{ "data": { "a": { "slug": "guilds-run", "name": "guilds.run", "vendor": "Cigale AI", "vendorUrl": "https://guilds.run", "kind": "framework", "category": "frameworks", "summary": "Open-source, self-hosted system from Cigale AI for standing teams of AI agents, each with its own role, model and tools. A guild shares chat, notes and tables, and every run keeps the prompt, tool calls and memory changes.", "url": "https://www.anchorterminal.com/tools/guilds-run", "markdownUrl": "https://www.anchorterminal.com/tools/guilds-run.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/guilds-run.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/guilds-run.json", "dns": "guilds-run.grade.anchorterminal.com", "repo": "https://github.com/CigaleAI/guilds", "license": "AGPL-3.0-only", "transports": [], "packages": [], "auth": "api-key", "authNotes": "The box has no model key of its own. Each organisation pastes a key for OpenAI, OpenRouter, xAI, DeepInfra or Kimi Code, or points at a local OpenAI-compatible endpoint, and the key is sent only to that provider. The web app on 127.0.0.1:8080 has no login by default; whoever reaches the port is the operator. AUTH_MODE=trusted-header takes identity from an authenticating proxy with a shared secret.", "pricing": "free", "pricingNotes": "Free under AGPL-3.0 to run yourself, with model usage billed by your own provider and no spend cap set by guilds.run. A hosted edition from $19 a month is listed as coming soon and not available on 14 October 2026 (https://www.guilds.run/pricing).", "priceSummary": "Free · OSS", "where": "library", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the repository, the docs or on guilds.run (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 57, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://docs.guilds.run/", "capabilities": [ "agent.framework", "agent.multi-agent", "agent.mcp-client", "agent.durable" ], "tags": [ "framework", "open-source", "self-hosted", "local", "docker", "typescript", "free", "no-card", "pre-1.0" ], "graded": true, "anchor": { "graded": true, "score": 53.4, "grade": "D", "agentReady": false, "rank": 951, "ranked": true, "rankOf": 1510, "categoryRank": 20, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 67, "maintenance": 21, "payments": 60, "reliability": 43, "schema": 58, "security": 68, "transparency": 60 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": -2, "negativeNotes": [ "2026-10-14, still live on 2026-11-04. The home page says each agent has its own computer, and its script example reads sandboxed in scout's workspace. Since the change of 13 October 2026 (pull request #8, per-org machines), agents are placed on shared machines, and the vendor's own register (SEC-24, open and accepted) and machines page say agents on one machine can read each other's homes, git tokens, browser sessions and running commands' environments. The footer also links to terms and privacy pages that return 404. The docs state the shared-machine risk plainly, so 2 points. https://www.guilds.run/ and https://github.com/CigaleAI/guilds/blob/main/docs/architecture/security-register.md" ], "verdict": "A self-hosted multi-agent system that records each run's prompt, tool calls and memory changes, with per-agent models and tools and no telemetry by default. It has no tagged release, version or package, so users track main, its own security register lists 28 open issues of 58, and the site's terms and privacy links return 404.", "bestFor": "A person or small team that wants a standing, inspectable team of agents with schedules, shared tables and a web app, run on one machine, and is comfortable tracking main.", "strengths": [ "Every run stores the prompt the model saw, each tool call and result, and versioned memory with the author of each change", "Free under AGPL-3.0, with Sentry off unless SENTRY_DSN is set and the model catalogue fetch switchable", "MCP tools that write or are marked destructive start Off for a new login, and each agent is offered only the tools turned on for it", "CI runs typecheck, lint, unit tests and a smoke test of the Compose stack on every push", "A public security register records 58 issues with status, exposure and residual risk" ], "weaknesses": [ "No tagged release, version number or published image on 4 November 2026. Users install whatever is on main, including breaking changes", "28 issues in the vendor's security register are open, among them shared machines (SEC-24), root shells (SEC-6) and prompt injection into coding agents (SEC-8)", "No login on the default box. Whoever reaches port 8080 is the operator, and remote use needs a proxy or tailnet", "Terms and privacy links on guilds.run return 404, and no privacy statement for the software was found", "The changelog holds only an Unreleased section with no dates" ], "agentNotes": [ "Keep the box on loopback or behind an authenticating proxy with AUTH_MODE=trusted-header. The default mode does not authenticate", "Put agents that hold different secrets or GitHub tokens on different machines. Agents on one machine can read each other's homes and tokens", "Back up the .env file written by ./setup.sh. It holds the only copy of the key that encrypts stored credentials", "Pin a commit of main when you deploy and read CHANGELOG.md's Unreleased section before pulling. Breaking changes land on main", "Set MODELS_DEV_URL empty for an offline box. The model catalogue is otherwise fetched from models.dev hourly" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 53.4 } ], "editorialScores": { "ergonomics": 67, "maintenance": 21, "payments": 60, "reliability": 43, "schema": 58, "security": 68, "transparency": 63 }, "provenanceScore": 56, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-04", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "git clone https://github.com/CigaleAI/guilds.git \u0026\u0026 cd guilds \u0026\u0026 ./setup.sh \u0026\u0026 docker compose up --detach --wait" }, "letme": { "capability": "https://letme.dev/agent.framework", "tool": "https://letme.dev/guilds-run" }, "area": "frameworks", "provenance": { "legalEntity": "Cigale AI", "domain": "guilds.run", "domainRegistered": "2026-09-19", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/CigaleAI/guilds/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-04", "notes": [ "The