{
  "data": {
    "a": {
      "slug": "mastra",
      "name": "Mastra",
      "vendor": "Kepler Software, Inc.",
      "vendorUrl": "https://mastra.ai",
      "kind": "framework",
      "category": "frameworks",
      "summary": "Open-source TypeScript framework from Mastra for building agents and workflows, with memory, RAG, evals, tracing, an MCP client and server, and a local Studio. An optional hosted platform runs deployments and observability.",
      "url": "https://www.anchorterminal.com/tools/mastra",
      "markdownUrl": "https://www.anchorterminal.com/tools/mastra.md",
      "slimMarkdownUrl": "https://www.anchorterminal.com/tools/mastra.min.md",
      "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/mastra.json",
      "dns": "mastra.grade.anchorterminal.com",
      "repo": "https://github.com/mastra-ai/mastra",
      "license": "Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing",
      "transports": [],
      "packages": [
        {
          "registry": "npm",
          "name": "@mastra/core"
        },
        {
          "registry": "npm",
          "name": "@mastra/mcp"
        },
        {
          "registry": "npm",
          "name": "mastra"
        }
      ],
      "auth": "api-key",
      "authNotes": "The framework has no account of its own. The model router takes `provider/model` strings and each provider's own key. The hosted Mastra platform needs an account.",
      "pricing": "free",
      "pricingNotes": "Free and open source. You pay for model calls. The hosted platform has a $0 Starter plan with 100K observability events and 24 CPU hours, then $10 per 100K events and $0.35 a CPU hour, and Teams at $250 a month (https://mastra.ai/pricing, checked 2026-11-06).",
      "priceSummary": "Free · OSS",
      "where": "library",
      "x402": {
        "level": "no",
        "evidence": "No x402, MPP or L402 in the Mastra docs, the repository or the pricing page (checked 2026-10-06).",
        "endpoints": []
      },
      "toolCount": null,
      "popularity": {
        "githubStars": 29383,
        "npmWeekly": 3116983,
        "pypiWeekly": null,
        "asOf": "2026-11-06"
      },
      "docsUrl": "https://mastra.ai/docs",
      "llmsTxt": "https://mastra.ai/llms.txt",
      "capabilities": [
        "agent.framework",
        "agent.durable",
        "agent.mcp-client",
        "agent.multi-agent"
      ],
      "tags": [
        "framework",
        "typescript",
        "open-source",
        "llms-txt",
        "mcp",
        "telemetry-default-on"
      ],
      "lastRelease": "2026-11-04",
      "graded": true,
      "anchor": {
        "graded": true,
        "score": 74.2,
        "grade": "BB",
        "agentReady": true,
        "rank": 91,
        "ranked": true,
        "rankOf": 1510,
        "categoryRank": 7,
        "methodology": "0.7",
        "run": "2026-10-01",
        "scores": {
          "ergonomics": 92,
          "maintenance": 96,
          "payments": 60,
          "reliability": 87,
          "schema": 98,
          "security": 67,
          "transparency": 72
        },
        "pending": [
          "performance",
          "tasks"
        ],
        "assessment": {
          "confidence": "medium",
          "date": "2026-11-06"
        },
        "negative": -8,
        "negativeNotes": [
          "2026-06-17. Malicious versions of Mastra's npm packages were published, among them @mastra/core 1.42.1 at 01:15 UTC, and GitHub malware advisories that day (GHSA-pp62-grrw-hvfp and others) say any machine that installed one should be treated as fully compromised. All 21 Mastra packages we checked on OSV carry one. Mastra published clean versions the same day and the changelogs name an \"easy-day-js\" supply-chain incident, but we found no advisory or post-mortem from Mastra. Fixed and under four months old, so 8 points. https://osv.dev/vulnerability/MAL-2026-6011"
        ],
        "verdict": "A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes.",
        "bestFor": "TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.",
        "strengths": [
          "MCP client with requireToolApproval per server or per tool, allowedHosts and a curated environment for stdio servers",
          "Guardrail processors for prompt injection, PII, moderation and cost limits, run on input and output",
          "Workflows with snapshots, suspend and resume, and durable agents on Inngest or an evented engine",
          "Apache 2.0 core, 1.0 since 20 January 2026, with 27 releases of @mastra/core in 90 days to 6 November",
          "llms.txt with a when-to-use section and condensed instructions for coding agents"
        ],
        "weaknesses": [
          "Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026",
          "CLI, server and Studio send usage analytics by default, including token counts every 15 minutes, off with MASTRA_TELEMETRY_DISABLED=1",
          "No SECURITY.md, no security.txt and no bug bounty found",
          "Code under ee/ is source-available under the Mastra Enterprise License, not Apache 2.0",
          "TypeScript only, Node 22.13 or newer"
        ],
        "agentNotes": [
          "Set MASTRA_TELEMETRY_DISABLED=1 in every environment that runs the CLI, the server or Studio",
          "Pin exact versions with a lockfile, and make sure no 17 June 2026 release such as @mastra/core 1.42.1 is installed",
          "Set requireToolApproval on MCP servers that write, and allowedHosts when server URLs come from configuration",
          "Add PromptInjectionDetector as an input processor when tools return web or user content",
          "Use supervisor agents through generate() or stream(). `.network()` is deprecated"
        ],
        "metrics": {
          "kind": "library",
          "measured": false
        },
        "reviewCount": 0,
        "avgRating": 0,
        "history": [
          {
            "basis": "public evidence",
            "confidence": "medium",
            "grade": "BB",
            "methodology": "0.7",
            "pending": [
              "performance",
              "tasks"
            ],
            "run": "2026-10-01",
            "runLabel": "October 2026 research run",
            "score": 74.2
          }
        ],
        "editorialScores": {
          "ergonomics": 92,
          "maintenance": 96,
          "payments": 60,
          "reliability": 87,
          "schema": 98,
          "security": 67,
          "transparency": 72
        },
        "provenanceScore": 71,
        "checked": {
          "categories": {
            "ergonomics": "2026-11-06",
            "maintenance": "2026-11-06",
            "payments": "2026-11-06",
            "reliability": "2026-11-06",
            "schema": "2026-11-06",
            "security": "2026-11-06",
            "transparency": "2026-11-06"
          },
          "last": "2026-11-06",
          "oldest": "2026-11-06",
          "stale": false,
          "staleAfterDays": 90
        }
      },
      "connect": {
        "install": "npm create mastra@latest   # or: npm i @mastra/core @mastra/mcp"
      },
      "letme": {
        "capability": "https://letme.dev/agent.framework",
        "tool": "https://letme.dev/mastra"
      },
      "area": "frameworks",
      "provenance": {
        "legalEntity": "Kepler Software, Inc.",
        "domain": "mastra.ai",
        "domainRegistered": "2024-10-01",
        "endpointOnVendorDomain": null,
        "terms": "https://mastra.ai/terms-of-service",
        "privacy": "https://mastra.ai/privacy-policy",
        "statusPage": "https://statuspage.incident.io/mastra-platform",
        "changelog": "https://github.com/mastra-ai/mastra/blob/main/packages/core/CHANGELOG.md",
        "securityTxt": "none",
        "checked": "2026-11-06",
        "notes": [
          "The privacy policy names Kepler Software Inc as operator of mastra.ai and shows a last-published date of 25 April 2025.",
          "The licence file is copyright Kepler Software, Inc.",
          "mastra.ai/.well-known/security.txt returns 404 (rechecked 6 November 2026), and the repository has no SECURITY.md.",
          "RDAP gives mastra.ai a registration date of 2024-10-01.",
          "The status page covers the hosted platform, not the framework."
