{ "data": { "a": { "slug": "google-adk", "name": "Agent Development Kit (ADK)", "vendor": "Google", "vendorUrl": "https://adk.dev", "kind": "framework", "category": "frameworks", "summary": "Google's code-first toolkit to build, evaluate and deploy agents in Python, TypeScript, Go, Java and Kotlin.", "url": "https://www.anchorterminal.com/tools/google-adk", "markdownUrl": "https://www.anchorterminal.com/tools/google-adk.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/google-adk.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/google-adk.json", "dns": "google-adk.grade.anchorterminal.com", "repo": "https://github.com/google/adk-python", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "pypi", "name": "google-adk" }, { "registry": "npm", "name": "@google/adk" } ], "auth": "none", "authNotes": "A library. Credentials are for the models and tools you use.", "pricing": "free", "pricingNotes": "Free and open source. You pay for the model calls it makes. Google's managed Agent Runtime costs $0.085 a vCPU-hour after 50 free vCPU-hours a month.", "priceSummary": "Free · OSS", "where": "library", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 21649, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-09-26" }, "docsUrl": "https://adk.dev", "llmsTxt": "https://adk.dev/llms.txt", "capabilities": [ "agent.framework", "agent.multi-agent", "agent.durable", "agent.mcp-client" ], "tags": [ "official", "framework", "python", "typescript", "go", "java", "open-source" ], "lastRelease": "2026-10-23", "graded": true, "anchor": { "graded": true, "score": 68.7, "grade": "B", "agentReady": false, "rank": 273, "ranked": true, "rankOf": 1510, "categoryRank": 13, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 80, "maintenance": 90, "payments": 60, "reliability": 80, "schema": 87, "security": 92, "transparency": 69 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -12, "negativeNotes": [ "2026-04-13. CVE-2026-4810 (CVSS 4.0 9.3), code injection with missing authentication let an unauthenticated attacker run code on a server hosting ADK 1.7.0 to 1.28.0 or 2.0.0a1, including local ADK Web. Fixed in 1.28.1 and 2.0.0a2 and published by Google as CNA, so it decays to 2 points. https://nvd.nist.gov/vuln/detail/CVE-2026-4810", "2026-07-29. CVE-2026-18236 (CVSS 4.0 9.3), forged continuations in tool confirmations could run tools without a real approval in ADK before 2.5.0. Fixed and published by Google as CNA, 2 points. https://nvd.nist.gov/vuln/detail/CVE-2026-18236", "2026-09-09. CVE-2026-79696 (CVSS 4.0 10.0), code injection in adk web let an unauthenticated attacker run code through a crafted test session replay on ADK 2.0.0 to 2.6.0 where pytest is installed. Fixed in 2.7.0 (13 August) and published by Google as CNA, so it decays to 2 points, as the two earlier criticals do. https://nvd.nist.gov/vuln/detail/CVE-2026-79696", "2026-09-04. CVE-2026-79707 (CVSS 4.0 8.7), path traversal in the builder endpoint let an unauthenticated attacker read arbitrary files on ADK 1.9.0 to 1.21.0. Fixed in 1.22.0 on 8 January 2026 and published by Google as CNA, 1 point. https://nvd.nist.gov/vuln/detail/CVE-2026-79707", "2026-10-23. CVE-2026-107858 (CVSS 4.0 7.2, high), ADK for Java's development web server accepted cross-origin requests and WebSocket connections from any origin, so a web page a developer visited could drive a locally running agent, trigger its tools and read or delete its sessions and artifacts, in google-adk-dev and the Maven plugin from 0.1.0 before 1.13.0. Fixed in 1.13.0 (21 October) and published by Google as CNA two days later, under two months old, so 2 points, as pydantic-ai's local web UI advisory of 12 August took. https://nvd.nist.gov/vuln/detail/CVE-2026-107858", "2026-10-22. -3, breaking changes in minor releases of a 2.x package without advance notice. google-adk 2.13.0 switches the default telemetry to the OpenTelemetry GenAI v2 schema and stops emitting the `call_llm` span, marked breaking only in the release's own changelog, with an environment variable to keep v1 until at least 31 March 2027. 2.10.0 (24 September) had changed instruction templating and BigQuery protected write mode in the same way, listed as behaviour changes on release day. One term at the floor, as temporal's SDK releases took. https://github.com/google/adk-python/blob/main/CHANGELOG.md" ], "verdict": "Python, TypeScript, Go, Java and Kotlin, with tool confirmation and context compaction built in. Google has published six CVEs against ADK in 2026, three of them critical, one in tool confirmation itself, and minor 2.x releases keep carrying breaking changes.", "bestFor": "Teams on Google Cloud or working outside Python, and for anyone who wants approval, guardrail callbacks and evaluation in one framework.", "strengths": [ "Python, TypeScript, Go, Java and Kotlin, with Python 2.13.0 on 23 October and Java 1.13.0 on 21 October 2026", "Tool confirmation, before-tool callbacks, plugins and a Model Armor plugin", "Token-based and sliding-window context compaction, documented for every language", "Message content in traces is opt-in, with OpenTelemetry and about 20 tracing integrations", "llms.txt of 247 entries with a Markdown version of every page" ], "weaknesses": [ "Six CVEs in 2026, three of them critical, one in tool confirmation itself", "Breaking changes in minor releases (2.6.0, 2.7.0, 2.10.0 and 2.13.0), and 2.12.0 dropped Python 3.10 without a changelog line", "300 open issues and 261 open pull requests as of 1 October", "No exception reference, and no error handling on the MCP page", "Agent Runtime needs a Google Cloud billing account" ], "agentNotes": [ "Run Python 2.7.0 or later and Java 1.13.0 or later, which fix the adk web code-injection CVE, the tool-confirmation forgery and the Java dev server's cross-origin flaw", "Always pass tool_filter to McpToolset", "Pin a 2.x minor and read the changelog before each bump. 2.12.0 needs Python 3.11 or later, which its changelog doesn't say", "Set EventsCompactionConfig on the App for long sessions so context doesn't grow without limit", "Keep ADK Web off public interfaces", "Set `ADK_TELEMETRY_SCHEMA_VERSION_OPT_IN=otel_semconv_1_36` on 2.13.0 or later if dashboards or alerts read the `call_llm` span" ], "metrics": { "kind": "library", "measured": false }, "reviewCount": 8, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68.7 } ], "editorialScores": { "ergonomics": 80, "maintenance": 90, "payments": 60, "reliability": 80, "schema": 87, "security": 92, "transparency": 67 }, "provenanceScore": 70, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install google-adk # or: npm i @google/adk" }, "letme": { "capability": "https://letme.dev/agent.framework", "tool": "https://letme.dev/google-adk" }, "sameCompany": [ "gemini-api", "vertex-ai", "gemini-embedding", "vertex-ai-tuning", "cloud-run-gpus", "google-model-armor", "google-imagen", "google-veo", "google-lyria", "google-speech-to-text", "google-cloud-tts", "gemini-live", "google-memory-bank", "google-secret-manager", "google-cloud-document-ai", "google-weather-api", "chrome-devtools-mcp", "google-maps-platform", "google-cloud-translation", "google-calendar-api", "firebase-cloud-messaging", "google-cloud-storage", "google-drive-api", "gemini-enterprise", "gemini-cli", "google-search-console", "google-ads-api", "google-forms", "google-sheets-api", "gmail-api", "google-people-api" ], "area": "frameworks", "unitPrices": [ { "item": "Agent Runtime", "unit": "vcpu-hour", "usd": 0.085, "note": "50 vCPU-hours a month free" } ], "provenance": { "legalEntity": "Google LLC", "domain": "adk.dev", "domainRegistered": "2019-02-28", "domainNote": "adk.dev was registered in 2019, before ADK existed. It's Google's docs domain for the project now.", "endpointOnVendorDomain": null, "terms": "", "privacy": "https://policies.google.com/privacy", "statusPage": "", "changelog": "https://github.com/google/adk-python/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-09-26", "score": 70 }, "requirements": { "setupChecked": true, "complianceChecked": true, "card": "unknown", "freeTier": true, "minutes": 3, "credential": "api-key", "hosting": [ "self-hosted" ], "euResidency": "unknown", "trainsOnData": "no", "zeroRetention": "unknown", "selfHost": "yes" }, "pageJsonUrl": "https://www.anchorterminal.com/tools/google-adk.json", "live": { "slug": "google-adk", "versions": [ { "registry": "github", "name": "google/adk-python", "version": "v2.13.0", "released": "2026-10-23", "seenAt": "2026-11-06T23:28:55.222598494Z" }, { "registry": "npm", "name": "@google/adk", "version": "2.4.0", "seenAt": "2026-11-06T23:28:55.002701153Z" }, { "registry": "pypi", "name": "google-adk", "version": "2.13.0", "released": "2026-10-23", "seenAt": "2026-11-06T23:28:54.815546694Z" } ], "githubStars": 22126, "npmWeekly": 324165, "pypiWeekly": 2532189, "securityTxt": { "url": "https://adk.dev/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:48.394885079Z" }, "llmsTxt": { "url": "https://adk.dev/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:37.318647019Z" }, "domain": { "domain": "adk.dev", "registered": "2019-02-28", "source": "https://pubapi.registry.google/rdap/domain/adk.dev", "checkedAt": "2026-11-01T14:09:45.874929794Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/google/adk-python/main/CHANGELOG.md", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:21:12.002076689Z", "changedAt": "2026-11-07T14:21:12.002076689Z", "fingerprint": "dec9e098fc26" } ], "github": { "repo": "google/adk-python", "checkedAt": "2026-11-02T08:51:58.470038349Z", "stars": 22081, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T08:37:05Z", "openIssues": 202, "openPRs": 239, "issuesOpened90d": 471, "issuesClosed90d": 606, "prsMerged90d": 58, "ci": { "branch": "main", "runs": 50, "success": 26, "failure": 24, "other": 0, "latest": "success", "latestAt": "2026-11-02T08:37:16Z" }, "replies": { "sampled": 13, "unanswered": 9, "medianDays": 0.4 } }, "updatedAt": "2026-11-07T16:00:48.394885079Z" } }, "answer": "Mastra scores 74.2 (BB) on agent readiness against Agent Development Kit (ADK)'s 68.7 (B), and leads in 5 of 7 scored categories. Agent Development Kit (ADK) leads on security \u0026 auth.", "b": { "slug": "mastra", "name": "Mastra", "vendor": "Kepler Software, Inc.", "vendorUrl": "https://mastra.ai", "kind": "framework", "category": "frameworks", "summary": "Open-source TypeScript framework from Mastra for building agents and workflows, with memory, RAG, evals, tracing, an MCP client and server, and a local Studio. An optional hosted platform runs deployments and observability.", "url": "https://www.anchorterminal.com/tools/mastra", "markdownUrl": "https://www.anchorterminal.com/tools/mastra.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/mastra.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/mastra.json", "dns": "mastra.grade.anchorterminal.com", "repo": "https://github.com/mastra-ai/mastra", "license": "Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing", "transports": [], "packages": [ { "registry": "npm", "name": "@mastra/core" }, { "registry": "npm", "name": "@mastra/mcp" }, { "registry": "npm", "name": "mastra" } ], "auth": "api-key", "authNotes": "The framework has no account of its own. The model router takes `provider/model` strings and each provider's own key. The hosted Mastra platform needs an account.", "pricing": "free", "pricingNotes": "Free and open source. You pay for model calls. The hosted platform has a $0 Starter plan with 100K observability events and 24 CPU hours, then $10 per 100K events and $0.35 a CPU hour, and Teams at $250 a month (https://mastra.ai/pricing, checked 2026-11-06).", "priceSummary": "Free · OSS", "where": "library", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Mastra docs, the repository or the pricing page (checked 2026-10-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 29383, "npmWeekly": 3116983, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://mastra.ai/docs", "llmsTxt": "https://mastra.ai/llms.txt", "capabilities": [ "agent.framework", "agent.durable", "agent.mcp-client", "agent.multi-agent" ], "tags": [ "framework", "typescript", "open-source", "llms-txt", "mcp", "telemetry-default-on" ], "lastRelease": "2026-11-04", "graded": true, "anchor": { "graded": true, "score": 74.2, "grade": "BB", "agentReady": true, "rank": 91, "ranked": true, "rankOf": 1510, "categoryRank": 7, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 92, "maintenance": 96, "payments": 60, "reliability": 87, "schema": 98, "security": 67, "transparency": 72 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": -8, "negativeNotes": [ "2026-06-17. Malicious versions of Mastra's npm packages were published, among them @mastra/core 1.42.1 at 01:15 UTC, and GitHub malware advisories that day (GHSA-pp62-grrw-hvfp and others) say any machine that installed one should be treated as fully compromised. All 21 Mastra packages we checked on OSV carry one. Mastra published clean versions the same day and the changelogs name an \"easy-day-js\" supply-chain incident, but we found no advisory or post-mortem from Mastra. Fixed and under four months old, so 8 points. https://osv.dev/vulnerability/MAL-2026-6011" ], "verdict": "A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes.", "bestFor": "TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.", "strengths": [ "MCP client with requireToolApproval per server or per tool, allowedHosts and a curated environment for stdio servers", "Guardrail processors for prompt injection, PII, moderation and cost limits, run on input and output", "Workflows with snapshots, suspend and resume, and durable agents on Inngest or an evented engine", "Apache 2.0 core, 1.0 since 20 January 2026, with 27 releases of @mastra/core in 90 days to 6 November", "llms.txt with a when-to-use section and condensed instructions for coding agents" ], "weaknesses": [ "Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026", "CLI, server and Studio send usage analytics by default, including token counts every 15 minutes, off with MASTRA_TELEMETRY_DISABLED=1", "No SECURITY.md, no security.txt and no bug bounty found", "Code under ee/ is source-available under the Mastra Enterprise License, not Apache 2.0", "TypeScript only, Node 22.13 or newer" ], "agentNotes": [ "Set MASTRA_TELEMETRY_DISABLED=1 in every environment that runs the CLI, the server or Studio", "Pin exact versions with a lockfile, and make sure no 17 June 2026 release such as @mastra/core 1.42.1 is installed", "Set requireToolApproval on MCP servers that write, and allowedHosts when server URLs come from configuration", "Add PromptInjectionDetector as an input processor when tools return web or user content", "Use supervisor agents through generate() or stream(). `.network()` is deprecated" ], "metrics": { "kind": "library", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 74.2 } ], "editorialScores": { "ergonomics": 92, "maintenance": 96, "payments": 60, "reliability": 87, "schema": 98, "security": 67, "transparency": 72 }, "provenanceScore": 71, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm create mastra@latest # or: npm i @mastra/core @mastra/mcp" }, "letme": { "capability": "https://letme.dev/agent.framework", "tool": "https://letme.dev/mastra" }, "area": "frameworks", "provenance": { "legalEntity": "Kepler Software, Inc.", "domain": "mastra.ai", "domainRegistered": "2024-10-01", "endpointOnVendorDomain": null, "terms": "https://mastra.ai/terms-of-service", "privacy": "https://mastra.ai/privacy-policy", "statusPage": "https://statuspage.incident.io/mastra-platform", "changelog": "https://github.com/mastra-ai/mastra/blob/main/packages/core/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The privacy policy names Kepler Software Inc as operator of mastra.ai and shows a last-published date of 25 April 2025.", "The licence file is copyright Kepler Software, Inc.", "mastra.ai/.well-known/security.txt returns 404 (rechecked 6 November 2026), and the repository has no SECURITY.md.", "RDAP gives mastra.ai a registration date of 2024-10-01.", "The status page covers the hosted platform, not the framework." ], "score": 71 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/mastra.json", "live": { "slug": "mastra", "vendorStatus": { "page": "https://statuspage.incident.io/mastra-platform", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T19:22:27.41396844Z" }, "versions": [ { "registry": "github", "name": "mastra-ai/mastra", "version": "@mastra/core@1.82.0", "released": "2026-11-04", "seenAt": "2026-11-06T23:43:05.299046627Z" }, { "registry": "npm", "name": "@mastra/core", "version": "1.82.0", "seenAt": "2026-11-06T23:43:01.102546802Z" }, { "registry": "npm", "name": "@mastra/mcp", "version": "2.8.0", "seenAt": "2026-11-06T23:43:01.962943277Z" }, { "registry": "npm", "name": "mastra", "version": "1.38.0", "seenAt": "2026-11-06T23:43:03.330470883Z" } ], "githubStars": 29384, "npmWeekly": 3116983, "securityTxt": { "url": "https://mastra.ai/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:45.130857018Z" }, "llmsTxt": { "url": "https://mastra.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:57.501317652Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/mastra-ai/mastra/main/packages/core/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:21:37.959722321Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "0bdb3498f7aa" }, { "url": "https://mastra.ai/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:13:54.312763229Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "0204673a21a8" }, { "url": "https://mastra.ai/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:13:56.829832485Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1621ce3063d8" }, { "url": "https://mastra.ai/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:13:58.580048861Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "edbcf520f26c" } ], "updatedAt": "2026-11-07T19:22:27.41396844Z" } }, "edges": [ { "by": 25, "category": "security", "leads": "google-adk", "name": "Security \u0026 auth", "reasons": { "a": "We found no usage telemetry in the docs or the Python source, and capturing message content in traces is opt-in (30). Tool confirmation for human approval, extended to workflow tool nodes in 2.11.0 and to any workflow node through `require_confirmation` in 2.12.0, the docs say to always pass tool_filter to McpToolset, 2.12.0 limits the mutating /dev and agent builder endpoints of adk web to local clients by default, and sandboxed code execution is recommended for model-written code (20). Before-tool callbacks, an after_tool_callback that screens tool output since 2.12.0, plugins, a Model Armor plugin, an optional ToolCallIntegrityPlugin since 2.11.0, and a safety page that covers indirect prompt injection through tool results (15). OpenTelemetry traces with Cloud Trace and about 20 third-party integrations (15). SECURITY.md routes reports to Google's g.co/vulnz with a one-day triage target, per the 1 October check, not re-read on 1 November (the repository still has no SECURITY.md file and GitHub's security page answered 403). Google as CNA has published six 2026 CVEs with fixed versions, the newest on 23 and 28 October, but there are no repository advisories and no bounty is mentioned in the policy (12). Framework reading, so SOC 2 isn't scored.", "b": "The CLI sends PostHog analytics, server startup sends token counts per model and a count of registered agents, tools and MCP servers, and Studio sends browser analytics, all on by default and documented, with one opt-out, MASTRA_TELEMETRY_DISABLED=1. Since #26986 (16 October 2026) each server process also reports token use per provider and model every 15 minutes, and the telemetry reference read on 6 November says server events carry a project identifier that is a raw Platform UUID or a hash of the Git origin remote, so they \"aren't anonymous\" (12). requireToolApproval on agents and MCP servers, allowedHosts for MCP HTTP, a curated environment for stdio servers, and sandboxed workspaces (20). PromptInjectionDetector, PII and moderation processors, and docs that call tool results untrusted model input (15). Built-in tracing with OpenTelemetry and other exporters (15). No SECURITY.md, no security.txt and no bug bounty found. A blog post says Mastra is SOC 2 Type II audited, which isn't scored for a framework, and we found no public advisory from Mastra about the June incident (5). Framework reading. 