site footer says Cigale is the company behind guilds.run, and THIRD_PARTY_NOTICES.md reads copyright Cigale AI. No legal form or address was found.", "The footer links to https://www.guilds.run/terms and https://www.guilds.run/privacy, and both returned 404 on 14 October and 4 November 2026.", "www.guilds.run/.well-known/security.txt returns 404. The repository has SECURITY.md with GitHub private vulnerability reporting.", "CHANGELOG.md in the repository since 15 October 2026, with an Unreleased section only.", "RDAP gives guilds.run a registration date of 2026-09-19.", "The GitHub organisation CigaleAI was created on 2025-02-17 and is not verified." ], "score": 56 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/guilds-run.json", "live": { "slug": "guilds-run", "githubStars": 67, "securityTxt": { "url": "https://guilds.run/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T15:59:37.244745625Z" }, "domain": { "domain": "guilds.run", "registered": "2026-09-19", "source": "https://rdap.identitydigital.services/rdap/domain/guilds.run", "checkedAt": "2026-11-01T14:12:07.621535185Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/CigaleAI/guilds/main/CHANGELOG.md", "kind": "changelog", "status": 304, "checkedAt": "2026-11-07T14:18:06.648722196Z", "changedAt": "2026-11-06T13:39:41.628947519Z", "fingerprint": "f9038c621e32" }, { "url": "https://www.guilds.run/pricing", "kind": "pricing", "status": 304, "checkedAt": "2026-11-07T14:29:26.228895188Z", "changedAt": "2026-10-15T22:10:00.990326283Z", "fingerprint": "e3efa801ad24" } ], "github": { "repo": "cigaleai/guilds", "checkedAt": "2026-11-02T08:38:38.17968009Z", "stars": 67, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-01T17:47:15Z", "openIssues": 0, "openPRs": 0, "issuesOpened90d": 5, "issuesClosed90d": 5, "prsMerged90d": 17, "ci": { "branch": "main", "runs": 50, "success": 49, "failure": 1, "other": 0, "latest": "success", "latestAt": "2026-11-01T17:52:53Z" }, "replies": { "sampled": 5, "unanswered": 0, "medianDays": 0 } }, "updatedAt": "2026-11-07T15:59:37.244745625Z" } }, "answer": "Mastra scores 74.2 (BB) on agent readiness against guilds.run's 53.4 (D), and leads in 5 of 7 scored categories.", "b": { "slug": "mastra", "name": "Mastra", "vendor": "Kepler Software, Inc.", "vendorUrl": "https://mastra.ai", "kind": "framework", "category": "frameworks", "summary": "Open-source TypeScript framework from Mastra for building agents and workflows, with memory, RAG, evals, tracing, an MCP client and server, and a local Studio. An optional hosted platform runs deployments and observability.", "url": "https://www.anchorterminal.com/tools/mastra", "markdownUrl": "https://www.anchorterminal.com/tools/mastra.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/mastra.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/mastra.json", "dns": "mastra.grade.anchorterminal.com", "repo": "https://github.com/mastra-ai/mastra", "license": "Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing", "transports": [], "packages": [ { "registry": "npm", "name": "@mastra/core" }, { "registry": "npm", "name": "@mastra/mcp" }, { "registry": "npm", "name": "mastra" } ], "auth": "api-key", "authNotes": "The framework has no account of its own. The model router takes `provider/model` strings and each provider's own key. The hosted Mastra platform needs an account.", "pricing": "free", "pricingNotes": "Free and open source. You pay for model calls. The hosted platform has a $0 Starter plan with 100K observability events and 24 CPU hours, then $10 per 100K events and $0.35 a CPU hour, and Teams at $250 a month (https://mastra.ai/pricing, checked 2026-11-06).", "priceSummary": "Free · OSS", "where": "library", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Mastra docs, the repository or the pricing page (checked 2026-10-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 29383, "npmWeekly": 3116983, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://mastra.ai/docs", "llmsTxt": "https://mastra.ai/llms.txt", "capabilities": [ "agent.framework", "agent.durable", "agent.mcp-client", "agent.multi-agent" ], "tags": [ "framework", "typescript", "open-source", "llms-txt", "mcp", "telemetry-default-on" ], "lastRelease": "2026-11-04", "graded": true, "anchor": { "graded": true, "score": 74.2, "grade": "BB", "agentReady": true, "rank": 91, "ranked": true, "rankOf": 1510, "categoryRank": 7, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 92, "maintenance": 96, "payments": 60, "reliability": 87, "schema": 98, "security": 67, "transparency": 72 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": -8, "negativeNotes": [ "2026-06-17. Malicious versions of Mastra's npm packages were published, among them @mastra/core 1.42.1 at 01:15 UTC, and GitHub malware advisories that day (GHSA-pp62-grrw-hvfp and others) say any machine that installed one should be treated as fully compromised. All 21 Mastra packages we checked on OSV carry one. Mastra published clean versions the same day and the changelogs name an \"easy-day-js\" supply-chain incident, but we found no advisory or post-mortem from Mastra. Fixed and under four months old, so 8 points. https://osv.dev/vulnerability/MAL-2026-6011" ], "verdict": "A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes.", "bestFor": "TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.", "strengths": [ "MCP client with requireToolApproval per server or per tool, allowedHosts and a curated environment for stdio servers", "Guardrail processors for prompt injection, PII, moderation and cost limits, run on input and output", "Workflows with snapshots, suspend and resume, and durable agents on Inngest or an evented engine", "Apache 2.0 core, 1.0 since 20 January 2026, with 27 releases of @mastra/core in 90 days to 6 November", "llms.txt with a when-to-use section and condensed instructions for coding agents" ], "weaknesses": [ "Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026", "CLI, server and Studio send usage analytics by default, including token counts every 15 minutes, off with MASTRA_TELEMETRY_DISABLED=1", "No SECURITY.md, no security.txt and no bug bounty found", "Code under ee/ is source-available under the Mastra Enterprise License, not Apache 2.0", "TypeScript only, Node 22.13 or newer" ], "agentNotes": [ "Set