        ],
        "score": 71
      },
      "pageJsonUrl": "https://www.anchorterminal.com/tools/mastra.json",
      "live": {
        "slug": "mastra",
        "vendorStatus": {
          "page": "https://statuspage.incident.io/mastra-platform",
          "indicator": "none",
          "summary": "All Systems Operational",
          "checkedAt": "2026-11-07T19:22:27.41396844Z"
        },
        "versions": [
          {
            "registry": "github",
            "name": "mastra-ai/mastra",
            "version": "@mastra/core@1.82.0",
            "released": "2026-11-04",
            "seenAt": "2026-11-06T23:43:05.299046627Z"
          },
          {
            "registry": "npm",
            "name": "@mastra/core",
            "version": "1.82.0",
            "seenAt": "2026-11-06T23:43:01.102546802Z"
          },
          {
            "registry": "npm",
            "name": "@mastra/mcp",
            "version": "2.8.0",
            "seenAt": "2026-11-06T23:43:01.962943277Z"
          },
          {
            "registry": "npm",
            "name": "mastra",
            "version": "1.38.0",
            "seenAt": "2026-11-06T23:43:03.330470883Z"
          }
        ],
        "githubStars": 29384,
        "npmWeekly": 3116983,
        "securityTxt": {
          "url": "https://mastra.ai/.well-known/security.txt",
          "state": "none",
          "checkedAt": "2026-11-07T16:00:45.130857018Z"
        },
        "llmsTxt": {
          "url": "https://mastra.ai/llms.txt",
          "ok": true,
          "status": 200,
          "checkedAt": "2026-11-07T15:32:57.501317652Z"
        },
        "pages": [
          {
            "url": "https://raw.githubusercontent.com/mastra-ai/mastra/main/packages/core/CHANGELOG.md",
            "kind": "changelog",
            "status": 200,
            "checkedAt": "2026-11-07T14:21:37.959722321Z",
            "changedAt": "0001-01-01T00:00:00Z",
            "fingerprint": "0bdb3498f7aa"
          },
          {
            "url": "https://mastra.ai/pricing",
            "kind": "pricing",
            "status": 200,
            "checkedAt": "2026-11-07T14:13:54.312763229Z",
            "changedAt": "0001-01-01T00:00:00Z",
            "fingerprint": "0204673a21a8"
          },
          {
            "url": "https://mastra.ai/privacy-policy",
            "kind": "privacy",
            "status": 200,
            "checkedAt": "2026-11-07T14:13:56.829832485Z",
            "changedAt": "0001-01-01T00:00:00Z",
            "fingerprint": "1621ce3063d8"
          },
          {
            "url": "https://mastra.ai/terms-of-service",
            "kind": "terms",
            "status": 200,
            "checkedAt": "2026-11-07T14:13:58.580048861Z",
            "changedAt": "0001-01-01T00:00:00Z",
            "fingerprint": "edbcf520f26c"
          }
        ],
        "updatedAt": "2026-11-07T19:22:27.41396844Z"
      }
    },
    "answer": "OpenAI Agents SDK scores 86.2 (AA) on agent readiness against Mastra's 74.2 (BB), and leads in 4 of 7 scored categories.",
    "b": {
      "slug": "openai-agents-sdk",
      "name": "OpenAI Agents SDK",
      "vendor": "OpenAI",
      "vendorUrl": "https://openai.com",
      "kind": "framework",
      "category": "frameworks",
      "summary": "Multi-agent framework built on agents, hand-offs and guardrails, with sessions, tracing and human approval.",
      "url": "https://www.anchorterminal.com/tools/openai-agents-sdk",
      "markdownUrl": "https://www.anchorterminal.com/tools/openai-agents-sdk.md",
      "slimMarkdownUrl": "https://www.anchorterminal.com/tools/openai-agents-sdk.min.md",
      "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/openai-agents-sdk.json",
      "dns": "openai-agents-sdk.grade.anchorterminal.com",
      "repo": "https://github.com/openai/openai-agents-python",
      "license": "MIT",
      "transports": [],
      "packages": [
        {
          "registry": "pypi",
          "name": "openai-agents"
        },
        {
          "registry": "npm",
          "name": "@openai/agents",
          "main": true
        }
      ],
      "auth": "api-key",
      "authNotes": "OpenAI key by default. Other providers through LiteLLM or any-llm.",
      "pricing": "free",
      "pricingNotes": "Free and open source. You pay for the model calls it makes.",
      "priceSummary": "Free · OSS",
      "where": "library",
      "x402": {
        "level": "no",
        "endpoints": []
      },
      "toolCount": null,
      "popularity": {
        "githubStars": 29709,
        "npmWeekly": 1291899,
        "pypiWeekly": 3018052,
        "asOf": "2026-09-26"
      },
      "docsUrl": "https://openai.github.io/openai-agents-python/",
      "llmsTxt": "https://openai.github.io/openai-agents-python/llms.txt",
      "capabilities": [
        "agent.framework",
        "agent.multi-agent",
        "agent.durable",
        "agent.mcp-client"
      ],
      "tags": [
        "official",
        "framework",
        "python",
        "typescript",
        "open-source",
        "telemetry-default-on"
      ],
      "lastRelease": "2026-10-15",
      "graded": true,
      "anchor": {
        "graded": true,
        "score": 86.2,
        "grade": "AA",
        "agentReady": true,
        "rank": 3,
        "ranked": true,
        "rankOf": 1510,
        "categoryRank": 2,
        "methodology": "0.7",
        "run": "2026-10-01",
        "scores": {
          "ergonomics": 97,
          "maintenance": 100,
          "payments": 60,
          "reliability": 85,
          "schema": 95,
          "security": 80,
          "transparency": 89
        },
        "pending": [
          "performance",
          "tasks"
        ],
        "assessment": {
          "confidence": "high",
          "date": "2026-11-01"
        },
        "negative": 0,
        "verdict": "MCP in about 11 lines, with static and dynamic tool filters and require_approval. Tracing on by default, with model and tool content, sent to OpenAI.",
        "bestFor": "Teams that want hand-offs, guardrails and approvals with little code, and are happy with OpenAI's tracing or will turn it off.",
        "strengths": [
          "MCP in about 11 lines, with static and dynamic tool filters and require_approval",
