and write effects that drive retries and dry runs, an approval gate per tool and evals that assert on tool calls. It's closed source, every model turn runs through Cursor's backend on a Cursor plan, local sandboxing is off by default, and the changelog has two entries.", "mastra": "A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra", "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra.min.md" }, "markdown": "Mastra scores 74.2 (BB) on agent readiness against Cursor Agent SDK's 63.7 (B), and leads in 6 of 7 scored categories. Both do agent frameworks.\n\n- Cursor Agent SDK: grade B, 63.7/100, rank #501 of 1486. Markdown https://www.anchorterminal.com/tools/cursor-agent-sdk.md · JSON https://www.anchorterminal.com/api/v1/tools/cursor-agent-sdk.json\n- Mastra: grade BB, 74.2/100, rank #91 of 1486. Markdown https://www.anchorterminal.com/tools/mastra.md · JSON https://www.anchorterminal.com/api/v1/tools/mastra.json\n- Best agent frameworks and SDKs: https://www.anchorterminal.com/best/frameworks/index.md\n- All 171 frameworks comparisons: https://www.anchorterminal.com/compare/frameworks/index.md\n\n## Which one, for what\n\n### Cursor Agent SDK (B)\n\nGood for: Teams already on Cursor who want version-controlled agents for pull request review, triage and Slack, with evals in CI and one-command hosting.\n\nAlso in its favour:\n- No incidents deducted, where Mastra loses 8 points for them\n\nWatch for: Closed source under Cursor's terms, with no public repository, CI or issue tracker\n\n### Mastra (BB)\n\nGood for: TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.\n\nAhead on:\n- Reliability, 87 against 45\n- Schema \u0026 documentation, 98 against 82\n- Agent ergonomics, 92 against 80\n- Payments \u0026 pricing, 60 against 30\n- Maintenance \u0026 community, 96 against 74\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n- Open source\n\nWatch for: Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026\n\n\n## Why the edge\n\n### Reliability: Mastra +42\n\n- Cursor Agent SDK (45): Local-package reading, since the owner runs the framework, with Cursor's hosting as an option. Official npm package with Node 22.13 or newer stated in engines and in the docs, which also say never Bun (20). Closed source, so no public CI or test suite (0). No public issue tracker. github.com/cursor/cursor holds a README and SECURITY.md, and forum.cursor.com has no Agent SDK tag, so there's nothing to count open crashes against. The troubleshooting page lists known failures with fixes (5). A dated changelog of two entries, 0.2.29 and 0.3.0, both 23 October 2026, and 0.3.0 calls out the removed `persistent` option, but the 27 earlier @cursor/bdk versions and 123 @cursor/july versions have no notes, and one build ships under three package names (5). Version 0.3.0, but the changelog post of 20 October says generally available and the docs changelog labels 0.3.0 the GA release, which we read as declared stable (15). 20+0+5+5+15 = 45.\n- Mastra (87): Official npm packages, Node 22.13 or newer (20). Public CI workflows for unit, store, workspace and e2e tests; on 6 November the newest runs on main (Version Packages, Trigger Cloud Integration Tests) succeeded, while the test workflows themselves run on pull requests (22). 436 open issues and 795 open issues and pull requests on 6 November from GitHub's API, with 2,077 issues opened in the 90 days to 3 November; all 50 newest had a comment and 24 were closed, with issue-triage automation (18). A changesets CHANGELOG per package, a CI gate that needs approval for any major bump and migration guides, but no written versioning policy found, and `.network()` is deprecated without a removal date (12). 1.82.0 (15). 20+22+18+12+15 = 87, up from 74 on 6 October, when GitHub couldn't be read.\n\n### Payments \u0026 pricing: Mastra +30\n\n- Cursor Agent SDK (30): Framework reading of the published rubric. No payment protocol (0). Per-million-token prices for Cursor models, including the default Grok 4.5 with Fast, and plan prices are public, but no price for managed hosting and no statement of which plans cover the Agent SDK were found (15). The package is free and the Free plan needs no card, but its usage is only described as limited agent requests (15). A person signs in through a browser or creates an API key in the dashboard before a model turn runs (0). 