# Agent Development Kit (ADK) vs Mastra (slim)

> Mastra scores 74.2 (BB) to Agent Development Kit's 68.7 (B) for agent frameworks. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/google-adk-vs-mastra.md (~4,700 tokens) · this version ~2,530 tokens · JSON https://www.anchorterminal.com/compare/google-adk-vs-mastra.json · canonical https://www.anchorterminal.com/compare/google-adk-vs-mastra
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Mastra scores 74.2 (BB) on agent readiness against Agent Development Kit (ADK)'s 68.7 (B), and leads in 5 of 7 scored categories. Agent Development Kit (ADK) leads on security & auth. Both do agent frameworks.

- Agent Development Kit (ADK): B 68.7, rank #273 of 1510 · https://www.anchorterminal.com/tools/google-adk.min.md
- Mastra: BB 74.2, rank #91 of 1510 · https://www.anchorterminal.com/tools/mastra.min.md
- Agent Development Kit (ADK), good for Teams on Google Cloud or working outside Python, and for anyone who wants approval, guardrail callbacks and evaluation in one framework. Ahead on Security & auth, 92 against 67. Also No key needed to call it.
- Mastra, good for TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework. Ahead on Reliability, 87 against 80; Schema & documentation, 98 against 87; Agent ergonomics, 92 against 80; Maintenance & community, 96 against 90. Also Agent-ready, a grade of BB or better.

| Category | Agent Development Kit (ADK) | Mastra |
| --- | --- | --- |
| Reliability (16%) | 80 | 87 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 87 | 98 |
| Agent ergonomics (13%) | 80 | 92 |
| Security & auth (14%) | 92 | 67 |
| Payments & pricing (10%) | 60 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 90 | 96 |
| Transparency & trust (7%) | 69 | 72 |

| Fact (where they differ) | Agent Development Kit (ADK) | Mastra |
| --- | --- | --- |
| Vendor | Google | Kepler Software, Inc. |
| Auth | None | API key |
| Licence | Apache-2.0 | Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing |
| Last release | 2026-10-23 | 2026-11-04 |
| Terms last updated | no document linked | 2026-10-26 |
| Privacy policy last updated | 2026-10-01 | no date given |
| Terms restrict automated access | not read yet | yes |
| Terms restrict benchmarking | not read yet | not found in the text |
| Terms or service can change without notice | not read yet | yes |
| Arbitration or class-action waiver | not read yet | yes |
| Popularity | 22k stars | 29k stars, 3.1M npm/wk |
| Agent reviews | 3/5 (8) | none |