15+20+15+15+5 = 70 on 6 October, 12+20+15+15+5 = 67 on 6 November." }, "scores": { "a": 92, "b": 67 } }, { "by": 12, "category": "ergonomics", "leads": "mastra", "name": "Agent ergonomics", "reasons": { "a": "An agent with one MCP server is about 15 lines with the built-in McpToolset, and tool_filter limits which tools load, with no dynamic filtering or deferred loading that we saw (20). RunConfig caps model calls per run, and the context compression page documents token-based and sliding-window compaction through EventsCompactionConfig, plus context caching (20). No exception reference or MCP error handling documented (5). Invocations are resumable, model calls take retry options, and 2.11.0 adds an abort_signal for graceful cancellation (20). An agent needs a name, a model and an instruction, in Python, TypeScript, Go, Java or Kotlin (15).", "b": "An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10)." }, "scores": { "a": 80, "b": 92 } }, { "by": 11, "category": "schema", "leads": "mastra", "name": "Schema \u0026 documentation", "reasons": { "a": "An API reference on adk.dev (25). llms.txt with about 250 entries and Markdown versions of each page (10). The docs explain the agent types and when to use workflow agents, but say little about when not to use ADK (15). Tools are typed functions, and McpToolset keeps the server's schemas (12). Examples throughout, but the MCP page has no error handling section and we found no exception reference (10). Dated changelog and release notes (15).", "b": "Typed TypeScript API with a reference section (25). llms.txt with a when-to-use list and condensed instructions for coding agents (10). The docs say when to use durable agents, and point multi-agent users from `.network()` to supervisor agents (20). Tools take Zod schemas (15). Examples on every page, and MastraError with ids and categories documented, though errors are spread across pages (13). Per-package changelogs and migration guides (15)." }, "scores": { "a": 87, "b": 98 } }, { "by": 7, "category": "reliability", "leads": "mastra", "name": "Reliability", "reasons": { "a": "Official packages on PyPI (Requires-Python \u003e=3.11 since 2.12.0, constraint files for 3.11 to 3.15) and npm (20). The continuous-integration workflow passes on main, per the 1 October check, not re-read on 1 November (25). 300 open issues and 261 open pull requests, per the 1 October check, not re-read on 1 November (12). The changelog calls out breaking changes, but they keep shipping in minor releases of a post-1.0 package (2.6.0 on 2026-07-29 and 2.7.0 on 2026-08-13), 2.12.0 on 2026-10-13 dropped Python 3.10 with no line in its changelog, and 2.8.0 reverted an A2A guard that had broken every tool confirmation. On 8 October the changelog relabelled the 2.11.0 dev UI config change a bug fix and the 2.9.0 resumption changes behaviour changes. 2.13.0 (22 October) marks one more breaking change, the telemetry schema default, in a minor release (8). 2.12.0, past 1.0 (15).", "b": "Official npm packages, Node 22.13 or newer (20). Public CI workflows for unit, store, workspace and e2e tests; on 6 November the newest runs on main (Version Packages, Trigger Cloud Integration Tests) succeeded, while the test workflows themselves run on pull requests (22). 436 open issues and 795 open issues and pull requests on 6 November from GitHub's API, with 2,077 issues opened in the 90 days to 3 November; all 50 newest had a comment and 24 were closed, with issue-triage automation (18). A changesets CHANGELOG per package, a CI gate that needs approval for any major bump and migration guides, but no written versioning policy found, and `.network()` is deprecated without a removal date (12). 1.82.0 (15). 20+22+18+12+15 = 87, up from 74 on 6 October, when GitHub couldn't be read." }, "scores": { "a": 80, "b": 87 } }, { "by": 6, "category": "maintenance", "leads": "mastra", "name": "Maintenance \u0026 community", "reasons": { "a": "2.13.0 on 2026-10-23 (30). 15 Python releases in the 90 days from 3 August across the 1.x and 2.x lines, from 2.6.2 to 2.13.0, the newest 1.x being 1.39.1 on 2026-08-27 (20). 300 open issues and 261 open pull requests per the 1 October check, and we couldn't see reply times (15). Python is current, @google/adk is at 2.4.0 on npm, the Go module at v1.9.0 (tagged 15 October) and the Java artefact at 1.13.0 (21 October) (15). CI passes per the 1 October check, and 2.7.0 fixed zizmor findings in the workflows (10).", "b": "@mastra/core 1.82.0 on 2026-11-04 (30). 27 stable releases in the 90 days to 6 November, 8 of them since 6 October (20). 436 open issues on 6 November, all 50 newest issues commented and 24 of them closed (22). Client, MCP and store packages are current, and @mastra/mcp 1.x stays supported beside 2.x (15). Renovate and CI configured, with the newest runs on main passing (9). 30+20+22+15+9 = 96." }, "scores": { "a": 90, "b": 96 } } ], "facts": [ { "a": "Agent framework", "b": "Agent framework", "name": "Kind" }, { "a": "Google", "b": "Kepler Software, Inc.", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "", "name": "Transports" }, { "a": "None", "b": "API key", "name": "Auth" }, { "a": "Free", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Apache-2.0", "b": "Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-23", "b": "2026-11-04", "name": "Last release" }, { "a": "no document linked", "b": "2026-10-26", "name": "Terms last updated" }, { "a": "2026-10-01", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "yes", "b": "yes", "name": "Customer content may train models" }, { "a": "not read yet", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "22k stars", "b": "29k stars, 3.1M npm/wk", "name": "Popularity" }, { "a": "3/5 (8)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "Mastra scores 74.2 (BB) on agent readiness against Agent Development Kit (ADK)'s 68.7 (B), and leads in 5 of 7 scored categories. Agent Development Kit (ADK) leads on security \u0026 auth.", "question": "Which is better for AI agents, Agent Development Kit (ADK) or Mastra?" }, { "answer": "Yes. Agent Development Kit (ADK) is open source (Apache-2.0). Mastra is open source (Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing).", "question": "Are