0+15+15+0 = 30.\n- Mastra (60): No payment protocol (0). Scored on the hosted platform, whose per-unit prices are public without a login ($10 per 100K observability events and $0.35 a CPU hour on Starter) (20). The Apache 2.0 packages install with no card (20) and no account, and run any model (20).\n\n### Maintenance \u0026 community: Mastra +22\n\n- Cursor Agent SDK (74): 0.3.0 on npm on 25 October 2026, per the 27 October check (npm not re-read on 2 November), and the docs changelog still ends at 0.3.0 of 23 October (30). Five @grok/agent-sdk versions from 22 to 25 October and 29 @cursor/bdk versions since 22 September, per the 27 October check (20). Closed product. A public changelog with two entries and a forum with no Agent SDK tag, so we couldn't see replies to SDK reports (8). The npm package is current and official, TypeScript only (12). Dependencies are current releases, but there's no public CI and the same build goes out under three names with a postinstall script (4). 30+20+8+12+4 = 74.\n- Mastra (96): @mastra/core 1.82.0 on 2026-11-04 (30). 27 stable releases in the 90 days to 6 November, 8 of them since 6 October (20). 436 open issues on 6 November, all 50 newest issues commented and 24 of them closed (22). Client, MCP and store packages are current, and @mastra/mcp 1.x stays supported beside 2.x (15). Renovate and CI configured, with the newest runs on main passing (9). 30+20+22+15+9 = 96.\n\n### Schema \u0026 documentation: Mastra +16\n\n- Cursor Agent SDK (82): Framework reading. Typed TypeScript declarations ship in the package, tools take Zod or JSON Schema, `agent-sdk help --json` describes every command's flags and exit codes, and `GET /v1/info` and `GET /v1/tools/:name` return the discovered surface and each tool's schemas. No OpenAPI document for the HTTP routes (20). cursor.com/llms.txt lists every Agent SDK page with a Markdown twin, and the package ships the docs and an llms.txt (10). The overview has a table of when to use the Agent SDK, Automations or Grok Bot, and the hooks page has a table of what to use instead of a hook for each job (18). Typed config, `effect` as an enum or predicate, `timeArgs` checked against the input schema, and slug patterns stated (13). Examples on every page, with error tables for direct tool calls, HTTP 401, 403 and 409, the limit error's JSON and seven exit codes (15). A dated changelog, but only two entries, both from 23 October 2026 (6). 20+10+18+13+15+6 = 82.\n- Mastra (98): Typed TypeScript API with a reference section (25). llms.txt with a when-to-use list and condensed instructions for coding agents (10). The docs say when to use durable agents, and point multi-agent users from `.network()` to supervisor agents (20). Tools take Zod schemas (15). Examples on every page, and MastraError with ids and categories documented, though errors are spread across pages (13). Per-package changelogs and migration guides (15).\n\n### Agent ergonomics: Mastra +12\n\n- Cursor Agent SDK (80): Framework reading, scored on what it takes to run a tool-calling agent with MCP. One file per tool and one file per MCP connection, `tools` and `disallowedTools` filters with `effects: \"read\"`, and an allowlist for the harness's built-in tools (22). Concurrency caps with queued turns, `--fields`, page tokens and limits on list commands, and a per-session cost view. We found no turn cap or spend cap for a run (12). Built-in routes return `{ ok: false, error }` codes, direct tool calls have documented 400, 404, 409 and 500 codes, and the CLI has seven exit codes (18). Reads and idempotent calls retry up to three times, writes run once, MCP readOnlyHint and idempotentHint decide retries for connection tools, and dry-run sessions stub writes (20). `agent-sdk init` scaffolds a working project and every agent field is optional, but the framework is TypeScript only (8). 22+12+18+20+8 = 80.