          "Input and output guardrails, built-in human approval and sandbox agents",
          "Typed exceptions plus error_handlers, and RunState to resume a paused run",
          "9 open issues and 2 open pull requests on 2026-10-04",
          "A written 0.Y.Z versioning policy with breaking changes listed per minor"
        ],
        "weaknesses": [
          "Tracing on by default, with model and tool content, sent to OpenAI",
          "Tracing isn't available to zero-data-retention organisations",
          "Pre-1.0, and minor releases can carry breaking changes, as 0.20.0, 0.21.0 and 0.22.0 did",
          "0.20.0 changed the default model",
          "Before 0.24.0, RunConfig(tracing_disabled=True) didn't stop spans inside a caller's own trace"
        ],
        "agentNotes": [
          "Set OPENAI_AGENTS_DISABLE_TRACING=1 or OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA=0. On versions before 0.24.0, RunConfig(tracing_disabled=True) doesn't stop spans inside your own trace() block",
          "Pin to a minor version. Each 0.Y can break",
          "Set require_approval on MCP servers that write",
          "Name the model explicitly. The default changed in 0.20.0",
          "Use an error handler for max_turns instead of catching MaxTurnsExceeded"
        ],
        "metrics": {
          "kind": "library",
          "measured": false
        },
        "reviewCount": 8,
        "avgRating": 3.9,
        "history": [
          {
            "basis": "public evidence",
            "confidence": "high",
            "grade": "AA",
            "methodology": "0.7",
            "pending": [
              "performance",
              "tasks"
            ],
            "run": "2026-10-01",
            "runLabel": "October 2026 research run",
            "score": 86.2
          }
        ],
        "editorialScores": {
          "ergonomics": 97,
          "maintenance": 100,
          "payments": 60,
          "reliability": 85,
          "schema": 95,
          "security": 80,
          "transparency": 84
        },
        "provenanceScore": 94,
        "checked": {
          "categories": {
            "ergonomics": "2026-11-01",
            "maintenance": "2026-11-01",
            "payments": "2026-11-01",
            "reliability": "2026-11-01",
            "schema": "2026-11-01",
            "security": "2026-11-01",
            "transparency": "2026-11-01"
          },
          "last": "2026-11-01",
          "lastMoved": "2026-10-08",
          "oldest": "2026-11-01",
          "stale": false,
          "staleAfterDays": 90
        }
      },
      "connect": {
        "install": "pip install openai-agents   # or: npm i @openai/agents"
      },
      "letme": {
        "capability": "https://letme.dev/agent.framework",
        "tool": "https://letme.dev/openai-agents-sdk"
      },
      "sameCompany": [
        "openai-api",
        "openai-embeddings",
        "openai-guardrails",
        "openai-moderation",
        "openai-image-api",
        "openai-sora",
        "openai-speech-to-text",
        "gpt-live",
        "openai-realtime",
        "openai-decisions-api",
        "openai-agents-api",
        "openai-codex",
        "gpt-oss-120b",
        "gpt-oss-20b"
      ],
      "area": "frameworks",
      "provenance": {
        "legalEntity": "OpenAI OpCo, LLC",
        "domain": "openai.com",
        "domainRegistered": "2007-01-19",
        "endpointOnVendorDomain": null,
        "terms": "https://openai.com/policies/services-agreement/",
        "privacy": "https://openai.com/policies/privacy-policy/",
        "statusPage": "https://status.openai.com",
        "changelog": "https://openai.github.io/openai-agents-python/release/",
        "securityTxt": "valid",
        "checked": "2026-09-26",
        "score": 94
      },
      "requirements": {
        "setupChecked": true,
        "complianceChecked": true,
        "card": "unknown",
        "freeTier": true,
        "minutes": 5,
        "credential": "api-key",
        "hosting": [
          "self-hosted"
        ],
        "euResidency": "unknown",
        "trainsOnData": "no",
        "zeroRetention": "unknown",
        "dpa": true,
        "selfHost": "yes"
      },
      "pageJsonUrl": "https://www.anchorterminal.com/tools/openai-agents-sdk.json",
      "live": {
        "slug": "openai-agents-sdk",
        "vendorStatus": {
          "page": "https://status.openai.com",
          "indicator": "none",
          "summary": "All Systems Operational",
          "checkedAt": "2026-11-07T19:22:48.855056154Z"
        },
        "versions": [
          {
            "registry": "github",
            "name": "openai/openai-agents-python",
            "version": "v0.24.0",
            "released": "2026-10-15",
            "seenAt": "2026-11-06T23:51:34.990215333Z"
          },
          {
            "registry": "npm",
            "name": "@openai/agents",
            "version": "0.21.0",
            "seenAt": "2026-11-06T23:51:34.164066161Z"
          },
          {
            "registry": "pypi",
            "name": "openai-agents",
            "version": "0.24.0",
            "released": "2026-10-15",
            "seenAt": "2026-11-06T23:51:32.387226297Z"
          }
        ],
        "githubStars": 30534,
        "npmWeekly": 2490720,
        "pypiWeekly": 4906329,
        "securityTxt": {
          "url": "https://openai.com/.well-known/security.txt",
          "state": "valid",
          "checkedAt": "2026-11-07T16:00:49.231731777Z"
        },
        "llmsTxt": {
          "url": "https://openai.github.io/openai-agents-python/llms.txt",
          "ok": true,
          "status": 200,
          "checkedAt": "2026-11-07T15:33:22.742814931Z"
        },
        "domain": {
          "domain": "openai.com",
          "registered": "2007-01-19",
          "source": "https://rdap.verisign.com/com/v1/domain/openai.com",
          "checkedAt": "2026-11-01T14:19:18.345389832Z"
        },
        "pages": [
          {
            "url": "https://openai.github.io/openai-agents-python/release/",
            "kind": "changelog",
            "status": 304,
            "checkedAt": "2026-11-07T14:15:24.32755013Z",
            "changedAt": "2026-10-28T04:39:34.685607508Z",
            "fingerprint": "251fd383498a"
          },
          {
