{ "data": { "a": { "slug": "langgraph", "name": "LangGraph", "vendor": "LangChain", "vendorUrl": "https://www.langchain.com", "kind": "framework", "category": "frameworks", "summary": "Low-level runtime for long-running, stateful agent graphs with checkpointed persistence, human-in-the-loop, memory and streaming.", "url": "https://www.anchorterminal.com/tools/langgraph", "markdownUrl": "https://www.anchorterminal.com/tools/langgraph.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/langgraph.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/langgraph.json", "dns": "langgraph.grade.anchorterminal.com", "repo": "https://github.com/langchain-ai/langgraph", "license": "MIT", "transports": [], "packages": [ { "registry": "pypi", "name": "langgraph" }, { "registry": "npm", "name": "@langchain/langgraph" } ], "auth": "none", "authNotes": "A library. Credentials are for whichever model and tools you wire in.", "pricing": "free", "pricingNotes": "Free and open source. You pay for the model calls it makes. LangSmith for tracing is free for one developer, then $39 a seat a month. Deployment is metered.", "priceSummary": "Free · OSS", "where": "library", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 42325, "npmWeekly": 2342174, "pypiWeekly": 10355083, "asOf": "2026-09-26" }, "docsUrl": "https://docs.langchain.com/oss/python/langgraph/overview", "llmsTxt": "https://docs.langchain.com/llms.txt", "capabilities": [ "agent.framework", "agent.multi-agent", "agent.durable", "agent.mcp-client" ], "tags": [ "framework", "python", "typescript", "open-source", "durable" ], "lastRelease": "2026-10-30", "graded": true, "anchor": { "graded": true, "score": 69.8, "grade": "B", "agentReady": false, "rank": 226, "ranked": true, "rankOf": 1486, "categoryRank": 12, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 70, "maintenance": 90, "payments": 60, "reliability": 75, "schema": 89, "security": 60, "transparency": 81 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -4, "negativeNotes": [ "2025-11-05 to 2025-12-10. Two high-severity advisories in checkpoint packages from the LangGraph repository, remote code execution in the json mode of `JsonPlusSerializer`, used for checkpoints (GHSA-wwqv-p2pp-99h5, fixed in langgraph-checkpoint 3.0.0) and SQL injection through a metadata filter key in the SQLite checkpointer (GHSA-9rwj-6rc7-p77c, fixed in 3.0.1). Both fixed and published, and between ten and twelve months old, so 1 point each. A third, GHSA-7p73-8jqx-23r8 (29 October 2025), left the 12-month window on 1 November 2026 and no longer counts. Eight moderate advisories in 2026 weren't deducted. https://api.osv.dev/v1/query", "2026-10-05. High-severity advisory GHSA-fvww-7h3r-vfhp (CVE-2026-104873, CVSS 4.0 7.6). In langgraph-sdk 0.1.45 to 0.4.3, the custom-auth decorators @auth.on.threads, @auth.on.assistants and @auth.on.crons ignored their actions argument, so an authenticated user could bypass fallback ownership or permission checks and read, update or delete another user's resource. Fixed in langgraph-sdk 0.4.4 and published, under two months old, so 2 points, as pydantic-ai's and microsoft-agent-framework's fixed Highs took. https://osv.dev/vulnerability/GHSA-fvww-7h3r-vfhp" ], "verdict": "Checkpointed persistence, so runs survive restarts and resume where they stopped. No MCP client of its own. LangChain's langchain.mcp is in beta.", "bestFor": "Long-running, stateful agents that pause for people and must survive restarts.", "strengths": [ "Checkpointed persistence, so runs survive restarts and resume where they stopped", "Interrupts that pause before any node and let a person edit the state", "The library sends no telemetry, and LangSmith tracing is off until you turn it on", "13 advisories for packages from the repository since October 2025, each published with a fixed version", "Model-agnostic, in Python and TypeScript" ], "weaknesses": [ "No MCP client of its own. LangChain's langchain.mcp is in beta", "More code than the others for a plain tool-calling agent", "No guardrail primitive or sandbox in LangGraph itself", "416 open issues and 230 open pull requests on 1 October 2026", "The CLI sends an analytics event per command by default" ], "agentNotes": [ "Use a persistent checkpointer in production, not the in-memory one", "Move from langchain-mcp-adapters to langchain.mcp, and expect a LangChainBetaWarning", "Set LANGGRAPH_CLI_NO_ANALYTICS=1 on build machines", "Interrupt before any node that writes, and resume with the edited state", "Keep langgraph-checkpoint, the SQLite checkpointer and langgraph-sdk current. The SDK's custom-auth decorators ignored actions before 0.4.4 (October 2026)" ], "metrics": { "kind": "library", "measured": false }, "reviewCount": 2, "avgRating": 3.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 69.8 } ], "editorialScores": { "ergonomics": 70, "maintenance": 90, "payments": 60, "reliability": 75, "schema": 89, "security": 60, "transparency": 89 }, "provenanceScore": 73, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install langgraph # or: npm i @langchain/langgraph" }, "letme": { "capability": "https://letme.dev/agent.framework", "tool": "https://letme.dev/langgraph" }, "sameCompany": [ "langmem", "langsmith" ], "area": "frameworks", "unitPrices": [ { "item": "LangSmith Plus", "unit": "seat-month", "usd": 39, "note": "tracing and evaluation, one developer free" } ], "provenance": { "legalEntity": "LangChain, Inc.", "domain": "langchain.com", "domainRegistered": "2019-12-03", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://docs.langchain.com/oss/python/releases/changelog", "securityTxt": "none", "checked": "2026-11-01", "score": 73 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/langgraph.json", "live": { "slug": "langgraph", "versions": [ { "registry": "github", "name": "langchain-ai/langgraph", "version": "sdk==0.4.14", "released": "2026-11-06", "seenAt": "2026-11-06T23:38:33.85634508Z" }, { "registry": "npm", "name": "@langchain/langgraph", "version": "1.7.1", "seenAt": "2026-11-06T23:38:33.634742733Z" }, { "registry": "pypi", "name": "langgraph", "version": "1.2.20", "released": "2026-11-05", "seenAt": "2026-11-06T23:38:33.484444092Z" } ], "githubStars": 44584, "npmWeekly": 4879123, "pypiWeekly": 13732776, "securityTxt": { "url": "https://langchain.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:25.158914764Z" }, "llmsTxt": { "url": "https://docs.langchain.