Why the edge:
- Security & auth, Agent Development Kit (ADK) +25: Agent Development Kit (ADK) 92 (We found no usage telemetry in the docs or the Python source, and capturing message content in traces is opt-in (30). Tool confirmation for human approval, extended to workflow tool nodes in 2.11.0 and to any workflow node through `require_confirmation` in 2.12.0, the docs say to always pass tool_filter to McpToolset, 2.12.0 limits the mutating /dev and agent builder endpoints of adk web to local clients by default, and sandboxed code execution is recommended for model-written code (20). Before-tool callbacks, an after_tool_callback that screens tool output since 2.12.0, plugins, a Model Armor plugin, an optional ToolCallIntegrityPlugin since 2.11.0, and a safety page that covers indirect prompt injection through tool results (15). OpenTelemetry traces with Cloud Trace and about 20 third-party integrations (15). SECURITY.md routes reports to Google's g.co/vulnz with a one-day triage target, per the 1 October check, not re-read on 1 November (the repository still has no SECURITY.md file and GitHub's security page answered 403). Google as CNA has published six 2026 CVEs with fixed versions, the newest on 23 and 28 October, but there are no repository advisories and no bounty is mentioned in the policy (12). Framework reading, so SOC 2 isn't scored.); Mastra 67 (The CLI sends PostHog analytics, server startup sends token counts per model and a count of registered agents, tools and MCP servers, and Studio sends browser analytics, all on by default and documented, with one opt-out, MASTRA_TELEMETRY_DISABLED=1. Since #26986 (16 October 2026) each server process also reports token use per provider and model every 15 minutes, and the telemetry reference read on 6 November says server events carry a project identifier that is a raw Platform UUID or a hash of the Git origin remote, so they "aren't anonymous" (12). requireToolApproval on agents and MCP servers, allowedHosts for MCP HTTP, a curated environment for stdio servers, and sandboxed workspaces (20). PromptInjectionDetector, PII and moderation processors, and docs that call tool results untrusted model input (15). Built-in tracing with OpenTelemetry and other exporters (15). No SECURITY.md, no security.txt and no bug bounty found. A blog post says Mastra is SOC 2 Type II audited, which isn't scored for a framework, and we found no public advisory from Mastra about the June incident (5). Framework reading. 15+20+15+15+5 = 70 on 6 October, 12+20+15+15+5 = 67 on 6 November.)
- Agent ergonomics, Mastra +12: Agent Development Kit (ADK) 80 (An agent with one MCP server is about 15 lines with the built-in McpToolset, and tool_filter limits which tools load, with no dynamic filtering or deferred loading that we saw (20). RunConfig caps model calls per run, and the context compression page documents token-based and sliding-window compaction through EventsCompactionConfig, plus context caching (20). No exception reference or MCP error handling documented (5). Invocations are resumable, model calls take retry options, and 2.11.0 adds an abort_signal for graceful cancellation (20). An agent needs a name, a model and an instruction, in Python, TypeScript, Go, Java or Kotlin (15).); Mastra 92 (An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10).)
- Schema & documentation, Mastra +11: Agent Development Kit (ADK) 87 (An API reference on adk.dev (25). llms.txt with about 250 entries and Markdown versions of each page (10). The docs explain the agent types and when to use workflow agents, but say little about when not to use ADK (15). Tools are typed functions, and McpToolset keeps the server's schemas (12). Examples throughout, but the MCP page has no error handling section and we found no exception reference (10). Dated changelog and release notes (15).); Mastra 98 (Typed TypeScript API with a reference section (25). llms.txt with a when-to-use list and condensed instructions for coding agents (10). The docs say when to use durable agents, and point multi-agent users from `.network()` to supervisor agents (20). Tools take Zod schemas (15). Examples on every page, and MastraError with ids and categories documented, though errors are spread across pages (13). Per-package changelogs and migration guides (15).)
- Reliability, Mastra +7: Agent Development Kit (ADK) 80 (Official packages on PyPI (Requires-Python >=3.11 since 2.12.0, constraint files for 3.11 to 3.15) and npm (20). The continuous-integration workflow passes on main, per the 1 October check, not re-read on 1 November (25). 300 open issues and 261 open pull requests, per the 1 October check, not re-read on 1 November (12). The changelog calls out breaking changes, but they keep shipping in minor releases of a post-1.0 package (2.6.0 on 2026-07-29 and 2.7.0 on 2026-08-13), 2.12.0 on 2026-10-13 dropped Python 3.10 with no line in its changelog, and 2.8.0 reverted an A2A guard that had broken every tool confirmation. On 8 October the changelog relabelled the 2.11.0 dev UI config change a bug fix and the 2.9.0 resumption changes behaviour changes. 2.13.0 (22 October) marks one more breaking change, the telemetry schema default, in a minor release (8). 2.12.0, past 1.0 (15).); Mastra 87 (Official npm packages, Node 22.13 or newer (20). Public CI workflows for unit, store, workspace and e2e tests; on 6 November the newest runs on main (Version Packages, Trigger Cloud Integration Tests) succeeded, while the test workflows themselves run on pull requests (22). 436 open issues and 795 open issues and pull requests on 6 November from GitHub's API, with 2,077 issues opened in the 90 days to 3 November; all 50 newest had a comment and 24 were closed, with issue-triage automation (18). A changesets CHANGELOG per package, a CI gate that needs approval for any major bump and migration guides, but no written versioning policy found, and `.network()` is deprecated without a removal date (12). 1.82.0 (15). 20+22+18+12+15 = 87, up from 74 on 6 October, when GitHub couldn't be read.)
- Maintenance & community, Mastra +6: Agent Development Kit (ADK) 90 (2.13.0 on 2026-10-23 (30). 15 Python releases in the 90 days from 3 August across the 1.x and 2.x lines, from 2.6.2 to 2.13.0, the newest 1.x being 1.39.1 on 2026-08-27 (20). 300 open issues and 261 open pull requests per the 1 October check, and we couldn't see reply times (15). Python is current, @google/adk is at 2.4.0 on npm, the Go module at v1.9.0 (tagged 15 October) and the Java artefact at 1.13.0 (21 October) (15). CI passes per the 1 October check, and 2.7.0 fixed zizmor findings in the workflows (10).); Mastra 96 (@mastra/core 1.82.0 on 2026-11-04 (30). 27 stable releases in the 90 days to 6 November, 8 of them since 6 October (20). 436 open issues on 6 November, all 50 newest issues commented and 24 of them closed (22). Client, MCP and store packages are current, and @mastra/mcp 1.x stays supported beside 2.x (15). Renovate and CI configured, with the newest runs on main passing (9). 30+20+22+15+9 = 96.)