\n- Mastra (92): An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10).\n\n## Score by category\n\n| Category | Weight | Cursor Agent SDK | Mastra | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 45 | 87 | Mastra +42 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 82 | 98 | Mastra +16 |\n| Agent ergonomics | 13% (16.2 this run) | 80 | 92 | Mastra +12 |\n| Security \u0026 auth | 14% (17.5 this run) | 68 | 67 | Cursor Agent SDK +1 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 60 | Mastra +30 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 74 | 96 | Mastra +22 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 71 | 72 | Mastra +1 |\n| Negative events | ≤15 | 0 | -8 | |\n| **Total** | | **63.7 · B** | **74.2 · BB** | |\n\n## Facts side by side\n\n| Fact | Cursor Agent SDK | Mastra |\n| --- | --- | --- |\n| Kind | Agent framework | Agent framework |\n| Vendor | Cursor | Kepler Software, Inc. |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | OAuth or key | API key |\n| Pricing | Your plan | Free |\n| x402 | no | no |\n| Licence | Proprietary. The package's LICENSE.md reads \"© Anysphere Inc. All rights reserved\", with use subject to Cursor's Terms of Service (updated 3 September 2026). No source repository is published | Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-10-25 | 2026-11-04 |\n| Terms last updated | 2026-09-03 | 2026-10-26 |\n| Privacy policy last updated | 2026-09-29 | no date given |\n| Customer content may train models | not found in the text | yes |\n| Terms restrict automated access | yes | yes |\n| Terms restrict benchmarking | yes | not found in the text |\n| Terms or service can change without notice | yes | yes |\n| Arbitration or class-action waiver | yes | yes |\n| Popularity | none | 29k stars, 3.1M npm/wk |\n\n## How the scores have moved\n\n### Cursor Agent SDK\n\n- +0.1 on 28 October 2026: checklist\n\n### Mastra\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Cursor Agent SDK.** An agent-as-code framework with typed tools, declared read and write effects that drive retries and dry runs, an approval gate per tool and evals that assert on tool calls. It's closed source, every model turn runs through Cursor's backend on a Cursor plan, local sandboxing is off by default, and the changelog has two entries.\n\n**Mastra.** A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes.\n\n## Before you call either\n\n### Cursor Agent SDK\n\n1. Install `@grok/agent-sdk`, not `@cursor/agent-sdk` from the launch post. That name answers 404 on npm\n2. Set `local.sandbox` before a turn reads webhook payloads, pull request diffs or chat. Without it shell commands auto-approve with the host's credentials\n3. Give every tool an `effect`. A tool without one counts as a write, runs once and is stubbed in dry runs\n4. Start `agent-sdk serve` with `--bearer-token` on any shared host. `--allow-anonymous` admits every caller as one principal\n5. Delete bot/hooks/memory.ts when sessions serve different people. The journal shares each turn's message and result with later turns\n\n### Mastra\n\n1. Set MASTRA_TELEMETRY_DISABLED=1 in every environment that runs the CLI, the server or Studio\n2. Pin exact versions with a lockfile, and make sure no 17 June 2026 release such as @mastra/core 1.42.1 is installed\n3. Set requireToolApproval on MCP servers that write, and allowedHosts when server URLs come from configuration\n4. Add PromptInjectionDetector as an input processor when tools return web or user content\n5. Use supervisor agents through generate() or stream(). `.network()` is deprecated\n\n## Questions\n\n### Which is better for AI agents, Cursor Agent SDK or Mastra?\n\nMastra scores 74.2 (BB) on agent readiness against Cursor Agent SDK's 63.7 (B), and leads in 6 of 7 scored categories.\n\n### Are Cursor Agent SDK and Mastra open source?