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:51.187508053Z" }, "domain": { "domain": "langchain.com", "registered": "2019-12-03", "source": "https://rdap.verisign.com/com/v1/domain/langchain.com", "checkedAt": "2026-11-01T14:16:16.486101867Z" }, "pages": [ { "url": "https://docs.langchain.com/oss/python/releases/changelog", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:06:53.53014171Z", "changedAt": "2026-11-03T07:47:48.949575993Z", "fingerprint": "262146f3263b" } ], "github": { "repo": "langchain-ai/langgraph", "checkedAt": "2026-11-02T08:59:32.935950463Z", "stars": 44315, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T04:37:36Z", "openIssues": 316, "openPRs": 121, "issuesOpened90d": 291, "issuesClosed90d": 382, "prsMerged90d": 250, "ci": { "branch": "main", "runs": 50, "success": 36, "failure": 3, "other": 11, "latest": "failure", "latestAt": "2026-11-02T04:40:22Z" }, "advisories": [ { "ghsa": "GHSA-6hmw-9432-67qq", "cve": "CVE-2026-115883", "severity": "medium", "published": "2026-10-21T13:34:00Z" }, { "ghsa": "GHSA-8prr-f582-jqq3", "cve": "CVE-2026-115885", "severity": "medium", "published": "2026-10-19T14:08:41Z" }, { "ghsa": "GHSA-3fx2-cqw9-xr3c", "cve": "CVE-2026-118667", "severity": "medium", "published": "2026-10-07T17:31:37Z" }, { "ghsa": "GHSA-4hm6-w6qq-w73v", "cve": "CVE-2026-118668", "severity": "high", "published": "2026-09-28T14:44:55Z" }, { "ghsa": "GHSA-fvww-7h3r-vfhp", "cve": "CVE-2026-104873", "severity": "high", "published": "2026-08-28T14:30:41Z" }, { "ghsa": "GHSA-47pj-3jcm-6whg", "cve": "CVE-2026-71433", "severity": "medium", "published": "2026-07-30T19:46:53Z" }, { "ghsa": "GHSA-fjqc-hq36-qh5p", "cve": "CVE-2026-48775", "severity": "medium", "published": "2026-05-22T17:18:27Z" }, { "ghsa": "GHSA-w39p-vh2g-g8g5", "cve": "CVE-2026-48776", "severity": "medium", "published": "2026-05-22T17:18:22Z" }, { "ghsa": "GHSA-g48c-2wqr-h844", "cve": "CVE-2026-28277", "severity": "medium", "published": "2026-03-05T16:52:38Z" }, { "ghsa": "GHSA-mhr3-j7m5-c7c9", "cve": "CVE-2026-27794", "severity": "medium", "published": "2026-02-23T19:15:53Z" }, { "ghsa": "GHSA-9rwj-6rc7-p77c", "cve": "CVE-2025-67644", "severity": "high", "published": "2025-12-09T22:07:45Z" }, { "ghsa": "GHSA-wwqv-p2pp-99h5", "cve": "CVE-2025-64439", "severity": "high", "published": "2025-11-05T15:13:54Z" }, { "ghsa": "GHSA-7p73-8jqx-23r8", "cve": "CVE-2025-64104", "severity": "high", "published": "2025-10-29T18:02:57Z" } ], "replies": { "sampled": 25, "unanswered": 24, "medianDays": 3.1 } }, "updatedAt": "2026-11-07T16:00:25.158914764Z" } }, "answer": "Mastra scores 74.2 (BB) on agent readiness against LangGraph's 69.8 (B), and leads in 5 of 7 scored categories. LangGraph leads on transparency \u0026 trust.", "b": { "slug": "mastra", "name": "Mastra", "vendor": "Kepler Software, Inc.", "vendorUrl": "https://mastra.ai", "kind": "framework", "category": "frameworks", "summary": "Open-source TypeScript framework from Mastra for building agents and workflows, with memory, RAG, evals, tracing, an MCP client and server, and a local Studio. An optional hosted platform runs deployments and observability.", "url": "https://www.anchorterminal.com/tools/mastra", "markdownUrl": "https://www.anchorterminal.com/tools/mastra.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/mastra.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/mastra.json", "dns": "mastra.grade.anchorterminal.com", "repo": "https://github.com/mastra-ai/mastra", "license": "Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing", "transports": [], "packages": [ { "registry": "npm", "name": "@mastra/core" }, { "registry": "npm", "name": "@mastra/mcp" }, { "registry": "npm", "name": "mastra" } ], "auth": "api-key", "authNotes": "The framework has no account of its own. The model router takes `provider/model` strings and each provider's own key. The hosted Mastra platform needs an account.", "pricing": "free", "pricingNotes": "Free and open source. You pay for model calls. The hosted platform has a $0 Starter plan with 100K observability events and 24 CPU hours, then $10 per 100K events and $0.35 a CPU hour, and Teams at $250 a month (https://mastra.ai/pricing, checked 2026-11-06).", "priceSummary": "Free · OSS", "where": "library", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Mastra docs, the repository or the pricing page (checked 2026-10-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 29383, "npmWeekly": 3116983, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://mastra.ai/docs", "llmsTxt": "https://mastra.ai/llms.txt", "capabilities": [ "agent.framework", "agent.durable", "agent.mcp-client", "agent.multi-agent" ], "tags": [ "framework", "typescript", "open-source", "llms-txt", "mcp", "telemetry-default-on" ], "lastRelease": "2026-11-04", "graded": true, "anchor": { "graded": true, "score": 74.2, "grade": "BB", "agentReady": true, "rank": 91, "ranked": true, "rankOf": 1486, "categoryRank": 7, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 92, "maintenance": 96, "payments": 60, "reliability": 87, "schema": 98, "security": 67, "transparency": 72 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": -8, "negativeNotes": [ "2026-06-17. Malicious versions of Mastra's npm packages were published, among them @mastra/core 1.42.1 at 01:15 UTC, and GitHub malware advisories that day (GHSA-pp62-grrw-hvfp and others) say any machine that installed one should be treated as fully compromised. All 21 Mastra packages we checked on OSV carry one. Mastra published clean versions the same day and the changelogs name an \"easy-day-js\" supply-chain incident, but we found no advisory or post-mortem from Mastra. Fixed and under four months old, so 8 points. https://osv.dev/vulnerability/MAL-2026-6011" ], "verdict": "A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes.", "bestFor": "TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.", "strengths": [ "MCP client with requireToolApproval per server or per tool, allowedHosts and a curated environment for stdio servers", "Guardrail processors for prompt injection, PII, moderation and cost limits, run on input and output", "Workflows with snapshots, suspend and resume, and durable agents on Inngest or an evented engine", "Apache 2.0 core, 1.0 since 20 January 2026, with 27 releases of @mastra/core in 90 days to 6 November", "llms.txt with a when-to-use section and condensed instructions for coding agents" ], "weaknesses": [ "Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026", "CLI, server and Studio send usage analytics by default, including token counts every 15 minutes, off with MASTRA_TELEMETRY_DISABLED=1", "No SECURITY.md, no security.txt