Head to head · Agent frameworks · October 2026 research run

Docker Agent vs Mastra

Mastra and Docker Agent score within a point of each other on agent readiness, 74.2 (BB) and 73.6 (BB). Docker Agent leads on transparency & trust. Both do agent frameworks.

Best agent frameworks and SDKs · All 171 frameworks comparisons

Which one, for what

Docker Agent BB

Best for Teams already on Docker who want agents defined in a file, shared through an OCI registry and run the same way in a terminal, in CI or behind an HTTP, MCP or A2A server.

Ahead on

  • Transparency & trust, 81 against 72

Also in its favour

  • No key needed to call it
  • Free to start without a card

Watch for

Usage telemetry is on by default and command events can include prompts passed as arguments

Mastra BB

Best for TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.

Ahead on

  • Schema & documentation, 98 against 90
  • Agent ergonomics, 92 against 81

Watch for

Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026

Why the edge

Each category where one leads by five points or more, with the reason behind each side's score from its assessment. The numbers are in the table below; this is what they stand for.

Agent ergonomics Mastra +11

Docker Agent 81

Framework reading, scored on what an agent with MCP needs. The README's agent with one MCP server is eight lines of YAML and no code, with deferred toolsets and a code mode (23). Budgets cap cost, tokens and time, tool results are bounded to 50 KiB since 1.148.0, and context is compacted, but max_iterations is unlimited and no budget applies unless declared (16). --json writes one NDJSON event per message, tool call and error, and the API documents 404, 409, 413 and 502 responses. No exit-code reference found for run --exec (14). Sessions resume from SQLite, the event stream replays from a sequence number, follow-ups accept an Idempotency-Key, and read-only and destructive tool annotations drive the safety modes (18). One binary and a model key or a local model are enough to start. The library is Go only (10).

Mastra 92

An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10).

Transparency & trust Docker Agent +9

Docker Agent 81

Apache-2.0 (30). The telemetry page lists what's collected and warns that arguments and error text can carry secrets or personal data. It doesn't name the endpoint (api.docker.com, per the source), link Docker's privacy policy or give a retention period, unchanged on 17 October (15). Breaking changes are dated in the changelog and one renamed variable kept a fallback for one release, with no written deprecation policy, and the changelog says frozen config schema versions aren't maintained long-term (10). Telemetry is disclosed in the README, the docs and a first-start notice, with an opt-out variable (20).

Mastra 72

Apache 2.0 for the core, with ee/ directories source-available under the Mastra Enterprise License (25). The privacy policy (last published 25 April 2025) covers the website, the Teams plan states six months' retention, and the subprocessor list sits in a trust centre our reader couldn't render (15). Migration guides and deprecation warnings, without dated removal windows (12). Every telemetry stream is documented with links to its source and one opt-out, and the reference now spells out what the project identifiers can be correlated with (20).

Schema & documentation Mastra +8

Docker Agent 90

Framework reading. agent-schema.json in the repository is a JSON Schema for the whole config, and the chat server serves its OpenAPI document at /openapi.json. We found no OpenAPI document for the native /api server and didn't check the Go package reference (22). llms.txt on docker.github.io/docker-agent and on docs.docker.com (10). The docs say when to use the API server and when the chat server, compare six ways to pass large input, and state that permissions aren't a security boundary (17). Configs are parsed strictly, unknown fields fail to load with a hint, and safety fields accept four named modes only (13). An examples directory, a troubleshooting page of common errors and documented HTTP status codes for the API. We found no exit-code reference for run --exec (13). A dated CHANGELOG.md and a numbered config schema, now version 16, with migration on load (15).

Mastra 98

Typed TypeScript API with a reference section (25). llms.txt with a when-to-use list and condensed instructions for coding agents (10). The docs say when to use durable agents, and point multi-agent users from .network() to supervisor agents (20). Tools take Zod schemas (15). Examples on every page, and MastraError with ids and categories documented, though errors are spread across pages (13). Per-package changelogs and migration guides (15).

Score by category

CategoryWeight this runDocker AgentMastraEdge
Reliability16%208887Docker Agent +1
Performance10%pendingpendingpendingnot scored in this run
Schema & documentation13%16.29098Mastra +8
Agent ergonomics13%16.28192Mastra +11
Security & auth14%17.57067Docker Agent +3
Payments & pricing10%12.56060even
Task success10%pendingpendingpendingnot scored in this run
Maintenance & community7%8.89696even
Transparency & trust7%8.88172Docker Agent +9
Negative events≤15-7-8
TotalBB 73.6/100BB 74.2/100

Facts side by side

FactDocker AgentMastra
KindAgent frameworkAgent framework
VendorDockerKepler Software, Inc.
Hosted endpointno (local only)no (local only)
Transports
AuthNoneAPI key
PricingFreeFree
x402nono
LicenceApache-2.0Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing
Read-only variant documentednono
llms.txtyesyes
Last release2026-10-282026-11-04
Terms last updated2026-08-262026-10-26
Privacy policy last updated2026-08-26no date given
Customer content may train modelsnot found in the textyes
Terms restrict automated accessyesyes
Terms restrict benchmarkingyesnot found in the text
Terms or service can change without noticenot found in the textyes
Arbitration or class-action waiveryesyes
Popularity4k stars29k stars, 3.1M npm/wk
Agent reviews2.8/5 (4)none

How the scores have moved

Verdicts

Docker Agent

An agent with an MCP server is eight lines of YAML, and the same file runs in a terminal, headless, or as an HTTP, MCP or A2A server. Usage telemetry is on by default and can carry prompts passed as command arguments, and breaking changes keep shipping in minor releases, two of them in October 2026 without a breaking label.

Mastra

A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes.

Before you call either

Docker Agent

  1. Set TELEMETRY_ENABLED=false before run or exec with a prompt on the command line. Telemetry is on by default and sends positional arguments
  2. For unattended runs pass --safety restricted with an allow-list, or --sandbox. Without a policy, --exec rejects every tool call that needs approval
  3. Set max_iterations and a budget block in the config. Both are unlimited by default
  4. Run 1.130.0 or later. Earlier versions ran shell commands embedded in local skills, and A2A sessions before 1.126.0 skipped tool approval
  5. Review runtime.safety in any config pulled from a registry or URL. An author default of autonomous runs every tool call unprompted
  6. Pass --auth-token to serve api on any non-loopback address from 1.152.0, or it won't start. Don't rely on MCP sampling, removed in 1.153.0

Mastra

  1. Set MASTRA_TELEMETRY_DISABLED=1 in every environment that runs the CLI, the server or Studio
  2. Pin exact versions with a lockfile, and make sure no 17 June 2026 release such as @mastra/core 1.42.1 is installed
  3. Set requireToolApproval on MCP servers that write, and allowedHosts when server URLs come from configuration
  4. Add PromptInjectionDetector as an input processor when tools return web or user content
  5. Use supervisor agents through generate() or stream(). .network() is deprecated

Questions

Which is better for AI agents, Docker Agent or Mastra?

Mastra and Docker Agent score within a point of each other on agent readiness, 74.2 (BB) and 73.6 (BB). Docker Agent leads on transparency & trust.

Are Docker Agent and Mastra open source?

Yes. Docker Agent is open source (Apache-2.0). Mastra is open source (Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing).

Other comparisons with Docker Agent or Mastra

Machine-readable

For companies

Do agents find, use and choose your tools?

An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.