MASTRA_TELEMETRY_DISABLED=1 in every environment that runs the CLI, the server or Studio", "Pin exact versions with a lockfile, and make sure no 17 June 2026 release such as @mastra/core 1.42.1 is installed", "Set requireToolApproval on MCP servers that write, and allowedHosts when server URLs come from configuration", "Add PromptInjectionDetector as an input processor when tools return web or user content", "Use supervisor agents through generate() or stream(). `.network()` is deprecated" ], "metrics": { "kind": "library", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 74.2 } ], "editorialScores": { "ergonomics": 92, "maintenance": 96, "payments": 60, "reliability": 87, "schema": 98, "security": 67, "transparency": 72 }, "provenanceScore": 71, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm create mastra@latest # or: npm i @mastra/core @mastra/mcp" }, "letme": { "capability": "https://letme.dev/agent.framework", "tool": "https://letme.dev/mastra" }, "area": "frameworks", "provenance": { "legalEntity": "Kepler Software, Inc.", "domain": "mastra.ai", "domainRegistered": "2024-10-01", "endpointOnVendorDomain": null, "terms": "https://mastra.ai/terms-of-service", "privacy": "https://mastra.ai/privacy-policy", "statusPage": "https://statuspage.incident.io/mastra-platform", "changelog": "https://github.com/mastra-ai/mastra/blob/main/packages/core/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The privacy policy names Kepler Software Inc as operator of mastra.ai and shows a last-published date of 25 April 2025.", "The licence file is copyright Kepler Software, Inc.", "mastra.ai/.well-known/security.txt returns 404 (rechecked 6 November 2026), and the repository has no SECURITY.md.", "RDAP gives mastra.ai a registration date of 2024-10-01.", "The status page covers the hosted platform, not the framework." ], "score": 71 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/mastra.json", "live": { "slug": "mastra", "vendorStatus": { "page": "https://statuspage.incident.io/mastra-platform", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T19:22:27.41396844Z" }, "versions": [ { "registry": "github", "name": "mastra-ai/mastra", "version": "@mastra/core@1.82.0", "released": "2026-11-04", "seenAt": "2026-11-06T23:43:05.299046627Z" }, { "registry": "npm", "name": "@mastra/core", "version": "1.82.0", "seenAt": "2026-11-06T23:43:01.102546802Z" }, { "registry": "npm", "name": "@mastra/mcp", "version": "2.8.0", "seenAt": "2026-11-06T23:43:01.962943277Z" }, { "registry": "npm", "name": "mastra", "version": "1.38.0", "seenAt": "2026-11-06T23:43:03.330470883Z" } ], "githubStars": 29384, "npmWeekly": 3116983, "securityTxt": { "url": "https://mastra.ai/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:45.130857018Z" }, "llmsTxt": { "url": "https://mastra.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:57.501317652Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/mastra-ai/mastra/main/packages/core/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:21:37.959722321Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "0bdb3498f7aa" }, { "url": "https://mastra.ai/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:13:54.312763229Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "0204673a21a8" }, { "url": "https://mastra.ai/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:13:56.829832485Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1621ce3063d8" }, { "url": "https://mastra.ai/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:13:58.580048861Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "edbcf520f26c" } ], "updatedAt": "2026-11-07T19:22:27.41396844Z" } }, "edges": [ { "by": 75, "category": "maintenance", "leads": "mastra", "name": "Maintenance \u0026 community", "reasons": { "a": "No tagged release, version or dated changelog entry. Main, which the install clones and SECURITY.md names as the supported version, last changed on 3 November 2026 (1,072 of the commits since 14 October by one author), but commits with no version or tag aren't releases in this run (hyperqwen, brave-search-mcp), and CONTRIBUTING.md itself defines a release as a vMAJOR.MINOR.PATCH tag, so nothing has been released (0, from 20). No releases or dated changelog entries in the 90 days from 6 August (0). Issues and pull requests per the 14 October check (eight, all closed, the three issues within an hour), not re-read on 4 November (15 of 25). No published package (0). CI on every push with a frozen pnpm lockfile, and still no Dependabot configuration in the repository (6 of 10). 0 + 0 + 15 + 0 + 6 = 21.", "b": "@mastra/core 1.82.0 on 2026-11-04 (30). 27 stable releases in the 90 days to 6 November, 8 of them since 6 October (20). 436 open issues on 6 November, all 50 newest issues commented and 24 of them closed (22). Client, MCP and store packages are current, and @mastra/mcp 1.x stays supported beside 2.x (15). Renovate and CI configured, with the newest runs on main passing (9). 30+20+22+15+9 = 96." }, "scores": { "a": 21, "b": 96 } }, { "by": 44, "category": "reliability", "leads": "mastra", "name": "Reliability", "reasons": { "a": "Read with the local-software lines, because the owner runs it. Docker with Compose is the stated requirement, and the install is a git clone of main plus ./setup.sh, which builds the images. No package, tagged release or published image exists, since the image workflow runs only on a v* tag and the remote still has none on 4 November 2026 (10 of 20, the earlier partial kept). The verify workflow runs scripts/check.sh on every push, with typecheck, lint, orchestrator, UI and web tests and a smoke test of the Compose stack, and the clone has 356 test files. GitHub's Actions pages and API answered 403 on 4 November, so the pass state on main is unread (15 of 25, down from 25 on the 14 October reading of 13 passing runs). Open issues per the 14 October check, not re-read on 4 November (18 of 25). CHANGELOG.md, added on 15 October, marks each change no impact, rebuild or breaking and CONTRIBUTING.md defines a semver tag policy, but no version has been cut (0, the earlier value kept). Not versioned or declared stable (0). 10 + 15 + 18 + 0 + 0 = 43.", "b": "Official npm packages, Node 22.13 or newer (20). Public CI workflows for unit, store, workspace and e2e tests; on 6 November the newest runs on main (Version Packages, Trigger Cloud Integration Tests) succeeded, while the test workflows themselves run on pull requests (22). 