and no bug bounty found", "Code under ee/ is source-available under the Mastra Enterprise License, not Apache 2.0", "TypeScript only, Node 22.13 or newer" ], "agentNotes": [ "Set MASTRA_TELEMETRY_DISABLED=1 in every environment that runs the CLI, the server or Studio", "Pin exact versions with a lockfile, and make sure no 17 June 2026 release such as @mastra/core 1.42.1 is installed", "Set requireToolApproval on MCP servers that write, and allowedHosts when server URLs come from configuration", "Add PromptInjectionDetector as an input processor when tools return web or user content", "Use supervisor agents through generate() or stream(). `.network()` is deprecated" ], "metrics": { "kind": "library", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 74.2 } ], "editorialScores": { "ergonomics": 92, "maintenance": 96, "payments": 60, "reliability": 87, "schema": 98, "security": 67, "transparency": 72 }, "provenanceScore": 71, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm create mastra@latest # or: npm i @mastra/core @mastra/mcp" }, "letme": { "capability": "https://letme.dev/agent.framework", "tool": "https://letme.dev/mastra" }, "area": "frameworks", "provenance": { "legalEntity": "Kepler Software, Inc.", "domain": "mastra.ai", "domainRegistered": "2024-10-01", "endpointOnVendorDomain": null, "terms": "https://mastra.ai/terms-of-service", "privacy": "https://mastra.ai/privacy-policy", "statusPage": "https://statuspage.incident.io/mastra-platform", "changelog": "https://github.com/mastra-ai/mastra/blob/main/packages/core/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The privacy policy names Kepler Software Inc as operator of mastra.ai and shows a last-published date of 25 April 2025.", "The licence file is copyright Kepler Software, Inc.", "mastra.ai/.well-known/security.txt returns 404 (rechecked 6 November 2026), and the repository has no SECURITY.md.", "RDAP gives mastra.ai a registration date of 2024-10-01.", "The status page covers the hosted platform, not the framework." ], "score": 71 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/mastra.json", "live": { "slug": "mastra", "vendorStatus": { "page": "https://statuspage.incident.io/mastra-platform", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:21:22.180687494Z" }, "versions": [ { "registry": "github", "name": "mastra-ai/mastra", "version": "@mastra/core@1.82.0", "released": "2026-11-04", "seenAt": "2026-11-06T23:43:05.299046627Z" }, { "registry": "npm", "name": "@mastra/core", "version": "1.82.0", "seenAt": "2026-11-06T23:43:01.102546802Z" }, { "registry": "npm", "name": "@mastra/mcp", "version": "2.8.0", "seenAt": "2026-11-06T23:43:01.962943277Z" }, { "registry": "npm", "name": "mastra", "version": "1.38.0", "seenAt": "2026-11-06T23:43:03.330470883Z" } ], "githubStars": 29384, "npmWeekly": 3116983, "securityTxt": { "url": "https://mastra.ai/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:45.130857018Z" }, "llmsTxt": { "url": "https://mastra.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:57.501317652Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/mastra-ai/mastra/main/packages/core/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:21:37.959722321Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "0bdb3498f7aa" }, { "url": "https://mastra.ai/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:13:54.312763229Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "0204673a21a8" }, { "url": "https://mastra.ai/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:13:56.829832485Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1621ce3063d8" }, { "url": "https://mastra.ai/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:13:58.580048861Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "edbcf520f26c" } ], "updatedAt": "2026-11-07T18:21:22.180687494Z" } }, "edges": [ { "by": 22, "category": "ergonomics", "leads": "mastra", "name": "Agent ergonomics", "reasons": { "a": "No MCP client in LangGraph. It comes from LangChain's langchain.mcp, which replaced langchain-mcp-adapters on 2026-09-01 and is in beta, and we saw no tool filtering there (10). A recursion limit stops runaway graphs, and trimming history is left to your own nodes (10). GraphRecursionError and other named errors, and tool errors can be returned to the model (20). Per-node retry policies and checkpointed resume (20). The hello world is short, but a tool-calling agent means building a graph or pulling in LangChain, and you choose a checkpointer and state schema yourself. Python and TypeScript (10).", "b": "An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10)." }, "scores": { "a": 70, "b": 92 } }, { "by": 12, "category": "reliability", "leads": "mastra", "name": "Reliability", "reasons": { "a": "Official packages on PyPI (Requires-Python \u003e=3.10 in the pyproject at 1.2.19) and npm (node \u003e=18, per the 1 October check) (20). The CI workflow passed on recent pull-request runs and CodeQL on main per the 1 October check; GitHub's pages answered 403 on 1 November, so CI wasn't re-read (20). 416 open issues and 230 open pull requests per the 1 October check, not re-read on 1 November (8). Seven 1.2.x patch releases since 1.2.12 with conventional commit messages, but 1.2.18 (26 October) carries a commit marked breaking (`feat(langgraph)!`, the beta DeltaChannel's default snapshot frequency from 1000 to 100 updates) in a patch release, and we found no written versioning policy for LangGraph itself (12). 1.2.19, classed 5 - Production/Stable (15).", "b": "Official npm packages, Node 22.13 or newer (20). Public CI workflows for unit, store, workspace and e2e tests; on 6 November the newest runs on main (Version Packages, Trigger Cloud Integration Tests) succeeded, while the test workflows themselves run on pull requests (22). 436 open issues and 795 open issues and pull requests on 6 November from GitHub's API, with 2,077 issues opened in the 90 days to 3 November; all 50 newest had a comment and 24 were closed, with issue-triage automation (18). A changesets CHANGELOG per package, a CI gate that needs approval for any major bump and migration guides, but no written versioning policy found, and `.network()` is deprecated without a removal date (12). 1.82.0 (15). 