# LlamaIndex Framework vs Mastra (slim)

> Mastra scores 74.2 (BB) to LlamaIndex Framework's 70 (BB) for agent frameworks. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/llamaindex-vs-mastra.md (~4,500 tokens) · this version ~2,530 tokens · JSON https://www.anchorterminal.com/compare/llamaindex-vs-mastra.json · canonical https://www.anchorterminal.com/compare/llamaindex-vs-mastra
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Mastra scores 74.2 (BB) on agent readiness against LlamaIndex Framework's 70 (BB), and leads in 5 of 7 scored categories. LlamaIndex Framework leads on security & auth. Both do agent frameworks.

- LlamaIndex Framework: BB 70, rank #217 of 1510 · https://www.anchorterminal.com/tools/llamaindex.min.md
- Mastra: BB 74.2, rank #91 of 1510 · https://www.anchorterminal.com/tools/mastra.min.md
- LlamaIndex Framework, good for Python teams building retrieval-heavy agents over their own data, with many connectors. Ahead on Security & auth, 74 against 67. Also No key needed to call it.
- Mastra, good for TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework. Ahead on Reliability, 87 against 70; Schema & documentation, 98 against 85; Agent ergonomics, 92 against 73; Maintenance & community, 96 against 69; Transparency & trust, 72 against 67.

| Category | LlamaIndex Framework | Mastra |
| --- | --- | --- |
| Reliability (16%) | 70 | 87 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 85 | 98 |
| Agent ergonomics (13%) | 73 | 92 |
| Security & auth (14%) | 74 | 67 |
| Payments & pricing (10%) | 60 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 69 | 96 |
| Transparency & trust (7%) | 67 | 72 |

| Fact (where they differ) | LlamaIndex Framework | Mastra |
| --- | --- | --- |
| Vendor | LlamaIndex | Kepler Software, Inc. |
| Auth | None | API key |
| Licence | MIT | Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing |
| Last release | 2026-09-21 | 2026-11-04 |
| Terms last updated | no document linked | 2026-10-26 |
| Privacy policy last updated | 2026-08-24 | no date given |
| Customer content may train models | not read yet | yes |
| Terms restrict automated access | not read yet | yes |
| Terms restrict benchmarking | not read yet | not found in the text |
| Terms or service can change without notice | not read yet | yes |
| Arbitration or class-action waiver | not read yet | yes |
| Popularity | 53k stars, 1.3M PyPI/wk | 29k stars, 3.1M npm/wk |