436 open issues and 795 open issues and pull requests on 6 November from GitHub's API, with 2,077 issues opened in the 90 days to 3 November; all 50 newest had a comment and 24 were closed, with issue-triage automation (18). A changesets CHANGELOG per package, a CI gate that needs approval for any major bump and migration guides, but no written versioning policy found, and `.network()` is deprecated without a removal date (12). 1.82.0 (15). 20+22+18+12+15 = 87, up from 74 on 6 October, when GitHub couldn't be read." }, "scores": { "a": 43, "b": 87 } }, { "by": 40, "category": "schema", "leads": "mastra", "name": "Schema \u0026 documentation", "reasons": { "a": "Framework reading. No OpenAPI document for the HTTP API. The recipe format guilds.recipe v2 rejects unknown keys, and connector manifests are validated with TypeBox at load (12 of 25). No llms.txt on docs.guilds.run (404 on 4 November). The docs are Markdown in the repository with an AGENTS.md (5 of 10). Pages state what the code does today, which page to read for which job, and the trust boundary in numbered rules (15 of 20). Tool input schemas, recipe caps and typed manifest fields (11 of 15). The getting-started walk says what you should see at each step, and the Operate page explains each startup error message (11 of 15). CHANGELOG.md (since 15 October) holds only an Unreleased section with no version or date, and the security register keeps dated history (4 of 15, the earlier partial kept). 12 + 5 + 15 + 11 + 11 + 4 = 58.", "b": "Typed TypeScript API with a reference section (25). llms.txt with a when-to-use list and condensed instructions for coding agents (10). The docs say when to use durable agents, and point multi-agent users from `.network()` to supervisor agents (20). Tools take Zod schemas (15). Examples on every page, and MastraError with ids and categories documented, though errors are spread across pages (13). Per-package changelogs and migration guides (15)." }, "scores": { "a": 58, "b": 98 } }, { "by": 25, "category": "ergonomics", "leads": "mastra", "name": "Agent ergonomics", "reasons": { "a": "Framework reading, scored on what it takes to run a tool-calling team with MCP. No code is needed. Three commands and a model key start a guild, and each agent is offered only the tools turned on for it (18 of 25). max_tool_calls defaults to 50 per run, max_input_tokens trims old tool results and hands off to a new run, and remaining_tool_calls is appended to each result after the platform cap (15 of 20). Runs end with named codes such as generation.max_tool_calls and workspace.full, and interrupted tool calls get an error result so the next model request is valid (13 of 20). readOnlyHint and destructiveHint are stored for each MCP tool and writing tools start Off. Startup does not replay a model call (14 of 20). Sensible defaults and a guided first-run dialog, but it is an application with an HTTP API and no SDK in any language (7 of 15). Confirmed on 4 November in the clone (max_tool_calls default 50, 200 for a new coding agent).", "b": "An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10)." }, "scores": { "a": 67, "b": 92 } }, { "by": 12, "category": "transparency", "leads": "mastra", "name": "Transparency \u0026 trust", "reasons": { "a": "AGPL-3.0-only, OSI approved (30). No privacy policy or terms. The footer still links to both and they returned 404 on 4 November 2026. The docs say where data lives (PostgreSQL and STATE_ROOT on your host), that model keys go only to their provider, and that stored credentials are encrypted under one master key in .env (12 of 30). No deprecation policy or dated notices. CHANGELOG.md marks breaking changes with steps, undated, and the security register is dated (3 of 20, the earlier partial kept). Sentry is opt-in and documented on the Configure page, and the models.dev catalogue fetch and the connector registry address are documented with their switches (18 of 20). 30 + 12 + 3 + 18 = 63.", "b": "Apache 2.0 for the core, with ee/ directories source-available under the Mastra Enterprise License (25). The privacy policy (last published 25 April 2025) covers the website, the Teams plan states six months' retention, and the subprocessor list sits in a trust centre our reader couldn't render (15). Migration guides and deprecation warnings, without dated removal windows (12). Every telemetry stream is documented with links to its source and one opt-out, and the reference now spells out what the project identifiers can be correlated with (20)." }, "scores": { "a": 60, "b": 72 } } ], "facts": [ { "a": "Agent framework", "b": "Agent framework", "name": "Kind" }, { "a": "Cigale AI", "b": "Kepler Software, Inc.", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "", "name": "Transports" }, { "a": "API key", "b": "API key", "name": "Auth" }, { "a": "Free", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "AGPL-3.0-only", "b": "Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "none", "b": "2026-11-04", "name": "Last release" }, { "a": "no document linked", "b": "2026-10-26", "name": "Terms last updated" }, { "a": "no document linked", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "not read yet", "b": "yes", "name": "Customer content may train models" }, { "a": "not read yet", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "57 stars", "b": "29k stars, 3.1M npm/wk", "name": "Popularity" } ], "faq": [ { "answer": "Mastra scores 74.2 (BB) on agent readiness against guilds.run's 53.4 (D), and leads in 5 of 7 scored categories.", "question": "Which is better for AI agents, guilds.run or Mastra?" }, { "answer": "Yes. guilds.run is open source (AGPL-3.0-only). Mastra is open source (Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing).", "question": "Are guilds.run and Mastra open source?" } ], "goodFor": [ { "aheadOn": null, "also": [ "Free to start without a card" ], "goodFor": "A person or small team that wants a standing, inspectable team of agents with schedules, shared tables and a web app, run on one machine, and is comfortable tracking main.", "slug": "guilds-run", "watchFor": "No tagged release, version number or published image on 4 November 2026. Users