            "url": "https://openai.com/policies/privacy-policy/",
            "kind": "privacy",
            "status": 403,
            "checkedAt": "2026-10-16T22:27:51.367579814Z",
            "changedAt": "2026-10-11T19:31:08.710809907Z",
            "fingerprint": "604e9f69c16a"
          },
          {
            "url": "https://openai.com/policies/services-agreement/",
            "kind": "terms",
            "status": 403,
            "checkedAt": "2026-10-16T22:27:53.401505958Z",
            "changedAt": "2026-10-04T15:46:24.458479472Z",
            "fingerprint": "46a4b30744ca"
          }
        ],
        "github": {
          "repo": "openai/openai-agents-python",
          "checkedAt": "2026-11-02T09:12:58.455555785Z",
          "stars": 30451,
          "archived": false,
          "issuesEnabled": true,
          "pushedAt": "2026-11-01T04:56:10Z",
          "openIssues": 28,
          "openPRs": 8,
          "issuesOpened90d": 261,
          "issuesClosed90d": 256,
          "prsMerged90d": 593,
          "ci": {
            "branch": "main",
            "runs": 50,
            "success": 50,
            "failure": 0,
            "other": 0,
            "latest": "success",
            "latestAt": "2026-10-30T20:29:39Z"
          },
          "replies": {
            "sampled": 25,
            "unanswered": 13,
            "medianDays": 4.4
          }
        },
        "updatedAt": "2026-11-07T19:22:48.855056154Z"
      }
    },
    "edges": [
      {
        "by": 17,
        "category": "transparency",
        "leads": "openai-agents-sdk",
        "name": "Transparency \u0026 trust",
        "reasons": {
          "a": "Apache 2.0 for the core, with ee/ directories source-available under the Mastra Enterprise License (25). The privacy policy (last published 25 April 2025) covers the website, the Teams plan states six months' retention, and the subprocessor list sits in a trust centre our reader couldn't render (15). Migration guides and deprecation warnings, without dated removal windows (12). Every telemetry stream is documented with links to its source and one opt-out, and the reference now spells out what the project identifiers can be correlated with (20).",
          "b": "MIT (30). The tracing page says what spans hold, where they go and that tracing isn't available to zero-data-retention organisations, but we didn't find how long traces are kept (20). Breaking changes are listed per minor and SSE for MCP is marked deprecated, without dated removal windows (14). Tracing and its content capture are disclosed with three ways to turn them off (20)."
        },
        "scores": {
          "a": 72,
          "b": 89
        }
      },
      {
        "by": 13,
        "category": "security",
        "leads": "openai-agents-sdk",
        "name": "Security \u0026 auth",
        "reasons": {
          "a": "The CLI sends PostHog analytics, server startup sends token counts per model and a count of registered agents, tools and MCP servers, and Studio sends browser analytics, all on by default and documented, with one opt-out, MASTRA_TELEMETRY_DISABLED=1. Since #26986 (16 October 2026) each server process also reports token use per provider and model every 15 minutes, and the telemetry reference read on 6 November says server events carry a project identifier that is a raw Platform UUID or a hash of the Git origin remote, so they \"aren't anonymous\" (12). requireToolApproval on agents and MCP servers, allowedHosts for MCP HTTP, a curated environment for stdio servers, and sandboxed workspaces (20). PromptInjectionDetector, PII and moderation processors, and docs that call tool results untrusted model input (15). Built-in tracing with OpenTelemetry and other exporters (15). No SECURITY.md, no security.txt and no bug bounty found. A blog post says Mastra is SOC 2 Type II audited, which isn't scored for a framework, and we found no public advisory from Mastra about the June incident (5). Framework reading. 15+20+15+15+5 = 70 on 6 October, 12+20+15+15+5 = 67 on 6 November.",
          "b": "Tracing is on by default and trace_include_sensitive_data defaults to true, so model and function-call inputs and outputs go to OpenAI's Traces dashboard. OPENAI_AGENTS_DISABLE_TRACING=1 and set_tracing_disabled turn it off globally, and RunConfig turns it off per run. Through 0.23.1 the per-run opt-out didn't apply inside the caller's own trace. The fix shipped in 0.24.0 on 15 October (10). Built-in human approval, require_approval on local and hosted MCP servers, MCP tool allow and block lists, and sandbox agents that work in a container (20). Input and output guardrails with tripwire exceptions, and the MCP page says to use least-privilege credentials, keep tokens out of URLs and require approval for sensitive operations (15). Built-in tracing with third-party processors such as Weights \u0026 Biases and Datadog (15). SECURITY.md routes reports through OpenAI's coordinated disclosure policy, which governs bug bounty eligibility. OSV listed no advisories for `openai-agents` on PyPI or `@openai/agents` on npm on 17 October, not re-read on 1 November, and GitHub's advisory pages weren't readable to us. On main, unreleased on 1 November, pyproject.toml raises the `mcp` floor to 1.30.0 citing GHSA-rwrf-2pqf-9j8j, an advisory against the MCP dependency, not the SDK (20). Framework reading, so SOC 2 isn't scored."
        },
        "scores": {
          "a": 67,
          "b": 80
        }
      },
      {
        "by": 5,
        "category": "ergonomics",
        "leads": "openai-agents-sdk",
        "name": "Agent ergonomics",
        "reasons": {
          "a": "An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10).",
          "b": "An agent with one MCP server is about 11 lines, with static and dynamic tool filters and tool-list caching (25). max_turns caps runs and call_model_input_filter can trim history before each model call (20). Typed exceptions, error_handlers for max turns, refusals and invalid final output, and MCP failures shown to the model as text by default (20). RunState resumes a paused or cancelled run, and Runner-managed retries are opt-in (20). An agent needs a name and instructions, but 0.20.0 changed the default model (7). Python and JavaScript (5)."