Why the edge:
- Maintenance & community, Mastra +27: LlamaIndex Framework 69 (llama-index-core 0.14.25 on 21 September 2026, 46 days before this check (20). Two core changelog entries in the 90 days (19 August and 21 September), with integration packages and Workflows (2.24.1 to 2.26.1) publishing in between, so partial (12). 379 open issues and 1,291 open issues and pull requests on 6 November, with 241 issues opened in the 90 days to 3 November. Of the 50 newest, 28 had a comment and 3 were closed; a stale bot and an issue classifier run on the repository (12). Core, Workflows and integrations are current (15). CI and CodeQL passing on main and a stale-package policy that moves unmaintained integrations out of main (10). 20+12+12+15+10 = 69.); Mastra 96 (@mastra/core 1.82.0 on 2026-11-04 (30). 27 stable releases in the 90 days to 6 November, 8 of them since 6 October (20). 436 open issues on 6 November, all 50 newest issues commented and 24 of them closed (22). Client, MCP and store packages are current, and @mastra/mcp 1.x stays supported beside 2.x (15). Renovate and CI configured, with the newest runs on main passing (9). 30+20+22+15+9 = 96.)
- Agent ergonomics, Mastra +19: LlamaIndex Framework 73 (Framework reading. MCP tools through a separate llama-index-tools-mcp package, with allowed tools selectable (18). Memory token limits, iteration caps and streaming events (16). Tool errors returned to the agent, with few typed errors (12). Workflow context serialises and resumes, and the DBOS package makes runs durable (16). Few required parameters, but OpenAI is the silent default for LLM and embeddings, Python here with a separate TypeScript edition (11). 18+16+12+16+11 = 73.); Mastra 92 (An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10).)
- Reliability, Mastra +17: LlamaIndex Framework 70 (Local-package reading. Official PyPI packages with Python 3.10 to below 4.0 (20). Public unit-test, type-check, lint, coverage and CodeQL workflows, with the type-check, lint and CodeQL runs on main passing on 3 November (25). 379 open issues and 1,291 open issues and pull requests on 6 November, with 241 issues opened in the 90 days to 3 November. Of the 50 newest, 28 had a comment and 3 were closed; a stale bot and an issue classifier run on the repository (12). A dated, generated changelog per package, but core is 0.x and minors such as 0.13 and 0.14 carried breaking changes (8). Core isn't 1.0; Workflows is at 2.x, so partial (5). 20+25+12+8+5 = 70.); Mastra 87 (Official npm packages, Node 22.13 or newer (20). Public CI workflows for unit, store, workspace and e2e tests; on 6 November the newest runs on main (Version Packages, Trigger Cloud Integration Tests) succeeded, while the test workflows themselves run on pull requests (22). 436 open issues and 795 open issues and pull requests on 6 November from GitHub's API, with 2,077 issues opened in the 90 days to 3 November; all 50 newest had a comment and 24 were closed, with issue-triage automation (18). A changesets CHANGELOG per package, a CI gate that needs approval for any major bump and migration guides, but no written versioning policy found, and `.network()` is deprecated without a removal date (12). 1.82.0 (15). 20+22+18+12+15 = 87, up from 74 on 6 October, when GitHub couldn't be read.)
- Schema & documentation, Mastra +13: LlamaIndex Framework 85 (Framework reading. A typed Python API with a generated reference (22). llms.txt indexing the framework docs, plus a docs search API and an MCP server for the docs (10). The agents guide says what each agent class is for, and the MCP page lists the three ways to use MCP (15). Tools are typed from function signatures and Pydantic models (13). Many examples and notebooks, few documented error types (10). Dated changelog (15). 22+10+15+13+10+15 = 85.); Mastra 98 (Typed TypeScript API with a reference section (25). llms.txt with a when-to-use list and condensed instructions for coding agents (10). The docs say when to use durable agents, and point multi-agent users from `.network()` to supervisor agents (20). Tools take Zod schemas (15). Examples on every page, and MastraError with ids and categories documented, though errors are spread across pages (13). Per-package changelogs and migration guides (15).)
- Security & auth, LlamaIndex Framework +7: LlamaIndex Framework 74 (Framework reading (telemetry defaults, approvals, guardrails, sandboxing). No telemetry found in llama-index-core (25). Human-in-the-loop events in Workflows and agents can wait for a person, but there's no per-tool approval primitive and CodeActAgent's executor is the developer's to supply (12). The threat model puts input validation on the application, with no prompt-injection guidance in the agent pages (5). Instrumentation events and callback handlers for tracing (14). A huntr bug bounty, GitHub private reporting and public advisories with fixed versions (18). 25+12+5+14+18 = 74.); Mastra 67 (The CLI sends PostHog analytics, server startup sends token counts per model and a count of registered agents, tools and MCP servers, and Studio sends browser analytics, all on by default and documented, with one opt-out, MASTRA_TELEMETRY_DISABLED=1. Since #26986 (16 October 2026) each server process also reports token use per provider and model every 15 minutes, and the telemetry reference read on 6 November says server events carry a project identifier that is a raw Platform UUID or a hash of the Git origin remote, so they "aren't anonymous" (12). requireToolApproval on agents and MCP servers, allowedHosts for MCP HTTP, a curated environment for stdio servers, and sandboxed workspaces (20). PromptInjectionDetector, PII and moderation processors, and docs that call tool results untrusted model input (15). Built-in tracing with OpenTelemetry and other exporters (15). No SECURITY.md, no security.txt and no bug bounty found. A blog post says Mastra is SOC 2 Type II audited, which isn't scored for a framework, and we found no public advisory from Mastra about the June incident (5). Framework reading. 15+20+15+15+5 = 70 on 6 October, 12+20+15+15+5 = 67 on 6 November.)
- Transparency & trust, Mastra +5: LlamaIndex Framework 67 (MIT (30). The library stores nothing itself; OpenAI is the default provider unless changed, which the docs show (20). A stale-package policy and removals noted in the changelog, such as deprecated IPEX integrations removed in 0.14.25, without dated notice (10). No telemetry, though no page states it (12). 30+20+10+12 = 72.); Mastra 72 (Apache 2.0 for the core, with ee/ directories source-available under the Mastra Enterprise License (25). The privacy policy (last published 25 April 2025) covers the website, the Teams plan states six months' retention, and the subprocessor list sits in a trust centre our reader couldn't render (15). Migration guides and deprecation warnings, without dated removal windows (12). Every telemetry stream is documented with links to its source and one opt-out, and the reference now spells out what the project identifiers can be correlated with (20).)