install whatever is on main, including breaking changes" }, { "aheadOn": [ "Reliability, 87 against 43", "Schema \u0026 documentation, 98 against 58", "Agent ergonomics, 92 against 67", "Maintenance \u0026 community, 96 against 21", "Transparency \u0026 trust, 72 against 60" ], "also": [ "Agent-ready, a grade of BB or better" ], "goodFor": "TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.", "slug": "mastra", "watchFor": "Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026" } ], "history": { "guilds-run": [ { "causes": [ "product", "evidence", "correction" ], "date": "2026-11-04", "delta": -3.2, "from": 56.6, "fromGrade": "C", "to": 53.4, "toGrade": "D" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 56.5, "fromGrade": "C", "to": 56.6, "toGrade": "C" } ], "mastra": null }, "job": { "capability": "agent.framework", "name": "Agent frameworks" }, "others": [ { "json": "https://www.anchorterminal.com/compare/agentos-vs-guilds-run.json", "title": "AgentOS vs guilds.run", "url": "https://www.anchorterminal.com/compare/agentos-vs-guilds-run" }, { "json": "https://www.anchorterminal.com/compare/agentos-vs-mastra.json", "title": "AgentOS vs Mastra", "url": "https://www.anchorterminal.com/compare/agentos-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/agno-vs-guilds-run.json", "title": "Agno vs guilds.run", "url": "https://www.anchorterminal.com/compare/agno-vs-guilds-run" }, { "json": "https://www.anchorterminal.com/compare/agno-vs-mastra.json", "title": "Agno vs Mastra", "url": "https://www.anchorterminal.com/compare/agno-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-guilds-run.json", "title": "BoxLang AI vs guilds.run", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-guilds-run" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra.json", "title": "BoxLang AI vs Mastra", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-guilds-run.json", "title": "Claude Agent SDK vs guilds.run", "url": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-guilds-run" }, { "json": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-mastra.json", "title": "Claude Agent SDK vs Mastra", "url": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/crewai-vs-guilds-run.json", "title": "CrewAI vs guilds.run", "url": "https://www.anchorterminal.com/compare/crewai-vs-guilds-run" }, { "json": "https://www.anchorterminal.com/compare/crewai-vs-mastra.json", "title": "CrewAI vs Mastra", "url": "https://www.anchorterminal.com/compare/crewai-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-guilds-run.json", "title": "Cursor Agent SDK vs guilds.run", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-guilds-run" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra.json", "title": "Cursor Agent SDK vs Mastra", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/docker-agent-vs-guilds-run.json", "title": "Docker Agent vs guilds.run", "url": "https://www.anchorterminal.com/compare/docker-agent-vs-guilds-run" }, { "json": "https://www.anchorterminal.com/compare/docker-agent-vs-mastra.json", "title": "Docker Agent vs Mastra", "url": "https://www.anchorterminal.com/compare/docker-agent-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/google-adk-vs-guilds-run.json", "title": "Agent Development Kit (ADK) vs guilds.run", "url": "https://www.anchorterminal.com/compare/google-adk-vs-guilds-run" }, { "json": "https://www.anchorterminal.com/compare/google-adk-vs-mastra.json", "title": "Agent Development Kit (ADK) vs Mastra", "url": "https://www.anchorterminal.com/compare/google-adk-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/guilds-run-vs-langgraph.json", "title": "guilds.run vs LangGraph", "url": "https://www.anchorterminal.com/compare/guilds-run-vs-langgraph" }, { "json": "https://www.anchorterminal.com/compare/guilds-run-vs-llamaindex.json", "title": "guilds.run vs LlamaIndex Framework", "url": "https://www.anchorterminal.com/compare/guilds-run-vs-llamaindex" }, { "json": "https://www.anchorterminal.com/compare/guilds-run-vs-microsoft-agent-framework.json", "title": "guilds.run vs Microsoft Agent Framework", "url": "https://www.anchorterminal.com/compare/guilds-run-vs-microsoft-agent-framework" }, { "json": "https://www.anchorterminal.com/compare/guilds-run-vs-openai-agents-sdk.json", "title": "guilds.run vs OpenAI Agents SDK", "url": "https://www.anchorterminal.com/compare/guilds-run-vs-openai-agents-sdk" }, { "json": "https://www.anchorterminal.com/compare/guilds-run-vs-pydantic-ai.json", "title": "guilds.run vs Pydantic AI", "url": "https://www.anchorterminal.com/compare/guilds-run-vs-pydantic-ai" }, { "json": "https://www.anchorterminal.com/compare/guilds-run-vs-smolagents.json", "title": "guilds.run vs smolagents", "url": "https://www.anchorterminal.com/compare/guilds-run-vs-smolagents" }, { "json": "https://www.anchorterminal.com/compare/guilds-run-vs-strands-agents.json", "title": "guilds.run vs Strands Agents", "url": "https://www.anchorterminal.com/compare/guilds-run-vs-strands-agents" }, { "json": "https://www.anchorterminal.com/compare/guilds-run-vs-tradingagents.json", "title": "guilds.run vs TradingAgents", "url": "https://www.anchorterminal.com/compare/guilds-run-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/guilds-run-vs-vercel-ai-sdk.json", "title": "guilds.run vs AI SDK", "url": "https://www.anchorterminal.com/compare/guilds-run-vs-vercel-ai-sdk" }, { "json": "https://www.anchorterminal.com/compare/langgraph-vs-mastra.json", "title": "LangGraph vs Mastra", "url": "https://www.anchorterminal.com/compare/langgraph-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/llamaindex-vs-mastra.json", "title": "LlamaIndex Framework vs Mastra", "url": "https://www.anchorterminal.com/compare/llamaindex-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-microsoft-agent-framework.json", "title": "Mastra vs Microsoft Agent Framework", "url": "https://www.anchorterminal.com/compare/mastra-vs-microsoft-agent-framework" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk.json", "title": "Mastra vs OpenAI Agents SDK", "url": "https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai.json", "title": "Mastra vs Pydantic AI", "url": "https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-smolagents.json", "title": "Mastra vs