guilds.run vs Mastra

guilds.run 21

No tagged release, version or dated changelog entry. Main, which the install clones and SECURITY.md names as the supported version, last changed on 3 November 2026 (1,072 of the commits since 14 October by one author), but commits with no version or tag aren't releases in this run (hyperqwen, brave-search-mcp), and CONTRIBUTING.md itself defines a release as a vMAJOR.MINOR.PATCH tag, so nothing has been released (0, from 20). No releases or dated changelog entries in the 90 days from 6 August (0). Issues and pull requests per the 14 October check (eight, all closed, the three issues within an hour), not re-read on 4 November (15 of 25). No published package (0). CI on every push with a frozen pnpm lockfile, and still no Dependabot configuration in the repository (6 of 10). 0 + 0 + 15 + 0 + 6 = 21.

Mastra 96

@mastra/core 1.82.0 on 2026-11-04 (30). 27 stable releases in the 90 days to 6 November, 8 of them since 6 October (20). 436 open issues on 6 November, all 50 newest issues commented and 24 of them closed (22). Client, MCP and store packages are current, and @mastra/mcp 1.x stays supported beside 2.x (15). Renovate and CI configured, with the newest runs on main passing (9). 30+20+22+15+9 = 96.

guilds.run 43

Read with the local-software lines, because the owner runs it. Docker with Compose is the stated requirement, and the install is a git clone of main plus ./setup.sh, which builds the images. No package, tagged release or published image exists, since the image workflow runs only on a v* tag and the remote still has none on 4 November 2026 (10 of 20, the earlier partial kept). The verify workflow runs scripts/check.sh on every push, with typecheck, lint, orchestrator, UI and web tests and a smoke test of the Compose stack, and the clone has 356 test files. GitHub's Actions pages and API answered 403 on 4 November, so the pass state on main is unread (15 of 25, down from 25 on the 14 October reading of 13 passing runs). Open issues per the 14 October check, not re-read on 4 November (18 of 25). CHANGELOG.md, added on 15 October, marks each change no impact, rebuild or breaking and CONTRIBUTING.md defines a semver tag policy, but no version has been cut (0, the earlier value kept). Not versioned or declared stable (0). 10 + 15 + 18 + 0 + 0 = 43.

Mastra 87

Official npm packages, Node 22.13 or newer (20). Public CI workflows for unit, store, workspace and e2e tests; on 6 November the newest runs on main (Version Packages, Trigger Cloud Integration Tests) succeeded, while the test workflows themselves run on pull requests (22). 436 open issues and 795 open issues and pull requests on 6 November from GitHub's API, with 2,077 issues opened in the 90 days to 3 November; all 50 newest had a comment and 24 were closed, with issue-triage automation (18). A changesets CHANGELOG per package, a CI gate that needs approval for any major bump and migration guides, but no written versioning policy found, and .network() is deprecated without a removal date (12). 1.82.0 (15). 20+22+18+12+15 = 87, up from 74 on 6 October, when GitHub couldn't be read.

guilds.run 58

Framework reading. No OpenAPI document for the HTTP API. The recipe format guilds.recipe v2 rejects unknown keys, and connector manifests are validated with TypeBox at load (12 of 25). No llms.txt on docs.guilds.run (404 on 4 November). The docs are Markdown in the repository with an AGENTS.md (5 of 10). Pages state what the code does today, which page to read for which job, and the trust boundary in numbered rules (15 of 20). Tool input schemas, recipe caps and typed manifest fields (11 of 15). The getting-started walk says what you should see at each step, and the Operate page explains each startup error message (11 of 15). CHANGELOG.md (since 15 October) holds only an Unreleased section with no version or date, and the security register keeps dated history (4 of 15, the earlier partial kept). 12 + 5 + 15 + 11 + 11 + 4 = 58.

Mastra 98

Typed TypeScript API with a reference section (25). llms.txt with a when-to-use list and condensed instructions for coding agents (10). The docs say when to use durable agents, and point multi-agent users from .network() to supervisor agents (20). Tools take Zod schemas (15). Examples on every page, and MastraError with ids and categories documented, though errors are spread across pages (13). Per-package changelogs and migration guides (15).

guilds.run 67

Framework reading, scored on what it takes to run a tool-calling team with MCP. No code is needed. Three commands and a model key start a guild, and each agent is offered only the tools turned on for it (18 of 25). max_tool_calls defaults to 50 per run, max_input_tokens trims old tool results and hands off to a new run, and remaining_tool_calls is appended to each result after the platform cap (15 of 20). Runs end with named codes such as generation.max_tool_calls and workspace.full, and interrupted tool calls get an error result so the next model request is valid (13 of 20). readOnlyHint and destructiveHint are stored for each MCP tool and writing tools start Off. Startup does not replay a model call (14 of 20). Sensible defaults and a guided first-run dialog, but it is an application with an HTTP API and no SDK in any language (7 of 15). Confirmed on 4 November in the clone (max_tool_calls default 50, 200 for a new coding agent).

Mastra 92

An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10).

guilds.run 60

AGPL-3.0-only, OSI approved (30). No privacy policy or terms. The footer still links to both and they returned 404 on 4 November 2026. The docs say where data lives (PostgreSQL and STATE_ROOT on your host), that model keys go only to their provider, and that stored credentials are encrypted under one master key in .env (12 of 30). No deprecation policy or dated notices. CHANGELOG.md marks breaking changes with steps, undated, and the security register is dated (3 of 20, the earlier partial kept). Sentry is opt-in and documented on the Configure page, and the models.dev catalogue fetch and the connector registry address are documented with their switches (18 of 20). 30 + 12 + 3 + 18 = 63.

Mastra 72

Apache 2.0 for the core, with ee/ directories source-available under the Mastra Enterprise License (25). The privacy policy (last published 25 April 2025) covers the website, the Teams plan states six months' retention, and the subprocessor list sits in a trust centre our reader couldn't render (15). Migration guides and deprecation warnings, without dated removal windows (12). Every telemetry stream is documented with links to its source and one opt-out, and the reference now spells out what the project identifiers can be correlated with (20).