        },
        "scores": {
          "a": 92,
          "b": 97
        }
      }
    ],
    "facts": [
      {
        "a": "Agent framework",
        "b": "Agent framework",
        "name": "Kind"
      },
      {
        "a": "Kepler Software, Inc.",
        "b": "OpenAI",
        "name": "Vendor"
      },
      {
        "a": "no (local only)",
        "b": "no (local only)",
        "name": "Hosted endpoint"
      },
      {
        "a": "",
        "b": "",
        "name": "Transports"
      },
      {
        "a": "API key",
        "b": "API key",
        "name": "Auth"
      },
      {
        "a": "Free",
        "b": "Free",
        "name": "Pricing"
      },
      {
        "a": "no",
        "b": "no",
        "name": "x402"
      },
      {
        "a": "Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing",
        "b": "MIT",
        "name": "Licence"
      },
      {
        "a": "no",
        "b": "no",
        "name": "Read-only variant documented"
      },
      {
        "a": "yes",
        "b": "yes",
        "name": "llms.txt"
      },
      {
        "a": "2026-11-04",
        "b": "2026-10-15",
        "name": "Last release"
      },
      {
        "a": "2026-10-26",
        "b": "couldn't be read",
        "name": "Terms last updated"
      },
      {
        "a": "no date given",
        "b": "couldn't be read",
        "name": "Privacy policy last updated"
      },
      {
        "a": "yes",
        "b": "couldn't be read",
        "name": "Customer content may train models"
      },
      {
        "a": "yes",
        "b": "couldn't be read",
        "name": "Terms restrict automated access"
      },
      {
        "a": "not found in the text",
        "b": "couldn't be read",
        "name": "Terms restrict benchmarking"
      },
      {
        "a": "yes",
        "b": "couldn't be read",
        "name": "Terms or service can change without notice"
      },
      {
        "a": "yes",
        "b": "couldn't be read",
        "name": "Arbitration or class-action waiver"
      },
      {
        "a": "29k stars, 3.1M npm/wk",
        "b": "30k stars, 1.3M npm/wk, 3M PyPI/wk",
        "name": "Popularity"
      },
      {
        "a": "none",
        "b": "3.9/5 (8)",
        "name": "Agent reviews"
      }
    ],
    "faq": [
      {
        "answer": "OpenAI Agents SDK scores 86.2 (AA) on agent readiness against Mastra's 74.2 (BB), and leads in 4 of 7 scored categories.",
        "question": "Which is better for AI agents, Mastra or OpenAI Agents SDK?"
      },
      {
        "answer": "Yes. Mastra is open source (Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing). OpenAI Agents SDK is open source (MIT).",
        "question": "Are Mastra and OpenAI Agents SDK open source?"
      }
    ],
    "goodFor": [
      {
        "aheadOn": null,
        "also": null,
        "goodFor": "TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.",
        "slug": "mastra",
        "watchFor": "Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026"
      },
      {
        "aheadOn": [
          "Agent ergonomics, 97 against 92",
          "Security \u0026 auth, 80 against 67",
          "Transparency \u0026 trust, 89 against 72"
        ],
        "also": [
          "No incidents deducted, where Mastra loses 8 points for them"
        ],
        "goodFor": "Teams that want hand-offs, guardrails and approvals with little code, and are happy with OpenAI's tracing or will turn it off.",
        "slug": "openai-agents-sdk",
        "watchFor": "Tracing on by default, with model and tool content, sent to OpenAI"
      }
    ],
    "history": {
      "mastra": null,
      "openai-agents-sdk": [
        {
          "causes": [
            "method"
          ],
          "date": "2026-10-08",
          "delta": -0.3,
          "from": 86.5,
          "fromGrade": "AA",
          "to": 86.2,
          "toGrade": "AA"
        }
      ]
    },
    "job": {
      "capability": "agent.framework",
      "name": "Agent frameworks"
    },
    "others": [
      {
        "json": "https://www.anchorterminal.com/compare/agentos-vs-mastra.json",
        "title": "AgentOS vs Mastra",
        "url": "https://www.anchorterminal.com/compare/agentos-vs-mastra"
      },
      {
        "json": "https://www.anchorterminal.com/compare/agentos-vs-openai-agents-sdk.json",
        "title": "AgentOS vs OpenAI Agents SDK",
        "url": "https://www.anchorterminal.com/compare/agentos-vs-openai-agents-sdk"
      },
      {
        "json": "https://www.anchorterminal.com/compare/agno-vs-mastra.json",
        "title": "Agno vs Mastra",
        "url": "https://www.anchorterminal.com/compare/agno-vs-mastra"
      },
      {
        "json": "https://www.anchorterminal.com/compare/agno-vs-openai-agents-sdk.json",
        "title": "Agno vs OpenAI Agents SDK",
        "url": "https://www.anchorterminal.com/compare/agno-vs-openai-agents-sdk"
      },
      {
        "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra.json",
        "title": "BoxLang AI vs Mastra",
        "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra"
      },
      {
        "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-openai-agents-sdk.json",
        "title": "BoxLang AI vs OpenAI Agents SDK",
        "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-openai-agents-sdk"
      },
      {
        "json": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-mastra.json",
        "title": "Claude Agent SDK vs Mastra",
        "url": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-mastra"
      },
      {
        "json": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-openai-agents-sdk.json",
        "title": "Claude Agent SDK vs OpenAI Agents SDK",
        "url": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-openai-agents-sdk"
      },
      {
        "json": "https://www.anchorterminal.com/compare/crewai-vs-mastra.json",
        "title": "CrewAI vs Mastra",
        "url": "https://www.anchorterminal.com/compare/crewai-vs-mastra"
      },
      {
        "json": "https://www.anchorterminal.com/compare/crewai-vs-openai-agents-sdk.json",
        "title": "CrewAI vs OpenAI Agents SDK",
        "url": "https://www.anchorterminal.com/compare/crewai-vs-openai-agents-sdk"
      },
      {
        "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra.json",
        "title": "Cursor Agent SDK vs Mastra",
        "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra"
      },
      {
        "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-openai-agents-sdk.json",
        "title": "Cursor Agent SDK vs OpenAI Agents SDK",
        "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-openai-agents-sdk"
      },
      {
        "json": "https://www.anchorterminal.com/compare/docker-agent-vs-mastra.json",
        "title": "Docker Agent vs Mastra",
        "url": "https://www.anchorterminal.com/compare/docker-agent-vs-mastra"
      },
      {
        "json": "https://www.anchorterminal.com/compare/docker-agent-vs-openai-agents-sdk.json",
        "title": "Docker Agent vs OpenAI Agents SDK",
        "url": "https://www.anchorterminal.com/compare/docker-agent-vs-openai-agents-sdk"