Agent Development Kit (ADK) and Mastra open source?" } ], "goodFor": [ { "aheadOn": [ "Security \u0026 auth, 92 against 67" ], "also": [ "No key needed to call it" ], "goodFor": "Teams on Google Cloud or working outside Python, and for anyone who wants approval, guardrail callbacks and evaluation in one framework.", "slug": "google-adk", "watchFor": "Six CVEs in 2026, three of them critical, one in tool confirmation itself" }, { "aheadOn": [ "Reliability, 87 against 80", "Schema \u0026 documentation, 98 against 87", "Agent ergonomics, 92 against 80", "Maintenance \u0026 community, 96 against 90" ], "also": [ "Agent-ready, a grade of BB or better" ], "goodFor": "TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.", "slug": "mastra", "watchFor": "Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026" } ], "history": { "google-adk": [ { "causes": [ "event" ], "date": "2026-11-01", "delta": -5, "from": 73.7, "fromGrade": "BB", "to": 68.7, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 73.6, "fromGrade": "BB", "to": 73.7, "toGrade": "BB" }, { "causes": [ "evidence", "event" ], "date": "2026-10-17", "delta": -1.1, "from": 74.7, "fromGrade": "BB", "to": 73.6, "toGrade": "BB" } ], "mastra": null }, "job": { "capability": "agent.framework", "name": "Agent frameworks" }, "others": [ { "json": "https://www.anchorterminal.com/compare/agentos-vs-google-adk.json", "title": "AgentOS vs Agent Development Kit (ADK)", "url": "https://www.anchorterminal.com/compare/agentos-vs-google-adk" }, { "json": "https://www.anchorterminal.com/compare/agentos-vs-mastra.json", "title": "AgentOS vs Mastra", "url": "https://www.anchorterminal.com/compare/agentos-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/agno-vs-google-adk.json", "title": "Agno vs Agent Development Kit (ADK)", "url": "https://www.anchorterminal.com/compare/agno-vs-google-adk" }, { "json": "https://www.anchorterminal.com/compare/agno-vs-mastra.json", "title": "Agno vs Mastra", "url": "https://www.anchorterminal.com/compare/agno-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-google-adk.json", "title": "BoxLang AI vs Agent Development Kit (ADK)", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-google-adk" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra.json", "title": "BoxLang AI vs Mastra", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-google-adk.json", "title": "Claude Agent SDK vs Agent Development Kit (ADK)", "url": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-google-adk" }, { "json": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-mastra.json", "title": "Claude Agent SDK vs Mastra", "url": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/crewai-vs-google-adk.json", "title": "CrewAI vs Agent Development Kit (ADK)", "url": "https://www.anchorterminal.com/compare/crewai-vs-google-adk" }, { "json": "https://www.anchorterminal.com/compare/crewai-vs-mastra.json", "title": "CrewAI vs Mastra", "url": "https://www.anchorterminal.com/compare/crewai-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-google-adk.json", "title": "Cursor Agent SDK vs Agent Development Kit (ADK)", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-google-adk" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra.json", "title": "Cursor Agent SDK vs Mastra", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/docker-agent-vs-google-adk.json", "title": "Docker Agent vs Agent Development Kit (ADK)", "url": "https://www.anchorterminal.com/compare/docker-agent-vs-google-adk" }, { "json": "https://www.anchorterminal.com/compare/docker-agent-vs-mastra.json", "title": "Docker Agent vs Mastra", "url": "https://www.anchorterminal.com/compare/docker-agent-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/google-adk-vs-guilds-run.json", "title": "Agent Development Kit (ADK) vs guilds.run", "url": "https://www.anchorterminal.com/compare/google-adk-vs-guilds-run" }, { "json": "https://www.anchorterminal.com/compare/google-adk-vs-langgraph.json", "title": "Agent Development Kit (ADK) vs LangGraph", "url": "https://www.anchorterminal.com/compare/google-adk-vs-langgraph" }, { "json": "https://www.anchorterminal.com/compare/google-adk-vs-llamaindex.json", "title": "Agent Development Kit (ADK) vs LlamaIndex Framework", "url": "https://www.anchorterminal.com/compare/google-adk-vs-llamaindex" }, { "json": "https://www.anchorterminal.com/compare/google-adk-vs-microsoft-agent-framework.json", "title": "Agent Development Kit (ADK) vs Microsoft Agent Framework", "url": "https://www.anchorterminal.com/compare/google-adk-vs-microsoft-agent-framework" }, { "json": "https://www.anchorterminal.com/compare/google-adk-vs-openai-agents-sdk.json", "title": "Agent Development Kit (ADK) vs OpenAI Agents SDK", "url": "https://www.anchorterminal.com/compare/google-adk-vs-openai-agents-sdk" }, { "json": "https://www.anchorterminal.com/compare/google-adk-vs-pydantic-ai.json", "title": "Agent Development Kit (ADK) vs Pydantic AI", "url": "https://www.anchorterminal.com/compare/google-adk-vs-pydantic-ai" }, { "json": "https://www.anchorterminal.com/compare/google-adk-vs-smolagents.json", "title": "Agent Development Kit (ADK) vs smolagents", "url": "https://www.anchorterminal.com/compare/google-adk-vs-smolagents" }, { "json": "https://www.anchorterminal.com/compare/google-adk-vs-strands-agents.json", "title": "Agent Development Kit (ADK) vs Strands Agents", "url": "https://www.anchorterminal.com/compare/google-adk-vs-strands-agents" }, { "json": "https://www.anchorterminal.com/compare/google-adk-vs-tradingagents.json", "title": "Agent Development Kit (ADK) vs TradingAgents", "url": "https://www.anchorterminal.com/compare/google-adk-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/google-adk-vs-vercel-ai-sdk.json", "title": "Agent Development Kit (ADK) vs AI SDK", "url": "https://www.anchorterminal.com/compare/google-adk-vs-vercel-ai-sdk" }, { "json": "https://www.anchorterminal.com/compare/guilds-run-vs-mastra.json", "title": "guilds.run vs Mastra", "url": "https://www.anchorterminal.com/compare/guilds-run-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/langgraph-vs-mastra.json", "title": "LangGraph vs Mastra", "url": "https://www.anchorterminal.com/compare/langgraph-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/llamaindex-vs-mastra.json", "title": "LlamaIndex Framework vs Mastra", "url": "https://www.anchorterminal.com/compare/llamaindex-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-microsoft-agent-framework.json", "title": "Mastra vs Microsoft Agent Framework", "url": "https://www.anchorterminal.com/compare/mastra-vs-microsoft-agent-framework" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk.json", "title": "Mastra