\n\nNo open-source release is listed for Cursor Agent SDK. Mastra is open source (Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"cursor-agent-sdk\", \"b\": \"mastra\"}`. From a terminal: `anchor compare cursor-agent-sdk mastra`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/cursor-agent-sdk.json and https://www.anchorterminal.com/api/v1/tools/mastra.json\n\n## Other comparisons with Cursor Agent SDK or Mastra\n\n- [AgentOS vs Cursor Agent SDK](https://www.anchorterminal.com/compare/agentos-vs-cursor-agent-sdk.md)\n- [AgentOS vs Mastra](https://www.anchorterminal.com/compare/agentos-vs-mastra.md)\n- [Agno vs Cursor Agent SDK](https://www.anchorterminal.com/compare/agno-vs-cursor-agent-sdk.md)\n- [Agno vs Mastra](https://www.anchorterminal.com/compare/agno-vs-mastra.md)\n- [BoxLang AI vs Cursor Agent SDK](https://www.anchorterminal.com/compare/boxlang-ai-vs-cursor-agent-sdk.md)\n- [BoxLang AI vs Mastra](https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra.md)\n- [Claude Agent SDK vs Cursor Agent SDK](https://www.anchorterminal.com/compare/claude-agent-sdk-vs-cursor-agent-sdk.md)\n- [Claude Agent SDK vs Mastra](https://www.anchorterminal.com/compare/claude-agent-sdk-vs-mastra.md)\n- [CrewAI vs Cursor Agent SDK](https://www.anchorterminal.com/compare/crewai-vs-cursor-agent-sdk.md)\n- [CrewAI vs Mastra](https://www.anchorterminal.com/compare/crewai-vs-mastra.md)\n- [Cursor Agent SDK vs Docker Agent](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-docker-agent.md)\n- [Cursor Agent SDK vs Agent Development Kit (ADK)](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-google-adk.md)\n- [Cursor Agent SDK vs guilds.run](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-guilds-run.md)\n- [Cursor Agent SDK vs LangGraph](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-langgraph.md)\n- [Cursor Agent SDK vs LlamaIndex Framework](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-llamaindex.md)\n- [Cursor Agent SDK vs Microsoft Agent Framework](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-microsoft-agent-framework.md)\n- [Cursor Agent SDK vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-openai-agents-sdk.md)\n- [Cursor Agent SDK vs Pydantic AI](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-pydantic-ai.md)\n- [Cursor Agent SDK vs smolagents](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-smolagents.md)\n- [Cursor Agent SDK vs Strands Agents](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-strands-agents.md)\n- [Cursor Agent SDK vs TradingAgents](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-tradingagents.md)\n- [Cursor Agent SDK vs AI SDK](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-vercel-ai-sdk.md)\n- [Docker Agent vs Mastra](https://www.anchorterminal.com/compare/docker-agent-vs-mastra.md)\n- [Agent Development Kit (ADK) vs Mastra](https://www.anchorterminal.com/compare/google-adk-vs-mastra.md)\n- [guilds.run vs Mastra](https://www.anchorterminal.com/compare/guilds-run-vs-mastra.md)\n- [LangGraph vs Mastra](https://www.anchorterminal.com/compare/langgraph-vs-mastra.md)\n- [LlamaIndex Framework vs Mastra](https://www.anchorterminal.com/compare/llamaindex-vs-mastra.md)\n- [Mastra vs Microsoft Agent Framework](https://www.anchorterminal.com/compare/mastra-vs-microsoft-agent-framework.md)\n- [Mastra vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk.md)\n- [Mastra vs Pydantic AI](https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai.md)\n- [Mastra vs smolagents](https://www.anchorterminal.com/compare/mastra-vs-smolagents.md)\n- [Mastra vs Strands Agents](https://www.anchorterminal.com/compare/mastra-vs-strands-agents.md)\n- [Mastra vs TradingAgents](https://www.anchorterminal.com/compare/mastra-vs-tradingagents.md)\n- [Mastra vs AI SDK](https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Cursor Agent SDK vs Mastra", "url": "" } ], "description": "Mastra scores 74.2 (BB) to Cursor Agent SDK's 63.7 (B) for agent frameworks. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Cursor Agent SDK B 63.7", "Mastra BB 74.2", "scores" ], "h1": "Cursor Agent SDK vs Mastra", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/cursor-agent-sdk-vs-mastra", "published": "2026-10-01", "section": "tools", "title": "Cursor Agent SDK vs Mastra for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra" }, "tokens": { "markdown": 4450, "slim": 2380 }, "version": 1 }