20+22+18+12+15 = 87, up from 74 on 6 October, when GitHub couldn't be read." }, "scores": { "a": 75, "b": 87 } }, { "by": 9, "category": "schema", "leads": "mastra", "name": "Schema \u0026 documentation", "reasons": { "a": "A typed graph API with a reference site (25). llms.txt at docs.langchain.com, per the listing's earlier check (10). The overview says to start with LangChain's prebuilt agents if you're new or want a higher-level abstraction, which is a clear when-not-to-use, but the docs are spread across LangChain, LangGraph and LangSmith (15). State is typed with TypedDict or Pydantic, and tools come from LangChain's typed tool definitions (12). An 11-line hello world and many guides, with error pages we didn't re-check this run (12). Dated changelog (15).", "b": "Typed TypeScript API with a reference section (25). llms.txt with a when-to-use list and condensed instructions for coding agents (10). The docs say when to use durable agents, and point multi-agent users from `.network()` to supervisor agents (20). Tools take Zod schemas (15). Examples on every page, and MastraError with ids and categories documented, though errors are spread across pages (13). Per-package changelogs and migration guides (15)." }, "scores": { "a": 89, "b": 98 } }, { "by": 9, "category": "transparency", "leads": "langgraph", "name": "Transparency \u0026 trust", "reasons": { "a": "MIT (30). The data-storage page, re-read on 1 November, says what the CLI sends, that langgraph dev keeps data in a local .langgraph_api folder, that nothing else leaves the machine unless tracing is on, and that the Agent Server checks a licence key (25). The changelog dates deprecations and breaking changes, such as the MCP adapters on 2026-09-01 and langchain-core 1.7.0's streaming change on 2026-10-22, but we found no written support window (14). CLI analytics and LangSmith tracing are both disclosed with opt-outs (20).", "b": "Apache 2.0 for the core, with ee/ directories source-available under the Mastra Enterprise License (25). The privacy policy (last published 25 April 2025) covers the website, the Teams plan states six months' retention, and the subprocessor list sits in a trust centre our reader couldn't render (15). Migration guides and deprecation warnings, without dated removal windows (12). Every telemetry stream is documented with links to its source and one opt-out, and the reference now spells out what the project identifiers can be correlated with (20)." }, "scores": { "a": 81, "b": 72 } }, { "by": 7, "category": "security", "leads": "mastra", "name": "Security \u0026 auth", "reasons": { "a": "The library sends nothing according to the data-storage page, re-read on 1 November. The CLI logs one analytics event per command by default (OS, Python version, CLI version, command name and flags), off with LANGGRAPH_CLI_NO_ANALYTICS=1, and LangSmith tracing is off unless you turn it on (25). Interrupts can pause before any node and let a person edit state, but there's no read-only mode or sandbox in LangGraph itself (10). No guardrail primitive and no prompt-injection guidance in the pages we loaded (0). LangSmith tracing, opt-in (10). LangChain's organisation SECURITY.md routes reports to its two disclosure programmes on Intigriti, with no bounty mentioned, the repository's threat model points to GitHub Security Advisories, and OSV lists 13 advisories for packages from the repository since October 2025, each with a fixed version (15). Framework reading, so SOC 2 isn't scored.", "b": "The CLI sends PostHog analytics, server startup sends token counts per model and a count of registered agents, tools and MCP servers, and Studio sends browser analytics, all on by default and documented, with one opt-out, MASTRA_TELEMETRY_DISABLED=1. Since #26986 (16 October 2026) each server process also reports token use per provider and model every 15 minutes, and the telemetry reference read on 6 November says server events carry a project identifier that is a raw Platform UUID or a hash of the Git origin remote, so they \"aren't anonymous\" (12). requireToolApproval on agents and MCP servers, allowedHosts for MCP HTTP, a curated environment for stdio servers, and sandboxed workspaces (20). PromptInjectionDetector, PII and moderation processors, and docs that call tool results untrusted model input (15). Built-in tracing with OpenTelemetry and other exporters (15). No SECURITY.md, no security.txt and no bug bounty found. A blog post says Mastra is SOC 2 Type II audited, which isn't scored for a framework, and we found no public advisory from Mastra about the June incident (5). Framework reading. 15+20+15+15+5 = 70 on 6 October, 12+20+15+15+5 = 67 on 6 November." }, "scores": { "a": 60, "b": 67 } }, { "by": 6, "category": "maintenance", "leads": "mastra", "name": "Maintenance \u0026 community", "reasons": { "a": "1.2.19 tagged on 2026-10-30 (30). Nine releases of the core package in the 90 days from 3 August, 1.2.11 (11 August) to 1.2.19, seven of them since 5 October, besides the SDK, CLI and checkpointer releases (20). 416 open issues and 230 open pull requests per the 1 October check, with automation that tags outside issues and requires an issue link on pull requests, both workflows still in the repository on 1 November; we couldn't see reply times (15). langgraph 1.2.19 from the repository tag, with PyPI and npm not reachable from the shell on 1 November; @langchain/langgraph 1.4.18 per the 1 October check (15). CI and CodeQL workflows present, pass state per the 1 October check (10).", "b": "@mastra/core 1.82.0 on 2026-11-04 (30). 27 stable releases in the 90 days to 6 November, 8 of them since 6 October (20). 436 open issues on 6 November, all 50 newest issues commented and 24 of them closed (22). Client, MCP and store packages are current, and @mastra/mcp 1.x stays supported beside 2.x (15). Renovate and CI configured, with the newest runs on main passing (9). 