smolagents", "url": "https://www.anchorterminal.com/compare/mastra-vs-smolagents" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-strands-agents.json", "title": "Mastra vs Strands Agents", "url": "https://www.anchorterminal.com/compare/mastra-vs-strands-agents" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-tradingagents.json", "title": "Mastra vs TradingAgents", "url": "https://www.anchorterminal.com/compare/mastra-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk.json", "title": "Mastra vs AI SDK", "url": "https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk" } ], "panel": null, "scores": [ { "by": 44, "edge": "mastra", "guilds-run": 43, "key": "reliability", "mastra": 87, "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 40, "edge": "mastra", "guilds-run": 58, "key": "schema", "mastra": 98, "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 25, "edge": "mastra", "guilds-run": 67, "key": "ergonomics", "mastra": 92, "name": "Agent ergonomics", "weight": 13 }, { "by": 1, "edge": "guilds-run", "guilds-run": 68, "key": "security", "mastra": 67, "name": "Security \u0026 auth", "weight": 14 }, { "by": 0, "edge": "", "guilds-run": 60, "key": "payments", "mastra": 60, "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 75, "edge": "mastra", "guilds-run": 21, "key": "maintenance", "mastra": 96, "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 12, "edge": "mastra", "guilds-run": 60, "key": "transparency", "mastra": 72, "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Mastra scores 74.2 (BB) on agent readiness against guilds.run's 53.4 (D), and leads in 5 of 7 scored categories. Both do agent frameworks.", "tasks": null, "tutorials": [], "verdicts": { "guilds-run": "A self-hosted multi-agent system that records each run's prompt, tool calls and memory changes, with per-agent models and tools and no telemetry by default. It has no tagged release, version or package, so users track main, its own security register lists 28 open issues of 58, and the site's terms and privacy links return 404.", "mastra": "A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/guilds-run-vs-mastra", "json": "https://www.anchorterminal.com/compare/guilds-run-vs-mastra.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/guilds-run-vs-mastra.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/guilds-run-vs-mastra.min.md" }, "markdown": "Mastra scores 74.2 (BB) on agent readiness against guilds.run's 53.4 (D), and leads in 5 of 7 scored categories. Both do agent frameworks.\n\n- guilds.run: grade D, 53.4/100, rank #951 of 1510. Markdown https://www.anchorterminal.com/tools/guilds-run.md · JSON https://www.anchorterminal.com/api/v1/tools/guilds-run.json\n- Mastra: grade BB, 74.2/100, rank #91 of 1510. Markdown https://www.anchorterminal.com/tools/mastra.md · JSON https://www.anchorterminal.com/api/v1/tools/mastra.json\n- Best agent frameworks and SDKs: https://www.anchorterminal.com/best/frameworks/index.md\n- All 171 frameworks comparisons: https://www.anchorterminal.com/compare/frameworks/index.md\n\n## Which one, for what\n\n### guilds.run (D)\n\nGood for: A person or small team that wants a standing, inspectable team of agents with schedules, shared tables and a web app, run on one machine, and is comfortable tracking main.\n\nAlso in its favour:\n- Free to start without a card\n\nWatch for: No tagged release, version number or published image on 4 November 2026. Users install whatever is on main, including breaking changes\n\n### Mastra (BB)\n\nGood for: TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.\n\nAhead on:\n- Reliability, 87 against 43\n- Schema \u0026 documentation, 98 against 58\n- Agent ergonomics, 92 against 67\n- Maintenance \u0026 community, 96 against 21\n- Transparency \u0026 trust, 72 against 60\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n\nWatch for: Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026\n\n\n## Why the edge\n\n### Maintenance \u0026 community: Mastra +75\n\n- guilds.run (21): No tagged release, version or dated changelog entry. Main, which the install clones and SECURITY.md names as the supported version, last changed on 3 November 2026 (1,072 of the commits since 14 October by one author), but commits with no version or tag aren't releases in this run (hyperqwen, brave-search-mcp), and CONTRIBUTING.md itself defines a release as a vMAJOR.MINOR.PATCH tag, so nothing has been released (0, from 20). No releases or dated changelog entries in the 90 days from 6 August (0). Issues and pull requests per the 14 October check (eight, all closed, the three issues within an hour), not re-read on 4 November (15 of 25). No published package (0). CI on every push with a frozen pnpm lockfile, and still no Dependabot configuration in the repository (6 of 10). 0 + 0 + 15 + 0 + 6 = 21.\n- Mastra (96): @mastra/core 1.82.0 on 2026-11-04 (30). 27 stable releases in the 90 days to 6 November, 8 of them since 6 October (20). 436 open issues on 6 November, all 50 newest issues commented and 24 of them closed (22). Client, MCP and store packages are current, and @mastra/mcp 1.x stays supported beside 2.x (15). Renovate and CI configured, with the newest runs on main passing (9). 30+20+22+15+9 = 96.\n\n### Reliability: Mastra +44\n\n- guilds.run (43): Read with the local-software lines, because the owner runs it. Docker with Compose is the stated requirement, and the install is a git clone of main plus ./setup.sh, which builds the images. No package, tagged release or published image exists, since the image workflow runs only on a v* tag and the remote still has none on 4 November 2026 (10 of 20, the earlier partial kept). The verify workflow runs scripts/check.sh on every push, with typecheck, lint, orchestrator, UI and web tests and a smoke test of the Compose stack, and the clone has 356 test files. GitHub's Actions pages and API answered 403 on 4 November, so the pass state on main is unread (15 of 25, down from 25 on the 14 October reading of 13 passing runs). Open issues per the 14 October check, not re-read on 4 November (18 of 25). CHANGELOG.md, added on 15 October, marks each change no impact, rebuild or breaking and CONTRIBUTING.md defines a semver tag policy, but no version has been cut (0, the earlier value kept). Not versioned or declared stable (0). 10 + 15 + 18 + 0 + 0 = 43.