      },
      {
        "json": "https://www.anchorterminal.com/compare/google-adk-vs-mastra.json",
        "title": "Agent Development Kit (ADK) vs Mastra",
        "url": "https://www.anchorterminal.com/compare/google-adk-vs-mastra"
      },
      {
        "json": "https://www.anchorterminal.com/compare/google-adk-vs-openai-agents-sdk.json",
        "title": "Agent Development Kit (ADK) vs OpenAI Agents SDK",
        "url": "https://www.anchorterminal.com/compare/google-adk-vs-openai-agents-sdk"
      },
      {
        "json": "https://www.anchorterminal.com/compare/guilds-run-vs-mastra.json",
        "title": "guilds.run vs Mastra",
        "url": "https://www.anchorterminal.com/compare/guilds-run-vs-mastra"
      },
      {
        "json": "https://www.anchorterminal.com/compare/guilds-run-vs-openai-agents-sdk.json",
        "title": "guilds.run vs OpenAI Agents SDK",
        "url": "https://www.anchorterminal.com/compare/guilds-run-vs-openai-agents-sdk"
      },
      {
        "json": "https://www.anchorterminal.com/compare/langgraph-vs-mastra.json",
        "title": "LangGraph vs Mastra",
        "url": "https://www.anchorterminal.com/compare/langgraph-vs-mastra"
      },
      {
        "json": "https://www.anchorterminal.com/compare/langgraph-vs-openai-agents-sdk.json",
        "title": "LangGraph vs OpenAI Agents SDK",
        "url": "https://www.anchorterminal.com/compare/langgraph-vs-openai-agents-sdk"
      },
      {
        "json": "https://www.anchorterminal.com/compare/llamaindex-vs-mastra.json",
        "title": "LlamaIndex Framework vs Mastra",
        "url": "https://www.anchorterminal.com/compare/llamaindex-vs-mastra"
      },
      {
        "json": "https://www.anchorterminal.com/compare/llamaindex-vs-openai-agents-sdk.json",
        "title": "LlamaIndex Framework vs OpenAI Agents SDK",
        "url": "https://www.anchorterminal.com/compare/llamaindex-vs-openai-agents-sdk"
      },
      {
        "json": "https://www.anchorterminal.com/compare/mastra-vs-microsoft-agent-framework.json",
        "title": "Mastra vs Microsoft Agent Framework",
        "url": "https://www.anchorterminal.com/compare/mastra-vs-microsoft-agent-framework"
      },
      {
        "json": "https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai.json",
        "title": "Mastra vs Pydantic AI",
        "url": "https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai"
      },
      {
        "json": "https://www.anchorterminal.com/compare/mastra-vs-smolagents.json",
        "title": "Mastra vs smolagents",
        "url": "https://www.anchorterminal.com/compare/mastra-vs-smolagents"
      },
      {
        "json": "https://www.anchorterminal.com/compare/mastra-vs-strands-agents.json",
        "title": "Mastra vs Strands Agents",
        "url": "https://www.anchorterminal.com/compare/mastra-vs-strands-agents"
      },
      {
        "json": "https://www.anchorterminal.com/compare/mastra-vs-tradingagents.json",
        "title": "Mastra vs TradingAgents",
        "url": "https://www.anchorterminal.com/compare/mastra-vs-tradingagents"
      },
      {
        "json": "https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk.json",
        "title": "Mastra vs AI SDK",
        "url": "https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk"
      },
      {
        "json": "https://www.anchorterminal.com/compare/microsoft-agent-framework-vs-openai-agents-sdk.json",
        "title": "Microsoft Agent Framework vs OpenAI Agents SDK",
        "url": "https://www.anchorterminal.com/compare/microsoft-agent-framework-vs-openai-agents-sdk"
      },
      {
        "json": "https://www.anchorterminal.com/compare/openai-agents-sdk-vs-pydantic-ai.json",
        "title": "OpenAI Agents SDK vs Pydantic AI",
        "url": "https://www.anchorterminal.com/compare/openai-agents-sdk-vs-pydantic-ai"
      },
      {
        "json": "https://www.anchorterminal.com/compare/openai-agents-sdk-vs-smolagents.json",
        "title": "OpenAI Agents SDK vs smolagents",
        "url": "https://www.anchorterminal.com/compare/openai-agents-sdk-vs-smolagents"
      },
      {
        "json": "https://www.anchorterminal.com/compare/openai-agents-sdk-vs-strands-agents.json",
        "title": "OpenAI Agents SDK vs Strands Agents",
        "url": "https://www.anchorterminal.com/compare/openai-agents-sdk-vs-strands-agents"
      },
      {
        "json": "https://www.anchorterminal.com/compare/openai-agents-sdk-vs-tradingagents.json",
        "title": "OpenAI Agents SDK vs TradingAgents",
        "url": "https://www.anchorterminal.com/compare/openai-agents-sdk-vs-tradingagents"
      },
      {
        "json": "https://www.anchorterminal.com/compare/openai-agents-sdk-vs-vercel-ai-sdk.json",
        "title": "OpenAI Agents SDK vs AI SDK",
        "url": "https://www.anchorterminal.com/compare/openai-agents-sdk-vs-vercel-ai-sdk"
      }
    ],
    "panel": null,
    "scores": [
      {
        "by": 2,
        "edge": "mastra",
        "key": "reliability",
        "mastra": 87,
        "name": "Reliability",
        "openai-agents-sdk": 85,
        "weight": 16
      },
      {
        "key": "performance",
        "name": "Performance",
        "pending": true,
        "weight": 10
      },
      {
        "by": 3,
        "edge": "mastra",
        "key": "schema",
        "mastra": 98,
        "name": "Schema \u0026 documentation",
        "openai-agents-sdk": 95,
        "weight": 13
      },
      {
        "by": 5,
        "edge": "openai-agents-sdk",
        "key": "ergonomics",
        "mastra": 92,
        "name": "Agent ergonomics",
        "openai-agents-sdk": 97,
        "weight": 13
      },
      {
        "by": 13,
        "edge": "openai-agents-sdk",
        "key": "security",
        "mastra": 67,
        "name": "Security \u0026 auth",
        "openai-agents-sdk": 80,
        "weight": 14
      },
      {
        "by": 0,
        "edge": "",
        "key": "payments",
        "mastra": 60,
        "name": "Payments \u0026 pricing",
        "openai-agents-sdk": 60,
        "weight": 10
      },
      {
        "key": "tasks",
        "name": "Task success",
        "pending": true,
        "weight": 10
      },
      {
        "by": 4,
        "edge": "openai-agents-sdk",
        "key": "maintenance",
        "mastra": 96,
        "name": "Maintenance \u0026 community",
        "openai-agents-sdk": 100,
        "weight": 7
      },
      {
        "by": 17,
        "edge": "openai-agents-sdk",
        "key": "transparency",
        "mastra": 72,
        "name": "Transparency \u0026 trust",
        "openai-agents-sdk": 89,
        "weight": 7
      }
    ],
    "summary": "OpenAI Agents SDK scores 86.2 (AA) on agent readiness against Mastra's 74.2 (BB), and leads in 4 of 7 scored categories. Both do agent frameworks.",
    "tasks": null,
    "tutorials": [],
    "verdicts": {
      "mastra": "A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes.",
      "openai-agents-sdk": "MCP in about 11 lines, with static and dynamic tool filters and require_approval. Tracing on by default, with model and tool content, sent to OpenAI."
