LlamaIndex Framework vs Mastra

LlamaIndex Framework 69

llama-index-core 0.14.25 on 21 September 2026, 46 days before this check (20). Two core changelog entries in the 90 days (19 August and 21 September), with integration packages and Workflows (2.24.1 to 2.26.1) publishing in between, so partial (12). 379 open issues and 1,291 open issues and pull requests on 6 November, with 241 issues opened in the 90 days to 3 November. Of the 50 newest, 28 had a comment and 3 were closed; a stale bot and an issue classifier run on the repository (12). Core, Workflows and integrations are current (15). CI and CodeQL passing on main and a stale-package policy that moves unmaintained integrations out of main (10). 20+12+12+15+10 = 69.

Mastra 96

@mastra/core 1.82.0 on 2026-11-04 (30). 27 stable releases in the 90 days to 6 November, 8 of them since 6 October (20). 436 open issues on 6 November, all 50 newest issues commented and 24 of them closed (22). Client, MCP and store packages are current, and @mastra/mcp 1.x stays supported beside 2.x (15). Renovate and CI configured, with the newest runs on main passing (9). 30+20+22+15+9 = 96.

LlamaIndex Framework 73

Framework reading. MCP tools through a separate llama-index-tools-mcp package, with allowed tools selectable (18). Memory token limits, iteration caps and streaming events (16). Tool errors returned to the agent, with few typed errors (12). Workflow context serialises and resumes, and the DBOS package makes runs durable (16). Few required parameters, but OpenAI is the silent default for LLM and embeddings, Python here with a separate TypeScript edition (11). 18+16+12+16+11 = 73.

Mastra 92

An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10).

LlamaIndex Framework 70

Local-package reading. Official PyPI packages with Python 3.10 to below 4.0 (20). Public unit-test, type-check, lint, coverage and CodeQL workflows, with the type-check, lint and CodeQL runs on main passing on 3 November (25). 379 open issues and 1,291 open issues and pull requests on 6 November, with 241 issues opened in the 90 days to 3 November. Of the 50 newest, 28 had a comment and 3 were closed; a stale bot and an issue classifier run on the repository (12). A dated, generated changelog per package, but core is 0.x and minors such as 0.13 and 0.14 carried breaking changes (8). Core isn't 1.0; Workflows is at 2.x, so partial (5). 20+25+12+8+5 = 70.

Mastra 87

Official npm packages, Node 22.13 or newer (20). Public CI workflows for unit, store, workspace and e2e tests; on 6 November the newest runs on main (Version Packages, Trigger Cloud Integration Tests) succeeded, while the test workflows themselves run on pull requests (22). 436 open issues and 795 open issues and pull requests on 6 November from GitHub's API, with 2,077 issues opened in the 90 days to 3 November; all 50 newest had a comment and 24 were closed, with issue-triage automation (18). A changesets CHANGELOG per package, a CI gate that needs approval for any major bump and migration guides, but no written versioning policy found, and .network() is deprecated without a removal date (12). 1.82.0 (15). 20+22+18+12+15 = 87, up from 74 on 6 October, when GitHub couldn't be read.

LlamaIndex Framework 85

Framework reading. A typed Python API with a generated reference (22). llms.txt indexing the framework docs, plus a docs search API and an MCP server for the docs (10). The agents guide says what each agent class is for, and the MCP page lists the three ways to use MCP (15). Tools are typed from function signatures and Pydantic models (13). Many examples and notebooks, few documented error types (10). Dated changelog (15). 22+10+15+13+10+15 = 85.

Mastra 98

Typed TypeScript API with a reference section (25). llms.txt with a when-to-use list and condensed instructions for coding agents (10). The docs say when to use durable agents, and point multi-agent users from .network() to supervisor agents (20). Tools take Zod schemas (15). Examples on every page, and MastraError with ids and categories documented, though errors are spread across pages (13). Per-package changelogs and migration guides (15).

LlamaIndex Framework 74

Framework reading (telemetry defaults, approvals, guardrails, sandboxing). No telemetry found in llama-index-core (25). Human-in-the-loop events in Workflows and agents can wait for a person, but there's no per-tool approval primitive and CodeActAgent's executor is the developer's to supply (12). The threat model puts input validation on the application, with no prompt-injection guidance in the agent pages (5). Instrumentation events and callback handlers for tracing (14). A huntr bug bounty, GitHub private reporting and public advisories with fixed versions (18). 25+12+5+14+18 = 74.

Mastra 67

The CLI sends PostHog analytics, server startup sends token counts per model and a count of registered agents, tools and MCP servers, and Studio sends browser analytics, all on by default and documented, with one opt-out, MASTRA_TELEMETRY_DISABLED=1. Since #26986 (16 October 2026) each server process also reports token use per provider and model every 15 minutes, and the telemetry reference read on 6 November says server events carry a project identifier that is a raw Platform UUID or a hash of the Git origin remote, so they "aren't anonymous" (12). requireToolApproval on agents and MCP servers, allowedHosts for MCP HTTP, a curated environment for stdio servers, and sandboxed workspaces (20). PromptInjectionDetector, PII and moderation processors, and docs that call tool results untrusted model input (15). Built-in tracing with OpenTelemetry and other exporters (15). No SECURITY.md, no security.txt and no bug bounty found. A blog post says Mastra is SOC 2 Type II audited, which isn't scored for a framework, and we found no public advisory from Mastra about the June incident (5). Framework reading. 15+20+15+15+5 = 70 on 6 October, 12+20+15+15+5 = 67 on 6 November.

LlamaIndex Framework 67

MIT (30). The library stores nothing itself; OpenAI is the default provider unless changed, which the docs show (20). A stale-package policy and removals noted in the changelog, such as deprecated IPEX integrations removed in 0.14.25, without dated notice (10). No telemetry, though no page states it (12). 30+20+10+12 = 72.

Mastra 72

Apache 2.0 for the core, with ee/ directories source-available under the Mastra Enterprise License (25). The privacy policy (last published 25 April 2025) covers the website, the Teams plan states six months' retention, and the subprocessor list sits in a trust centre our reader couldn't render (15). Migration guides and deprecation warnings, without dated removal windows (12). Every telemetry stream is documented with links to its source and one opt-out, and the reference now spells out what the project identifiers can be correlated with (20).