vs OpenAI Agents SDK", "url": "https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai.json", "title": "Mastra vs Pydantic AI", "url": "https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-smolagents.json", "title": "Mastra vs smolagents", "url": "https://www.anchorterminal.com/compare/mastra-vs-smolagents" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-strands-agents.json", "title": "Mastra vs Strands Agents", "url": "https://www.anchorterminal.com/compare/mastra-vs-strands-agents" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-tradingagents.json", "title": "Mastra vs TradingAgents", "url": "https://www.anchorterminal.com/compare/mastra-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk.json", "title": "Mastra vs AI SDK", "url": "https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk" } ], "panel": null, "scores": [ { "by": 7, "edge": "mastra", "google-adk": 80, "key": "reliability", "mastra": 87, "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 11, "edge": "mastra", "google-adk": 87, "key": "schema", "mastra": 98, "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 12, "edge": "mastra", "google-adk": 80, "key": "ergonomics", "mastra": 92, "name": "Agent ergonomics", "weight": 13 }, { "by": 25, "edge": "google-adk", "google-adk": 92, "key": "security", "mastra": 67, "name": "Security \u0026 auth", "weight": 14 }, { "by": 0, "edge": "", "google-adk": 60, "key": "payments", "mastra": 60, "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 6, "edge": "mastra", "google-adk": 90, "key": "maintenance", "mastra": 96, "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 3, "edge": "mastra", "google-adk": 69, "key": "transparency", "mastra": 72, "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Mastra scores 74.2 (BB) on agent readiness against Agent Development Kit (ADK)'s 68.7 (B), and leads in 5 of 7 scored categories. Agent Development Kit (ADK) leads on security \u0026 auth. Both do agent frameworks.", "tasks": null, "tutorials": [], "verdicts": { "google-adk": "Python, TypeScript, Go, Java and Kotlin, with tool confirmation and context compaction built in. Google has published six CVEs against ADK in 2026, three of them critical, one in tool confirmation itself, and minor 2.x releases keep carrying breaking changes.", "mastra": "A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/google-adk-vs-mastra", "json": "https://www.anchorterminal.com/compare/google-adk-vs-mastra.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/google-adk-vs-mastra.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/google-adk-vs-mastra.min.md" }, "markdown": "Mastra scores 74.2 (BB) on agent readiness against Agent Development Kit (ADK)'s 68.7 (B), and leads in 5 of 7 scored categories. Agent Development Kit (ADK) leads on security \u0026 auth. Both do agent frameworks.\n\n- Agent Development Kit (ADK): grade B, 68.7/100, rank #273 of 1510. Markdown https://www.anchorterminal.com/tools/google-adk.md · JSON https://www.anchorterminal.com/api/v1/tools/google-adk.json\n- Mastra: grade BB, 74.2/100, rank #91 of 1510. Markdown https://www.anchorterminal.com/tools/mastra.md · JSON https://www.anchorterminal.com/api/v1/tools/mastra.json\n- Best agent frameworks and SDKs: https://www.anchorterminal.com/best/frameworks/index.md\n- All 171 frameworks comparisons: https://www.anchorterminal.com/compare/frameworks/index.md\n\n## Which one, for what\n\n### Agent Development Kit (ADK) (B)\n\nGood for: Teams on Google Cloud or working outside Python, and for anyone who wants approval, guardrail callbacks and evaluation in one framework.\n\nAhead on:\n- Security \u0026 auth, 92 against 67\n\nAlso in its favour:\n- No key needed to call it\n\nWatch for: Six CVEs in 2026, three of them critical, one in tool confirmation itself\n\n### Mastra (BB)\n\nGood for: TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.\n\nAhead on:\n- Reliability, 87 against 80\n- Schema \u0026 documentation, 98 against 87\n- Agent ergonomics, 92 against 80\n- Maintenance \u0026 community, 96 against 90\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n\nWatch for: Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026\n\n\n## Why the edge\n\n### Security \u0026 auth: Agent Development Kit (ADK) +25\n\n- Agent Development Kit (ADK) (92): We found no usage telemetry in the docs or the Python source, and capturing message content in traces is opt-in (30). Tool confirmation for human approval, extended to workflow tool nodes in 2.11.0 and to any workflow node through `require_confirmation` in 2.12.0, the docs say to always pass tool_filter to McpToolset, 2.12.0 limits the mutating /dev and agent builder endpoints of adk web to local clients by default, and sandboxed code execution is recommended for model-written code (20). Before-tool callbacks, an after_tool_callback that screens tool output since 2.12.0, plugins, a Model Armor plugin, an optional ToolCallIntegrityPlugin since 2.11.0, and a safety page that covers indirect prompt injection through tool results (15). OpenTelemetry traces with Cloud Trace and about 20 third-party integrations (15). SECURITY.md routes reports to Google's g.co/vulnz with a one-day triage target, per the 1 October check, not re-read on 1 November (the repository still has no SECURITY.md file and GitHub's security page answered 403). Google as CNA has published six 2026 CVEs with fixed versions, the newest on 23 and 28 October, but there are no repository advisories and no bounty is mentioned in the policy (12). Framework reading, so SOC 2 isn't scored.\n- Mastra (67): The CLI sends PostHog analytics, server startup sends token counts per model and a count of registered agents, tools and MCP servers, and Studio sends browser analytics, all on by default and documented, with one opt-out, MASTRA_TELEMETRY_DISABLED=1. Since #26986 (16 October 2026) each server process also reports token use per provider and model every 15 minutes, and the telemetry reference read on 6 November says server events carry a project identifier that is a raw Platform UUID or a hash of the Git origin remote, so they \"aren't anonymous\" (12). requireToolApproval on agents and MCP servers, allowedHosts for MCP HTTP, a curated environment for stdio servers, and sandboxed workspaces (20). PromptInjectionDetector, PII and moderation processors, and docs that call tool results untrusted model input (15). Built-in tracing with OpenTelemetry and other exporters (15). No SECURITY.md, no security.txt and no bug bounty found. A blog post says Mastra is SOC 2 Type II audited, which isn't scored for a framework, and we found no public advisory from Mastra about the June incident (5). Framework reading. 