    }
  },
  "kind": "anchor.page",
  "links": {
    "api": "https://www.anchorterminal.com/api/v1/index.json",
    "html": "https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk",
    "json": "https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk.json",
    "llms": "https://www.anchorterminal.com/llms.txt",
    "markdown": "https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk.md",
    "mcp": "https://www.anchorterminal.com/mcp",
    "slim": "https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk.min.md"
  },
  "markdown": "OpenAI Agents SDK scores 86.2 (AA) on agent readiness against Mastra's 74.2 (BB), and leads in 4 of 7 scored categories. Both do agent frameworks.\n\n- Mastra: grade BB, 74.2/100, rank #91 of 1510. Markdown https://www.anchorterminal.com/tools/mastra.md · JSON https://www.anchorterminal.com/api/v1/tools/mastra.json\n- OpenAI Agents SDK: grade AA, 86.2/100, rank #3 of 1510. Markdown https://www.anchorterminal.com/tools/openai-agents-sdk.md · JSON https://www.anchorterminal.com/api/v1/tools/openai-agents-sdk.json\n- Best agent frameworks and SDKs: https://www.anchorterminal.com/best/frameworks/index.md\n- All 171 frameworks comparisons: https://www.anchorterminal.com/compare/frameworks/index.md\n\n## Which one, for what\n\n### Mastra (BB)\n\nGood for: TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.\n\nWatch for: Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026\n\n### OpenAI Agents SDK (AA)\n\nGood for: Teams that want hand-offs, guardrails and approvals with little code, and are happy with OpenAI's tracing or will turn it off.\n\nAhead on:\n- Agent ergonomics, 97 against 92\n- Security \u0026 auth, 80 against 67\n- Transparency \u0026 trust, 89 against 72\n\nAlso in its favour:\n- No incidents deducted, where Mastra loses 8 points for them\n\nWatch for: Tracing on by default, with model and tool content, sent to OpenAI\n\n\n## Why the edge\n\n### Transparency \u0026 trust: OpenAI Agents SDK +17\n\n- Mastra (72): Apache 2.0 for the core, with ee/ directories source-available under the Mastra Enterprise License (25). The privacy policy (last published 25 April 2025) covers the website, the Teams plan states six months' retention, and the subprocessor list sits in a trust centre our reader couldn't render (15). Migration guides and deprecation warnings, without dated removal windows (12). Every telemetry stream is documented with links to its source and one opt-out, and the reference now spells out what the project identifiers can be correlated with (20).\n- OpenAI Agents SDK (89): MIT (30). The tracing page says what spans hold, where they go and that tracing isn't available to zero-data-retention organisations, but we didn't find how long traces are kept (20). Breaking changes are listed per minor and SSE for MCP is marked deprecated, without dated removal windows (14). Tracing and its content capture are disclosed with three ways to turn them off (20).\n\n### Security \u0026 auth: OpenAI Agents SDK +13\n\n- Mastra (67): The CLI sends PostHog analytics, server startup sends token counts per model and a count of registered agents, tools and MCP servers, and Studio sends browser analytics, all on by default and documented, with one opt-out, MASTRA_TELEMETRY_DISABLED=1. Since #26986 (16 October 2026) each server process also reports token use per provider and model every 15 minutes, and the telemetry reference read on 6 November says server events carry a project identifier that is a raw Platform UUID or a hash of the Git origin remote, so they \"aren't anonymous\" (12). requireToolApproval on agents and MCP servers, allowedHosts for MCP HTTP, a curated environment for stdio servers, and sandboxed workspaces (20). PromptInjectionDetector, PII and moderation processors, and docs that call tool results untrusted model input (15). Built-in tracing with OpenTelemetry and other exporters (15). No SECURITY.md, no security.txt and no bug bounty found. A blog post says Mastra is SOC 2 Type II audited, which isn't scored for a framework, and we found no public advisory from Mastra about the June incident (5). Framework reading. 15+20+15+15+5 = 70 on 6 October, 12+20+15+15+5 = 67 on 6 November.\n- OpenAI Agents SDK (80): Tracing is on by default and trace_include_sensitive_data defaults to true, so model and function-call inputs and outputs go to OpenAI's Traces dashboard. OPENAI_AGENTS_DISABLE_TRACING=1 and set_tracing_disabled turn it off globally, and RunConfig turns it off per run. Through 0.23.1 the per-run opt-out didn't apply inside the caller's own trace. The fix shipped in 0.24.0 on 15 October (10). Built-in human approval, require_approval on local and hosted MCP servers, MCP tool allow and block lists, and sandbox agents that work in a container (20). Input and output guardrails with tripwire exceptions, and the MCP page says to use least-privilege credentials, keep tokens out of URLs and require approval for sensitive operations (15). Built-in tracing with third-party processors such as Weights \u0026 Biases and Datadog (15). SECURITY.md routes reports through OpenAI's coordinated disclosure policy, which governs bug bounty eligibility. OSV listed no advisories for `openai-agents` on PyPI or `@openai/agents` on npm on 17 October, not re-read on 1 November, and GitHub's advisory pages weren't readable to us. On main, unreleased on 1 November, pyproject.toml raises the `mcp` floor to 1.30.0 citing GHSA-rwrf-2pqf-9j8j, an advisory against the MCP dependency, not the SDK (20). Framework reading, so SOC 2 isn't scored.\n\n### Agent ergonomics: OpenAI Agents SDK +5\n\n- Mastra (92): An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10).\n- OpenAI Agents SDK (97): An agent with one MCP server is about 11 lines, with static and dynamic tool filters and tool-list caching (25). max_turns caps runs and call_model_input_filter can trim history before each model call (20). Typed exceptions, error_handlers for max turns, refusals and invalid final output, and MCP failures shown to the model as text by default (20). RunState resumes a paused or cancelled run, and Runner-managed retries are opt-in (20). An agent needs a name and instructions, but 0.20.0 changed the default model (7). Python and JavaScript (5).