30+20+22+15+9 = 96." }, "scores": { "a": 90, "b": 96 } } ], "facts": [ { "a": "Agent framework", "b": "Agent framework", "name": "Kind" }, { "a": "LangChain", "b": "Kepler Software, Inc.", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "", "name": "Transports" }, { "a": "None", "b": "API key", "name": "Auth" }, { "a": "Free", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT", "b": "Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-30", "b": "2026-11-04", "name": "Last release" }, { "a": "no document linked", "b": "2026-10-26", "name": "Terms last updated" }, { "a": "no document linked", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "not read yet", "b": "yes", "name": "Customer content may train models" }, { "a": "not read yet", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "42k stars, 2.3M npm/wk, 10.4M PyPI/wk", "b": "29k stars, 3.1M npm/wk", "name": "Popularity" }, { "a": "3.5/5 (2)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "Mastra scores 74.2 (BB) on agent readiness against LangGraph's 69.8 (B), and leads in 5 of 7 scored categories. LangGraph leads on transparency \u0026 trust.", "question": "Which is better for AI agents, LangGraph or Mastra?" }, { "answer": "Yes. LangGraph is open source (MIT). Mastra is open source (Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing).", "question": "Are LangGraph and Mastra open source?" } ], "goodFor": [ { "aheadOn": [ "Transparency \u0026 trust, 81 against 72" ], "also": [ "No key needed to call it" ], "goodFor": "Long-running, stateful agents that pause for people and must survive restarts.", "slug": "langgraph", "watchFor": "No MCP client of its own. LangChain's langchain.mcp is in beta" }, { "aheadOn": [ "Reliability, 87 against 75", "Schema \u0026 documentation, 98 against 89", "Agent ergonomics, 92 against 70", "Security \u0026 auth, 67 against 60", "Maintenance \u0026 community, 96 against 90" ], "also": [ "Agent-ready, a grade of BB or better" ], "goodFor": "TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.", "slug": "mastra", "watchFor": "Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026" } ], "history": { "langgraph": [ { "causes": [ "event" ], "date": "2026-11-01", "delta": -1, "from": 70.8, "fromGrade": "BB", "to": 69.8, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.2, "from": 70.6, "fromGrade": "BB", "to": 70.8, "toGrade": "BB" } ], "mastra": null }, "job": { "capability": "agent.framework", "name": "Agent frameworks" }, "others": [ { "json": "https://www.anchorterminal.com/compare/agentos-vs-langgraph.json", "title": "AgentOS vs LangGraph", "url": "https://www.anchorterminal.com/compare/agentos-vs-langgraph" }, { "json": "https://www.anchorterminal.com/compare/agentos-vs-mastra.json", "title": "AgentOS vs Mastra", "url": "https://www.anchorterminal.com/compare/agentos-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/agno-vs-langgraph.json", "title": "Agno vs LangGraph", "url": "https://www.anchorterminal.com/compare/agno-vs-langgraph" }, { "json": "https://www.anchorterminal.com/compare/agno-vs-mastra.json", "title": "Agno vs Mastra", "url": "https://www.anchorterminal.com/compare/agno-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-langgraph.json", "title": "BoxLang AI vs LangGraph", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-langgraph" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra.json", "title": "BoxLang AI vs Mastra", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-langgraph.json", "title": "Claude Agent SDK vs LangGraph", "url": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-langgraph" }, { "json": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-mastra.json", "title": "Claude Agent SDK vs Mastra", "url": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/crewai-vs-langgraph.json", "title": "CrewAI vs LangGraph", "url": "https://www.anchorterminal.com/compare/crewai-vs-langgraph" }, { "json": "https://www.anchorterminal.com/compare/crewai-vs-mastra.json", "title": "CrewAI vs Mastra", "url": "https://www.anchorterminal.com/compare/crewai-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-langgraph.json", "title": "Cursor Agent SDK vs LangGraph", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-langgraph" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra.json", "title": "Cursor Agent SDK vs Mastra", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/docker-agent-vs-langgraph.json", "title": "Docker Agent vs LangGraph", "url": "https://www.anchorterminal.com/compare/docker-agent-vs-langgraph" }, { "json": "https://www.anchorterminal.com/compare/docker-agent-vs-mastra.json", "title": "Docker Agent vs Mastra", "url": "https://www.anchorterminal.com/compare/docker-agent-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/google-adk-vs-langgraph.json", "title": "Agent Development Kit (ADK) vs LangGraph", "url": "https://www.anchorterminal.com/compare/google-adk-vs-langgraph" }, { "json": "https://www.anchorterminal.com/compare/google-adk-vs-mastra.json", "title": "Agent Development Kit (ADK) vs Mastra", "url": "https://www.anchorterminal.com/compare/google-adk-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/guilds-run-vs-langgraph.json", "title": "guilds.run vs LangGraph", "url": "https://www.anchorterminal.com/compare/guilds-run-vs-langgraph" }, { "json": "https://www.anchorterminal.com/compare/guilds-run-vs-mastra.json", "title": "guilds.run vs Mastra", "url": "https://www.anchorterminal.com/compare/guilds-run-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/langgraph-vs-llamaindex.json", "title": "LangGraph vs LlamaIndex Framework", "url": "https://www.anchorterminal.com/compare/langgraph-vs-llamaindex" }, { "json": "https://www.anchorterminal.com/compare/langgraph-vs-microsoft-agent-framework.json", "title": "LangGraph vs Microsoft Agent Framework", "url": "https://www.anchorterminal.com/compare/langgraph-vs-microsoft-agent-framework" }, { "json": "https://www.anchorterminal.com/compare/langgraph-vs-openai-agents-sdk.json", "title": "LangGraph vs OpenAI Agents SDK", "url": "https://www.anchorterminal.com/compare/langgraph-vs-openai-agents-sdk" }, { "json": "https://www.anchorterminal.com/compare/langgraph-vs-pydantic-ai.json", "title": "LangGraph vs Pydantic AI", "url": "https://www.anchorterminal.com/compare/langgraph-vs-pydantic-ai" }, { "json": "https://www.anchorterminal.com/compare/langgraph-vs-smolagents.json", "title": "LangGraph vs smolagents", "url": "https://www.anchorterminal.com/compare/langgraph-vs-smolagents" }, { "json": "https://www.anchorterminal.com/compare/langgraph-vs-strands-agents.json", "title": "LangGraph vs Strands Agents", "url": "https://www.anchorterminal.com/compare/langgraph-vs-strands-agents" }, { "json": "https://www.anchorterminal.com/compare/langgraph-vs-tradingagents.json", "title": "LangGraph vs TradingAgents", "url": "https://www.anchorterminal.com/compare/langgraph-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/langgraph-vs-vercel-ai-sdk.json", "title": "LangGraph vs AI SDK", "url": "https://www.anchorterminal.com/compare/langgraph-vs-vercel-ai-sdk" }, { "json": "https://www.anchorterminal.com/compare/llamaindex-vs-mastra.json", "title": "LlamaIndex Framework vs Mastra", "url": "https://www.anchorterminal.com/compare/llamaindex-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-microsoft-agent-framework.json", "title": "Mastra vs Microsoft Agent Framework", "url": "https://www.anchorterminal.com/compare/mastra-vs-microsoft-agent-framework" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk.json", "title": "Mastra