15+20+15+15+5 = 70 on 6 October, 12+20+15+15+5 = 67 on 6 November.\n\n### Agent ergonomics: Mastra +12\n\n- Agent Development Kit (ADK) (80): An agent with one MCP server is about 15 lines with the built-in McpToolset, and tool_filter limits which tools load, with no dynamic filtering or deferred loading that we saw (20). RunConfig caps model calls per run, and the context compression page documents token-based and sliding-window compaction through EventsCompactionConfig, plus context caching (20). No exception reference or MCP error handling documented (5). Invocations are resumable, model calls take retry options, and 2.11.0 adds an abort_signal for graceful cancellation (20). An agent needs a name, a model and an instruction, in Python, TypeScript, Go, Java or Kotlin (15).\n- Mastra (92): An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10).\n\n### Schema \u0026 documentation: Mastra +11\n\n- Agent Development Kit (ADK) (87): An API reference on adk.dev (25). llms.txt with about 250 entries and Markdown versions of each page (10). The docs explain the agent types and when to use workflow agents, but say little about when not to use ADK (15). Tools are typed functions, and McpToolset keeps the server's schemas (12). Examples throughout, but the MCP page has no error handling section and we found no exception reference (10). Dated changelog and release notes (15).\n- Mastra (98): Typed TypeScript API with a reference section (25). llms.txt with a when-to-use list and condensed instructions for coding agents (10). The docs say when to use durable agents, and point multi-agent users from `.network()` to supervisor agents (20). Tools take Zod schemas (15). Examples on every page, and MastraError with ids and categories documented, though errors are spread across pages (13). Per-package changelogs and migration guides (15).\n\n### Reliability: Mastra +7\n\n- Agent Development Kit (ADK) (80): Official packages on PyPI (Requires-Python \u003e=3.11 since 2.12.0, constraint files for 3.11 to 3.15) and npm (20). The continuous-integration workflow passes on main, per the 1 October check, not re-read on 1 November (25). 300 open issues and 261 open pull requests, per the 1 October check, not re-read on 1 November (12). The changelog calls out breaking changes, but they keep shipping in minor releases of a post-1.0 package (2.6.0 on 2026-07-29 and 2.7.0 on 2026-08-13), 2.12.0 on 2026-10-13 dropped Python 3.10 with no line in its changelog, and 2.8.0 reverted an A2A guard that had broken every tool confirmation. On 8 October the changelog relabelled the 2.11.0 dev UI config change a bug fix and the 2.9.0 resumption changes behaviour changes. 2.13.0 (22 October) marks one more breaking change, the telemetry schema default, in a minor release (8). 2.12.0, past 1.0 (15).\n- Mastra (87): Official npm packages, Node 22.13 or newer (20). Public CI workflows for unit, store, workspace and e2e tests; on 6 November the newest runs on main (Version Packages, Trigger Cloud Integration Tests) succeeded, while the test workflows themselves run on pull requests (22). 436 open issues and 795 open issues and pull requests on 6 November from GitHub's API, with 2,077 issues opened in the 90 days to 3 November; all 50 newest had a comment and 24 were closed, with issue-triage automation (18). A changesets CHANGELOG per package, a CI gate that needs approval for any major bump and migration guides, but no written versioning policy found, and `.network()` is deprecated without a removal date (12). 1.82.0 (15). 20+22+18+12+15 = 87, up from 74 on 6 October, when GitHub couldn't be read.\n\n### Maintenance \u0026 community: Mastra +6\n\n- Agent Development Kit (ADK) (90): 2.13.0 on 2026-10-23 (30). 15 Python releases in the 90 days from 3 August across the 1.x and 2.x lines, from 2.6.2 to 2.13.0, the newest 1.x being 1.39.1 on 2026-08-27 (20). 300 open issues and 261 open pull requests per the 1 October check, and we couldn't see reply times (15). Python is current, @google/adk is at 2.4.0 on npm, the Go module at v1.9.0 (tagged 15 October) and the Java artefact at 1.13.0 (21 October) (15). CI passes per the 1 October check, and 2.7.0 fixed zizmor findings in the workflows (10).\n- Mastra (96): @mastra/core 1.82.0 on 2026-11-04 (30). 27 stable releases in the 90 days to 6 November, 8 of them since 6 October (20). 436 open issues on 6 November, all 50 newest issues commented and 24 of them closed (22). Client, MCP and store packages are current, and @mastra/mcp 1.x stays supported beside 2.x (15). Renovate and CI configured, with the newest runs on main passing (9). 30+20+22+15+9 = 96.\n\n## Score by category\n\n| Category | Weight | Agent Development Kit (ADK) | Mastra | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 80 | 87 | Mastra +7 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 87 | 98 | Mastra +11 |\n| Agent ergonomics | 13% (16.2 this run) | 80 | 92 | Mastra +12 |\n| Security \u0026 auth | 14% (17.5 this run) | 92 | 67 | Agent Development Kit (ADK) +25 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 60 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 90 | 96 | Mastra +6 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 69 | 72 | Mastra +3 |\n| Negative events | ≤15 | -12 | -8 | |\n| **Total** | | **68.7 · B** | **74.2 · BB** | |\n\n## Facts side by side\n\n| Fact | Agent Development Kit (ADK) | Mastra |\n| --- | --- | --- |\n| Kind | Agent framework | Agent framework |\n| Vendor | Google | Kepler Software, Inc. |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | None | API key |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | Apache-2.0 | Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-10-23 | 2026-11-04 |\n| Terms last updated | no document linked | 2026-10-26 |\n| Privacy policy last updated | 2026-10-01 | no date given |\n| Customer content may train models | yes | yes |\n| Terms restrict automated access | not read yet | yes |\n| Terms restrict benchmarking | not read yet | not found in the text |\n| Terms or service can change without notice | not read yet | yes |\n| Arbitration or class-action waiver | not read yet | yes |\n| Popularity | 22k stars | 29k stars, 3.1M npm/wk |\n| Agent reviews | 3/5 (8) | none |\n\n## How the scores have moved\n\n### Agent Development Kit (ADK)\n\n- -5.0 on 1 November 2026 (BB to B): negative event\n- +0.1 on 27 October 2026: checklist\n- -1.1 on 17 October 2026: new evidence, negative event\n\n### Mastra\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Agent Development Kit (ADK).