\n- Mastra (87): Official npm packages, Node 22.13 or newer (20). Public CI workflows for unit, store, workspace and e2e tests; on 6 November the newest runs on main (Version Packages, Trigger Cloud Integration Tests) succeeded, while the test workflows themselves run on pull requests (22). 436 open issues and 795 open issues and pull requests on 6 November from GitHub's API, with 2,077 issues opened in the 90 days to 3 November; all 50 newest had a comment and 24 were closed, with issue-triage automation (18). A changesets CHANGELOG per package, a CI gate that needs approval for any major bump and migration guides, but no written versioning policy found, and `.network()` is deprecated without a removal date (12). 1.82.0 (15). 20+22+18+12+15 = 87, up from 74 on 6 October, when GitHub couldn't be read.\n\n### Schema \u0026 documentation: Mastra +40\n\n- guilds.run (58): Framework reading. No OpenAPI document for the HTTP API. The recipe format guilds.recipe v2 rejects unknown keys, and connector manifests are validated with TypeBox at load (12 of 25). No llms.txt on docs.guilds.run (404 on 4 November). The docs are Markdown in the repository with an AGENTS.md (5 of 10). Pages state what the code does today, which page to read for which job, and the trust boundary in numbered rules (15 of 20). Tool input schemas, recipe caps and typed manifest fields (11 of 15). The getting-started walk says what you should see at each step, and the Operate page explains each startup error message (11 of 15). CHANGELOG.md (since 15 October) holds only an Unreleased section with no version or date, and the security register keeps dated history (4 of 15, the earlier partial kept). 12 + 5 + 15 + 11 + 11 + 4 = 58.\n- Mastra (98): Typed TypeScript API with a reference section (25). llms.txt with a when-to-use list and condensed instructions for coding agents (10). The docs say when to use durable agents, and point multi-agent users from `.network()` to supervisor agents (20). Tools take Zod schemas (15). Examples on every page, and MastraError with ids and categories documented, though errors are spread across pages (13). Per-package changelogs and migration guides (15).\n\n### Agent ergonomics: Mastra +25\n\n- guilds.run (67): Framework reading, scored on what it takes to run a tool-calling team with MCP. No code is needed. Three commands and a model key start a guild, and each agent is offered only the tools turned on for it (18 of 25). max_tool_calls defaults to 50 per run, max_input_tokens trims old tool results and hands off to a new run, and remaining_tool_calls is appended to each result after the platform cap (15 of 20). Runs end with named codes such as generation.max_tool_calls and workspace.full, and interrupted tool calls get an error result so the next model request is valid (13 of 20). readOnlyHint and destructiveHint are stored for each MCP tool and writing tools start Off. Startup does not replay a model call (14 of 20). Sensible defaults and a guided first-run dialog, but it is an application with an HTTP API and no SDK in any language (7 of 15). Confirmed on 4 November in the clone (max_tool_calls default 50, 200 for a new coding agent).\n- Mastra (92): An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10).\n\n### Transparency \u0026 trust: Mastra +12\n\n- guilds.run (60): AGPL-3.0-only, OSI approved (30). No privacy policy or terms. The footer still links to both and they returned 404 on 4 November 2026. The docs say where data lives (PostgreSQL and STATE_ROOT on your host), that model keys go only to their provider, and that stored credentials are encrypted under one master key in .env (12 of 30). No deprecation policy or dated notices. CHANGELOG.md marks breaking changes with steps, undated, and the security register is dated (3 of 20, the earlier partial kept). Sentry is opt-in and documented on the Configure page, and the models.dev catalogue fetch and the connector registry address are documented with their switches (18 of 20). 30 + 12 + 3 + 18 = 63.\n- Mastra (72): Apache 2.0 for the core, with ee/ directories source-available under the Mastra Enterprise License (25). The privacy policy (last published 25 April 2025) covers the website, the Teams plan states six months' retention, and the subprocessor list sits in a trust centre our reader couldn't render (15). Migration guides and deprecation warnings, without dated removal windows (12). Every telemetry stream is documented with links to its source and one opt-out, and the reference now spells out what the project identifiers can be correlated with (20).\n\n## Score by category\n\n| Category | Weight | guilds.run | Mastra | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 43 | 87 | Mastra +44 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 58 | 98 | Mastra +40 |\n| Agent ergonomics | 13% (16.2 this run) | 67 | 92 | Mastra +25 |\n| Security \u0026 auth | 14% (17.5 this run) | 68 | 67 | guilds.run +1 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 60 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 21 | 96 | Mastra +75 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 60 | 72 | Mastra +12 |\n| Negative events | ≤15 | -2 | -8 | |\n| **Total** | | **53.4 · D** | **74.2 · BB** | |\n\n## Facts side by side\n\n| Fact | guilds.run | Mastra |\n| --- | --- | --- |\n| Kind | Agent framework | Agent framework |\n| Vendor | Cigale AI | Kepler Software, Inc. |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | API key | API key |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | AGPL-3.0-only | Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| Last release | none | 2026-11-04 |\n| Terms last updated | no document linked | 2026-10-26 |\n| Privacy policy last updated | no document linked | no date given |\n| Customer content may train models | not read yet | yes |\n| Terms restrict automated access | not read yet | yes |\n| Terms restrict benchmarking | not read yet | not found in the text |\n| Terms or service can change without notice | not read yet | yes |\n| Arbitration or class-action waiver | not read yet | yes |\n| Popularity | 57 stars | 29k stars, 3.1M npm/wk |\n\n## How the scores have moved\n\n### guilds.run\n\n- -3.2 on 4 November 2026 (C to D): product, new evidence, correction\n- +0.1 on 27 October 2026: checklist\n\n### Mastra\n\nNo score change since it was listed.