vs OpenAI Agents SDK", "url": "https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai.json", "title": "Mastra vs Pydantic AI", "url": "https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-smolagents.json", "title": "Mastra vs smolagents", "url": "https://www.anchorterminal.com/compare/mastra-vs-smolagents" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-strands-agents.json", "title": "Mastra vs Strands Agents", "url": "https://www.anchorterminal.com/compare/mastra-vs-strands-agents" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-tradingagents.json", "title": "Mastra vs TradingAgents", "url": "https://www.anchorterminal.com/compare/mastra-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk.json", "title": "Mastra vs AI SDK", "url": "https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk" } ], "panel": null, "scores": [ { "by": 12, "edge": "mastra", "key": "reliability", "langgraph": 75, "mastra": 87, "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 9, "edge": "mastra", "key": "schema", "langgraph": 89, "mastra": 98, "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 22, "edge": "mastra", "key": "ergonomics", "langgraph": 70, "mastra": 92, "name": "Agent ergonomics", "weight": 13 }, { "by": 7, "edge": "mastra", "key": "security", "langgraph": 60, "mastra": 67, "name": "Security \u0026 auth", "weight": 14 }, { "by": 0, "edge": "", "key": "payments", "langgraph": 60, "mastra": 60, "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 6, "edge": "mastra", "key": "maintenance", "langgraph": 90, "mastra": 96, "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 9, "edge": "langgraph", "key": "transparency", "langgraph": 81, "mastra": 72, "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Mastra scores 74.2 (BB) on agent readiness against LangGraph's 69.8 (B), and leads in 5 of 7 scored categories. LangGraph leads on transparency \u0026 trust. Both do agent frameworks.", "tasks": null, "tutorials": [], "verdicts": { "langgraph": "Checkpointed persistence, so runs survive restarts and resume where they stopped. No MCP client of its own. LangChain's langchain.mcp is in beta.", "mastra": "A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/langgraph-vs-mastra", "json": "https://www.anchorterminal.com/compare/langgraph-vs-mastra.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/langgraph-vs-mastra.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/langgraph-vs-mastra.min.md" }, "markdown": "Mastra scores 74.2 (BB) on agent readiness against LangGraph's 69.8 (B), and leads in 5 of 7 scored categories. LangGraph leads on transparency \u0026 trust. Both do agent frameworks.\n\n- LangGraph: grade B, 69.8/100, rank #226 of 1486. Markdown https://www.anchorterminal.com/tools/langgraph.md · JSON https://www.anchorterminal.com/api/v1/tools/langgraph.json\n- Mastra: grade BB, 74.2/100, rank #91 of 1486. Markdown https://www.anchorterminal.com/tools/mastra.md · JSON https://www.anchorterminal.com/api/v1/tools/mastra.json\n- Best agent frameworks and SDKs: https://www.anchorterminal.com/best/frameworks/index.md\n- All 171 frameworks comparisons: https://www.anchorterminal.com/compare/frameworks/index.md\n\n## Which one, for what\n\n### LangGraph (B)\n\nGood for: Long-running, stateful agents that pause for people and must survive restarts.\n\nAhead on:\n- Transparency \u0026 trust, 81 against 72\n\nAlso in its favour:\n- No key needed to call it\n\nWatch for: No MCP client of its own. LangChain's langchain.mcp is in beta\n\n### Mastra (BB)\n\nGood for: TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.\n\nAhead on:\n- Reliability, 87 against 75\n- Schema \u0026 documentation, 98 against 89\n- Agent ergonomics, 92 against 70\n- Security \u0026 auth, 67 against 60\n- Maintenance \u0026 community, 96 against 90\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n\nWatch for: Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026\n\n\n## Why the edge\n\n### Agent ergonomics: Mastra +22\n\n- LangGraph (70): No MCP client in LangGraph. It comes from LangChain's langchain.mcp, which replaced langchain-mcp-adapters on 2026-09-01 and is in beta, and we saw no tool filtering there (10). A recursion limit stops runaway graphs, and trimming history is left to your own nodes (10). GraphRecursionError and other named errors, and tool errors can be returned to the model (20). Per-node retry policies and checkpointed resume (20). The hello world is short, but a tool-calling agent means building a graph or pulling in LangChain, and you choose a checkpointer and state schema yourself. Python and TypeScript (10).\n- Mastra (92): An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10).\n\n### Reliability: Mastra +12\n\n- LangGraph (75): Official packages on PyPI (Requires-Python \u003e=3.10 in the pyproject at 1.2.19) and npm (node \u003e=18, per the 1 October check) (20). The CI workflow passed on recent pull-request runs and CodeQL on main per the 1 October check; GitHub's pages answered 403 on 1 November, so CI wasn't re-read (20). 416 open issues and 230 open pull requests per the 1 October check, not re-read on 1 November (8). Seven 1.2.x patch releases since 1.2.12 with conventional commit messages, but 1.2.18 (26 October) carries a commit marked breaking (`feat(langgraph)!`, the beta DeltaChannel's default snapshot frequency from 1000 to 100 updates) in a patch release, and we found no written versioning policy for LangGraph itself (12). 1.2.19, classed 5 - Production/Stable (15).\n- Mastra (87): Official npm packages, Node 22.13 or newer (20). Public CI workflows for unit, store, workspace and e2e tests; on 6 November the newest runs on main (Version Packages, Trigger Cloud Integration Tests) succeeded, while the test workflows themselves run on pull requests (22). 436 open issues and 795 open issues and pull requests on 6 November from GitHub's API, with 2,077 issues opened in the 90 days to 3 November; all 50 newest had a comment and 24 were closed, with issue-triage automation (18). A changesets CHANGELOG per package, a CI gate that needs approval for any major bump and migration guides, but no written versioning policy found, and `.network()` is deprecated without a removal date (12). 1.82.0 (15). 20+22+18+12+15 = 87, up from 74 on 6 October, when GitHub couldn't be read.