** Python, TypeScript, Go, Java and Kotlin, with tool confirmation and context compaction built in. Google has published six CVEs against ADK in 2026, three of them critical, one in tool confirmation itself, and minor 2.x releases keep carrying breaking changes.\n\n**Mastra.** A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes.\n\n## Before you call either\n\n### Agent Development Kit (ADK)\n\n1. Run Python 2.7.0 or later and Java 1.13.0 or later, which fix the adk web code-injection CVE, the tool-confirmation forgery and the Java dev server's cross-origin flaw\n2. Always pass tool_filter to McpToolset\n3. Pin a 2.x minor and read the changelog before each bump. 2.12.0 needs Python 3.11 or later, which its changelog doesn't say\n4. Set EventsCompactionConfig on the App for long sessions so context doesn't grow without limit\n5. Keep ADK Web off public interfaces\n6. Set `ADK_TELEMETRY_SCHEMA_VERSION_OPT_IN=otel_semconv_1_36` on 2.13.0 or later if dashboards or alerts read the `call_llm` span\n\n### Mastra\n\n1. Set MASTRA_TELEMETRY_DISABLED=1 in every environment that runs the CLI, the server or Studio\n2. Pin exact versions with a lockfile, and make sure no 17 June 2026 release such as @mastra/core 1.42.1 is installed\n3. Set requireToolApproval on MCP servers that write, and allowedHosts when server URLs come from configuration\n4. Add PromptInjectionDetector as an input processor when tools return web or user content\n5. Use supervisor agents through generate() or stream(). `.network()` is deprecated\n\n## Questions\n\n### Which is better for AI agents, Agent Development Kit (ADK) or Mastra?\n\nMastra scores 74.2 (BB) on agent readiness against Agent Development Kit (ADK)'s 68.7 (B), and leads in 5 of 7 scored categories. Agent Development Kit (ADK) leads on security \u0026 auth.\n\n### Are Agent Development Kit (ADK) and Mastra open source?\n\nYes. Agent Development Kit (ADK) is open source (Apache-2.0). Mastra is open source (Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/google-adk-vs-mastra.json, and with the fewest tokens: https://www.anchorterminal.com/compare/google-adk-vs-mastra.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"google-adk\", \"b\": \"mastra\"}`. From a terminal: `anchor compare google-adk mastra`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/google-adk.json and https://www.anchorterminal.com/api/v1/tools/mastra.json\n\n## Other comparisons with Agent Development Kit (ADK) or Mastra\n\n- [AgentOS vs Agent Development Kit (ADK)](https://www.anchorterminal.com/compare/agentos-vs-google-adk.md)\n- [AgentOS vs Mastra](https://www.anchorterminal.com/compare/agentos-vs-mastra.md)\n- [Agno vs Agent Development Kit (ADK)](https://www.anchorterminal.com/compare/agno-vs-google-adk.md)\n- [Agno vs Mastra](https://www.anchorterminal.com/compare/agno-vs-mastra.md)\n- [BoxLang AI vs Agent Development Kit (ADK)](https://www.anchorterminal.com/compare/boxlang-ai-vs-google-adk.md)\n- [BoxLang AI vs Mastra](https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra.md)\n- [Claude Agent SDK vs Agent Development Kit (ADK)](https://www.anchorterminal.com/compare/claude-agent-sdk-vs-google-adk.md)\n- [Claude Agent SDK vs Mastra](https://www.anchorterminal.com/compare/claude-agent-sdk-vs-mastra.md)\n- [CrewAI vs Agent Development Kit (ADK)](https://www.anchorterminal.com/compare/crewai-vs-google-adk.md)\n- [CrewAI vs Mastra](https://www.anchorterminal.com/compare/crewai-vs-mastra.md)\n- [Cursor Agent SDK vs Agent Development Kit (ADK)](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-google-adk.md)\n- [Cursor Agent SDK vs Mastra](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra.md)\n- [Docker Agent vs Agent Development Kit (ADK)](https://www.anchorterminal.com/compare/docker-agent-vs-google-adk.md)\n- [Docker Agent vs Mastra](https://www.anchorterminal.com/compare/docker-agent-vs-mastra.md)\n- [Agent Development Kit (ADK) vs guilds.run](https://www.anchorterminal.com/compare/google-adk-vs-guilds-run.md)\n- [Agent Development Kit (ADK) vs LangGraph](https://www.anchorterminal.com/compare/google-adk-vs-langgraph.md)\n- [Agent Development Kit (ADK) vs LlamaIndex Framework](https://www.anchorterminal.com/compare/google-adk-vs-llamaindex.md)\n- [Agent Development Kit (ADK) vs Microsoft Agent Framework](https://www.anchorterminal.com/compare/google-adk-vs-microsoft-agent-framework.md)\n- [Agent Development Kit (ADK) vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/google-adk-vs-openai-agents-sdk.md)\n- [Agent Development Kit (ADK) vs Pydantic AI](https://www.anchorterminal.com/compare/google-adk-vs-pydantic-ai.md)\n- [Agent Development Kit (ADK) vs smolagents](https://www.anchorterminal.com/compare/google-adk-vs-smolagents.md)\n- [Agent Development Kit (ADK) vs Strands Agents](https://www.anchorterminal.com/compare/google-adk-vs-strands-agents.md)\n- [Agent Development Kit (ADK) vs TradingAgents](https://www.anchorterminal.com/compare/google-adk-vs-tradingagents.md)\n- [Agent Development Kit (ADK) vs AI SDK](https://www.anchorterminal.com/compare/google-adk-vs-vercel-ai-sdk.md)\n- [guilds.run vs Mastra](https://www.anchorterminal.com/compare/guilds-run-vs-mastra.md)\n- [LangGraph vs Mastra](https://www.anchorterminal.com/compare/langgraph-vs-mastra.md)\n- [LlamaIndex Framework vs Mastra](https://www.anchorterminal.com/compare/llamaindex-vs-mastra.md)\n- [Mastra vs Microsoft Agent Framework](https://www.anchorterminal.com/compare/mastra-vs-microsoft-agent-framework.md)\n- [Mastra vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk.md)\n- [Mastra vs Pydantic AI](https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai.md)\n- [Mastra vs smolagents](https://www.anchorterminal.com/compare/mastra-vs-smolagents.md)\n- [Mastra vs Strands Agents](https://www.anchorterminal.com/compare/mastra-vs-strands-agents.md)\n- [Mastra vs TradingAgents](https://www.anchorterminal.com/compare/mastra-vs-tradingagents.md)\n- [Mastra vs AI SDK](https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Agent Development Kit (ADK) vs Mastra", "url": "" } ], "description": "Mastra scores 74.2 (BB) to Agent Development Kit's 68.7 (B) for agent frameworks. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Agent Development Kit (ADK) B 68.7", "Mastra BB 74.2", "scores" ], "h1": "Agent Development Kit (ADK) vs Mastra", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/google-adk-vs-mastra", "published": "2026-10-01", "section": "tools", "title": "Agent Development Kit vs Mastra for AI agents (2026) | Anchor Terminal", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/google-adk-vs-mastra" }, "tokens": { "markdown": 4700, "slim": 2530 }, "version": 1 }