\n\n## Verdicts\n\n**guilds.run.** A self-hosted multi-agent system that records each run's prompt, tool calls and memory changes, with per-agent models and tools and no telemetry by default. It has no tagged release, version or package, so users track main, its own security register lists 28 open issues of 58, and the site's terms and privacy links return 404.\n\n**Mastra.** A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes.\n\n## Before you call either\n\n### guilds.run\n\n1. Keep the box on loopback or behind an authenticating proxy with AUTH_MODE=trusted-header. The default mode does not authenticate\n2. Put agents that hold different secrets or GitHub tokens on different machines. Agents on one machine can read each other's homes and tokens\n3. Back up the .env file written by ./setup.sh. It holds the only copy of the key that encrypts stored credentials\n4. Pin a commit of main when you deploy and read CHANGELOG.md's Unreleased section before pulling. Breaking changes land on main\n5. Set MODELS_DEV_URL empty for an offline box. The model catalogue is otherwise fetched from models.dev hourly\n\n### Mastra\n\n1. Set MASTRA_TELEMETRY_DISABLED=1 in every environment that runs the CLI, the server or Studio\n2. Pin exact versions with a lockfile, and make sure no 17 June 2026 release such as @mastra/core 1.42.1 is installed\n3. Set requireToolApproval on MCP servers that write, and allowedHosts when server URLs come from configuration\n4. Add PromptInjectionDetector as an input processor when tools return web or user content\n5. Use supervisor agents through generate() or stream(). `.network()` is deprecated\n\n## Questions\n\n### Which is better for AI agents, guilds.run or Mastra?\n\nMastra scores 74.2 (BB) on agent readiness against guilds.run's 53.4 (D), and leads in 5 of 7 scored categories.\n\n### Are guilds.run and Mastra open source?\n\nYes. guilds.run is open source (AGPL-3.0-only). Mastra is open source (Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/guilds-run-vs-mastra.json, and with the fewest tokens: https://www.anchorterminal.com/compare/guilds-run-vs-mastra.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"guilds-run\", \"b\": \"mastra\"}`. From a terminal: `anchor compare guilds-run mastra`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/guilds-run.json and https://www.anchorterminal.com/api/v1/tools/mastra.json\n\n## Other comparisons with guilds.run or Mastra\n\n- [AgentOS vs guilds.run](https://www.anchorterminal.com/compare/agentos-vs-guilds-run.md)\n- [AgentOS vs Mastra](https://www.anchorterminal.com/compare/agentos-vs-mastra.md)\n- [Agno vs guilds.run](https://www.anchorterminal.com/compare/agno-vs-guilds-run.md)\n- [Agno vs Mastra](https://www.anchorterminal.com/compare/agno-vs-mastra.md)\n- [BoxLang AI vs guilds.run](https://www.anchorterminal.com/compare/boxlang-ai-vs-guilds-run.md)\n- [BoxLang AI vs Mastra](https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra.md)\n- [Claude Agent SDK vs guilds.run](https://www.anchorterminal.com/compare/claude-agent-sdk-vs-guilds-run.md)\n- [Claude Agent SDK vs Mastra](https://www.anchorterminal.com/compare/claude-agent-sdk-vs-mastra.md)\n- [CrewAI vs guilds.run](https://www.anchorterminal.com/compare/crewai-vs-guilds-run.md)\n- [CrewAI vs Mastra](https://www.anchorterminal.com/compare/crewai-vs-mastra.md)\n- [Cursor Agent SDK vs guilds.run](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-guilds-run.md)\n- [Cursor Agent SDK vs Mastra](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra.md)\n- [Docker Agent vs guilds.run](https://www.anchorterminal.com/compare/docker-agent-vs-guilds-run.md)\n- [Docker Agent vs Mastra](https://www.anchorterminal.com/compare/docker-agent-vs-mastra.md)\n- [Agent Development Kit (ADK) vs guilds.run](https://www.anchorterminal.com/compare/google-adk-vs-guilds-run.md)\n- [Agent Development Kit (ADK) vs Mastra](https://www.anchorterminal.com/compare/google-adk-vs-mastra.md)\n- [guilds.run vs LangGraph](https://www.anchorterminal.com/compare/guilds-run-vs-langgraph.md)\n- [guilds.run vs LlamaIndex Framework](https://www.anchorterminal.com/compare/guilds-run-vs-llamaindex.md)\n- [guilds.run vs Microsoft Agent Framework](https://www.anchorterminal.com/compare/guilds-run-vs-microsoft-agent-framework.md)\n- [guilds.run vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/guilds-run-vs-openai-agents-sdk.md)\n- [guilds.run vs Pydantic AI](https://www.anchorterminal.com/compare/guilds-run-vs-pydantic-ai.md)\n- [guilds.run vs smolagents](https://www.anchorterminal.com/compare/guilds-run-vs-smolagents.md)\n- [guilds.run vs Strands Agents](https://www.anchorterminal.com/compare/guilds-run-vs-strands-agents.md)\n- [guilds.run vs TradingAgents](https://www.anchorterminal.com/compare/guilds-run-vs-tradingagents.md)\n- [guilds.run vs AI SDK](https://www.anchorterminal.com/compare/guilds-run-vs-vercel-ai-sdk.md)\n- [LangGraph vs Mastra](https://www.anchorterminal.com/compare/langgraph-vs-mastra.md)\n- [LlamaIndex Framework vs Mastra](https://www.anchorterminal.com/compare/llamaindex-vs-mastra.md)\n- [Mastra vs Microsoft Agent Framework](https://www.anchorterminal.com/compare/mastra-vs-microsoft-agent-framework.md)\n- [Mastra vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk.md)\n- [Mastra vs Pydantic AI](https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai.md)\n- [Mastra vs smolagents](https://www.anchorterminal.com/compare/mastra-vs-smolagents.md)\n- [Mastra vs Strands Agents](https://www.anchorterminal.com/compare/mastra-vs-strands-agents.md)\n- [Mastra vs TradingAgents](https://www.anchorterminal.com/compare/mastra-vs-tradingagents.md)\n- [Mastra vs AI SDK](https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "guilds.run vs Mastra", "url": "" } ], "description": "Mastra scores 74.2 (BB) to guilds.run's 53.4 (D) for agent frameworks. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "guilds.run D 53.4", "Mastra BB 74.2", "scores" ], "h1": "guilds.run vs Mastra", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/guilds-run-vs-mastra", "published": "2026-10-01", "section": "tools", "title": "guilds.run vs Mastra for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/guilds-run-vs-mastra" }, "tokens": { "markdown": 4550, "slim": 2480 }, "version": 1 }