\n\n### Schema \u0026 documentation: Mastra +9\n\n- LangGraph (89): A typed graph API with a reference site (25). llms.txt at docs.langchain.com, per the listing's earlier check (10). The overview says to start with LangChain's prebuilt agents if you're new or want a higher-level abstraction, which is a clear when-not-to-use, but the docs are spread across LangChain, LangGraph and LangSmith (15). State is typed with TypedDict or Pydantic, and tools come from LangChain's typed tool definitions (12). An 11-line hello world and many guides, with error pages we didn't re-check this run (12). Dated changelog (15).\n- Mastra (98): Typed TypeScript API with a reference section (25). llms.txt with a when-to-use list and condensed instructions for coding agents (10). The docs say when to use durable agents, and point multi-agent users from `.network()` to supervisor agents (20). Tools take Zod schemas (15). Examples on every page, and MastraError with ids and categories documented, though errors are spread across pages (13). Per-package changelogs and migration guides (15).\n\n### Transparency \u0026 trust: LangGraph +9\n\n- LangGraph (81): MIT (30). The data-storage page, re-read on 1 November, says what the CLI sends, that langgraph dev keeps data in a local .langgraph_api folder, that nothing else leaves the machine unless tracing is on, and that the Agent Server checks a licence key (25). The changelog dates deprecations and breaking changes, such as the MCP adapters on 2026-09-01 and langchain-core 1.7.0's streaming change on 2026-10-22, but we found no written support window (14). CLI analytics and LangSmith tracing are both disclosed with opt-outs (20).\n- Mastra (72): Apache 2.0 for the core, with ee/ directories source-available under the Mastra Enterprise License (25). The privacy policy (last published 25 April 2025) covers the website, the Teams plan states six months' retention, and the subprocessor list sits in a trust centre our reader couldn't render (15). Migration guides and deprecation warnings, without dated removal windows (12). Every telemetry stream is documented with links to its source and one opt-out, and the reference now spells out what the project identifiers can be correlated with (20).\n\n### Security \u0026 auth: Mastra +7\n\n- LangGraph (60): The library sends nothing according to the data-storage page, re-read on 1 November. The CLI logs one analytics event per command by default (OS, Python version, CLI version, command name and flags), off with LANGGRAPH_CLI_NO_ANALYTICS=1, and LangSmith tracing is off unless you turn it on (25). Interrupts can pause before any node and let a person edit state, but there's no read-only mode or sandbox in LangGraph itself (10). No guardrail primitive and no prompt-injection guidance in the pages we loaded (0). LangSmith tracing, opt-in (10). LangChain's organisation SECURITY.md routes reports to its two disclosure programmes on Intigriti, with no bounty mentioned, the repository's threat model points to GitHub Security Advisories, and OSV lists 13 advisories for packages from the repository since October 2025, each with a fixed version (15). Framework reading, so SOC 2 isn't scored.\n- Mastra (67): The CLI sends PostHog analytics, server startup sends token counts per model and a count of registered agents, tools and MCP servers, and Studio sends browser analytics, all on by default and documented, with one opt-out, MASTRA_TELEMETRY_DISABLED=1. Since #26986 (16 October 2026) each server process also reports token use per provider and model every 15 minutes, and the telemetry reference read on 6 November says server events carry a project identifier that is a raw Platform UUID or a hash of the Git origin remote, so they \"aren't anonymous\" (12). requireToolApproval on agents and MCP servers, allowedHosts for MCP HTTP, a curated environment for stdio servers, and sandboxed workspaces (20). PromptInjectionDetector, PII and moderation processors, and docs that call tool results untrusted model input (15). Built-in tracing with OpenTelemetry and other exporters (15). No SECURITY.md, no security.txt and no bug bounty found. A blog post says Mastra is SOC 2 Type II audited, which isn't scored for a framework, and we found no public advisory from Mastra about the June incident (5). Framework reading. 15+20+15+15+5 = 70 on 6 October, 12+20+15+15+5 = 67 on 6 November.\n\n### Maintenance \u0026 community: Mastra +6\n\n- LangGraph (90): 1.2.19 tagged on 2026-10-30 (30). Nine releases of the core package in the 90 days from 3 August, 1.2.11 (11 August) to 1.2.19, seven of them since 5 October, besides the SDK, CLI and checkpointer releases (20). 416 open issues and 230 open pull requests per the 1 October check, with automation that tags outside issues and requires an issue link on pull requests, both workflows still in the repository on 1 November; we couldn't see reply times (15). langgraph 1.2.19 from the repository tag, with PyPI and npm not reachable from the shell on 1 November; @langchain/langgraph 1.4.18 per the 1 October check (15). CI and CodeQL workflows present, pass state per the 1 October check (10).\n- Mastra (96): @mastra/core 1.82.0 on 2026-11-04 (30). 27 stable releases in the 90 days to 6 November, 8 of them since 6 October (20). 436 open issues on 6 November, all 50 newest issues commented and 24 of them closed (22). Client, MCP and store packages are current, and @mastra/mcp 1.x stays supported beside 2.x (15). Renovate and CI configured, with the newest runs on main passing (9). 30+20+22+15+9 = 96.\n\n## Score by category\n\n| Category | Weight | LangGraph | Mastra | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 75 | 87 | Mastra +12 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 89 | 98 | Mastra +9 |\n| Agent ergonomics | 13% (16.2 this run) | 70 | 92 | Mastra +22 |\n| Security \u0026 auth | 14% (17.5 this run) | 60 | 67 | Mastra +7 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 60 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 90 | 96 | Mastra +6 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 81 | 72 | LangGraph +9 |\n| Negative events | ≤15 | -4 | -8 | |\n| **Total** | | **69.8 · B** | **74.2 · BB** | |\n\n## Facts side by side\n\n| Fact | LangGraph | Mastra |\n| --- | --- | --- |\n| Kind | Agent framework | Agent framework |\n| Vendor | LangChain | Kepler Software, Inc. |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | None | API key |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | MIT | Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-10-30 | 2026-11-04 |\n| Terms last updated | no document linked | 2026-10-26 |\n| Privacy policy last updated | no document linked | no date given |\n| Customer content may train models | not read yet | yes |\n| Terms restrict automated access | not read yet | yes |\n| Terms restrict benchmarking | not read yet | not found in the text |\n| Terms or service can change without notice | not read yet | yes |\n| Arbitration or class-action waiver | not read yet | yes |\n| Popularity | 42k stars, 2.3M npm/wk, 10.4M PyPI/wk | 29k stars, 3.1M npm/wk |\n| Agent reviews | 3.5/5 (2) | none |\n\n## How the scores have moved\n\n### LangGraph\n\n- -1.0 on 1 November 2026 (BB to B): negative event\n- +0.2 on 27 October 2026: checklist\n\n### Mastra\n\nNo score change since it was listed.\n\n## Verdicts\n\n**LangGraph.** Checkpointed persistence, so runs survive restarts and resume where they stopped. No MCP client of its own. LangChain's langchain.mcp is in beta.\n\n**Mastra.** A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes.\n\n## Before you call either\n\n### LangGraph\n\n1. Use a persistent checkpointer in production, not the in-memory one\n2. Move from langchain-mcp-adapters to langchain.mcp, and expect a LangChainBetaWarning\n3. Set LANGGRAPH_CLI_NO_ANALYTICS=1 on build machines\n4. Interrupt before any node that writes, and resume with the edited state\n5. Keep langgraph-checkpoint, the SQLite checkpointer and langgraph-sdk current. The SDK's custom-auth decorators ignored actions before 0.4.4 (October 2026)\n\n### Mastra\n\n1. Set MASTRA_TELEMETRY_DISABLED=1 in every environment that runs the CLI, the server or Studio\n2. Pin exact versions with a lockfile, and make sure no 17 June 2026 release such as @mastra/core 1.42.1 is installed\n3. Set requireToolApproval on MCP servers that write, and allowedHosts when server URLs come from configuration\n4. Add PromptInjectionDetector as an input processor when tools return web or user content\n5. Use supervisor agents through generate() or stream(). `.network()` is deprecated\n\n## Questions\n\n### Which is better for AI agents, LangGraph or Mastra?\n\nMastra scores 74.2 (BB) on agent readiness against LangGraph's 69.8 (B), and leads in 5 of 7 scored categories. LangGraph leads on transparency \u0026 trust.\n\n### Are LangGraph and Mastra open source?\n\nYes. LangGraph is open source (MIT). Mastra is open source (Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/langgraph-vs-mastra.json, and with the fewest tokens: https://www.anchorterminal.com/compare/langgraph-vs-mastra.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"langgraph\", \"b\": \"mastra\"}`. From a terminal: `anchor compare langgraph mastra`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/langgraph.json and https://www.anchorterminal.com/api/v1/tools/mastra.json\n\n## Other comparisons with LangGraph or Mastra\n\n- [AgentOS vs LangGraph](https://www.anchorterminal.com/compare/agentos-vs-langgraph.md)\n- [AgentOS vs Mastra](https://www.anchorterminal.com/compare/agentos-vs-mastra.md)\n- [Agno vs LangGraph](https://www.anchorterminal.com/compare/agno-vs-langgraph.md)\n- [Agno vs Mastra](https://www.anchorterminal.com/compare/agno-vs-mastra.md)\n- [BoxLang AI vs LangGraph](https://www.anchorterminal.com/compare/boxlang-ai-vs-langgraph.md)\n- [BoxLang AI vs Mastra](https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra.md)\n- [Claude Agent SDK vs LangGraph](https://www.anchorterminal.com/compare/claude-agent-sdk-vs-langgraph.md)\n- [Claude Agent SDK vs Mastra](https://www.anchorterminal.com/compare/claude-agent-sdk-vs-mastra.md)\n- [CrewAI vs LangGraph](https://www.anchorterminal.com/compare/crewai-vs-langgraph.md)\n- [CrewAI vs Mastra](https://www.anchorterminal.com/compare/crewai-vs-mastra.md)\n- [Cursor Agent SDK vs LangGraph](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-langgraph.md)\n- [Cursor Agent SDK vs Mastra](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra.md)\n- [Docker Agent vs LangGraph](https://www.anchorterminal.com/compare/docker-agent-vs-langgraph.md)\n- [Docker Agent vs Mastra](https://www.anchorterminal.com/compare/docker-agent-vs-mastra.md)\n- [Agent Development Kit (ADK) vs LangGraph](https://www.anchorterminal.com/compare/google-adk-vs-langgraph.md)\n- [Agent Development Kit (ADK) vs Mastra](https://www.anchorterminal.com/compare/google-adk-vs-mastra.md)\n- [guilds.run vs LangGraph](https://www.anchorterminal.com/compare/guilds-run-vs-langgraph.md)\n- [guilds.run vs Mastra](https://www.anchorterminal.com/compare/guilds-run-vs-mastra.md)\n- [LangGraph vs LlamaIndex Framework](https://www.anchorterminal.com/compare/langgraph-vs-llamaindex.md)\n- [LangGraph vs Microsoft Agent Framework](https://www.anchorterminal.com/compare/langgraph-vs-microsoft-agent-framework.md)\n- [LangGraph vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/langgraph-vs-openai-agents-sdk.md)\n- [LangGraph vs Pydantic AI](https://www.anchorterminal.com/compare/langgraph-vs-pydantic-ai.md)\n- [LangGraph vs smolagents](https://www.anchorterminal.com/compare/langgraph-vs-smolagents.md)\n- [LangGraph vs Strands Agents](https://www.anchorterminal.com/compare/langgraph-vs-strands-agents.md)\n- [LangGraph vs TradingAgents](https://www.anchorterminal.com/compare/langgraph-vs-tradingagents.md)\n- [LangGraph vs AI SDK](https://www.anchorterminal.com/compare/langgraph-vs-vercel-ai-sdk.md)\n- [LlamaIndex Framework vs Mastra](https://www.anchorterminal.com/compare/llamaindex-vs-mastra.md)\n- [Mastra vs Microsoft Agent Framework](https://www.anchorterminal.com/compare/mastra-vs-microsoft-agent-framework.md)\n- [Mastra vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk.md)\n- [Mastra vs Pydantic AI](https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai.md)\n- [Mastra vs smolagents](https://www.anchorterminal.com/compare/mastra-vs-smolagents.md)\n- [Mastra vs Strands Agents](https://www.anchorterminal.com/compare/mastra-vs-strands-agents.md)\n- [Mastra vs TradingAgents](https://www.anchorterminal.com/compare/mastra-vs-tradingagents.md)\n- [Mastra vs AI SDK](https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "LangGraph vs Mastra", "url": "" } ], "description": "Mastra scores 74.2 (BB) to LangGraph's 69.8 (B) for agent frameworks. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "LangGraph B 69.8", "Mastra BB 74.2", "scores" ], "h1": "LangGraph vs Mastra", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/langgraph-vs-mastra", "published": "2026-10-01", "section": "tools", "title": "LangGraph vs Mastra for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/langgraph-vs-mastra" }, "tokens": { "markdown": 4650, "slim": 2730 }, "version": 1 }