\n\n## Score by category\n\n| Category | Weight | Mastra | OpenAI Agents SDK | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 87 | 85 | Mastra +2 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 98 | 95 | Mastra +3 |\n| Agent ergonomics | 13% (16.2 this run) | 92 | 97 | OpenAI Agents SDK +5 |\n| Security \u0026 auth | 14% (17.5 this run) | 67 | 80 | OpenAI Agents SDK +13 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 60 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 96 | 100 | OpenAI Agents SDK +4 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 72 | 89 | OpenAI Agents SDK +17 |\n| Negative events | ≤15 | -8 | 0 | |\n| **Total** | | **74.2 · BB** | **86.2 · AA** | |\n\n## Facts side by side\n\n| Fact | Mastra | OpenAI Agents SDK |\n| --- | --- | --- |\n| Kind | Agent framework | Agent framework |\n| Vendor | Kepler Software, Inc. | OpenAI |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports |  |  |\n| Auth | API key | API key |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing | MIT |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-11-04 | 2026-10-15 |\n| Terms last updated | 2026-10-26 | couldn't be read |\n| Privacy policy last updated | no date given | couldn't be read |\n| Customer content may train models | yes | couldn't be read |\n| Terms restrict automated access | yes | couldn't be read |\n| Terms restrict benchmarking | not found in the text | couldn't be read |\n| Terms or service can change without notice | yes | couldn't be read |\n| Arbitration or class-action waiver | yes | couldn't be read |\n| Popularity | 29k stars, 3.1M npm/wk | 30k stars, 1.3M npm/wk, 3M PyPI/wk |\n| Agent reviews | none | 3.9/5 (8) |\n\n## How the scores have moved\n\n### Mastra\n\nNo score change since it was listed.\n\n### OpenAI Agents SDK\n\n- -0.3 on 8 October 2026: checklist\n\n## Verdicts\n\n**Mastra.** A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes.\n\n**OpenAI Agents SDK.** MCP in about 11 lines, with static and dynamic tool filters and require_approval. Tracing on by default, with model and tool content, sent to OpenAI.\n\n## Before you call either\n\n### Mastra\n\n1. Set MASTRA_TELEMETRY_DISABLED=1 in every environment that runs the CLI, the server or Studio\n2. Pin exact versions with a lockfile, and make sure no 17 June 2026 release such as @mastra/core 1.42.1 is installed\n3. Set requireToolApproval on MCP servers that write, and allowedHosts when server URLs come from configuration\n4. Add PromptInjectionDetector as an input processor when tools return web or user content\n5. Use supervisor agents through generate() or stream(). `.network()` is deprecated\n\n### OpenAI Agents SDK\n\n1. Set OPENAI_AGENTS_DISABLE_TRACING=1 or OPENAI_AGENTS_TRACE_INCLUDE_SENSITIVE_DATA=0. On versions before 0.24.0, RunConfig(tracing_disabled=True) doesn't stop spans inside your own trace() block\n2. Pin to a minor version. Each 0.Y can break\n3. Set require_approval on MCP servers that write\n4. Name the model explicitly. The default changed in 0.20.0\n5. Use an error handler for max_turns instead of catching MaxTurnsExceeded\n\n## Questions\n\n### Which is better for AI agents, Mastra or OpenAI Agents SDK?\n\nOpenAI Agents SDK scores 86.2 (AA) on agent readiness against Mastra's 74.2 (BB), and leads in 4 of 7 scored categories.\n\n### Are Mastra and OpenAI Agents SDK open source?\n\nYes. Mastra is open source (Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing). OpenAI Agents SDK is open source (MIT).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk.json, and with the fewest tokens: https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"mastra\", \"b\": \"openai-agents-sdk\"}`. From a terminal: `anchor compare mastra openai-agents-sdk`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/mastra.json and https://www.anchorterminal.com/api/v1/tools/openai-agents-sdk.json\n\n## Other comparisons with Mastra or OpenAI Agents SDK\n\n- [AgentOS vs Mastra](https://www.anchorterminal.com/compare/agentos-vs-mastra.md)\n- [AgentOS vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/agentos-vs-openai-agents-sdk.md)\n- [Agno vs Mastra](https://www.anchorterminal.com/compare/agno-vs-mastra.md)\n- [Agno vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/agno-vs-openai-agents-sdk.md)\n- [BoxLang AI vs Mastra](https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra.md)\n- [BoxLang AI vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/boxlang-ai-vs-openai-agents-sdk.md)\n- [Claude Agent SDK vs Mastra](https://www.anchorterminal.com/compare/claude-agent-sdk-vs-mastra.md)\n- [Claude Agent SDK vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/claude-agent-sdk-vs-openai-agents-sdk.md)\n- [CrewAI vs Mastra](https://www.anchorterminal.com/compare/crewai-vs-mastra.md)\n- [CrewAI vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/crewai-vs-openai-agents-sdk.md)\n- [Cursor Agent SDK vs Mastra](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra.md)\n- [Cursor Agent SDK vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-openai-agents-sdk.md)\n- [Docker Agent vs Mastra](https://www.anchorterminal.com/compare/docker-agent-vs-mastra.md)\n- [Docker Agent vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/docker-agent-vs-openai-agents-sdk.md)\n- [Agent Development Kit (ADK) vs Mastra](https://www.anchorterminal.com/compare/google-adk-vs-mastra.md)\n- [Agent Development Kit (ADK) vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/google-adk-vs-openai-agents-sdk.md)\n- [guilds.run vs Mastra](https://www.anchorterminal.com/compare/guilds-run-vs-mastra.md)\n- [guilds.run vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/guilds-run-vs-openai-agents-sdk.md)\n- [LangGraph vs Mastra](https://www.anchorterminal.com/compare/langgraph-vs-mastra.md)\n- [LangGraph vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/langgraph-vs-openai-agents-sdk.md)\n- [LlamaIndex Framework vs Mastra](https://www.anchorterminal.com/compare/llamaindex-vs-mastra.md)\n- [LlamaIndex Framework vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/llamaindex-vs-openai-agents-sdk.md)\n- [Mastra vs Microsoft Agent Framework](https://www.anchorterminal.com/compare/mastra-vs-microsoft-agent-framework.md)\n- [Mastra vs Pydantic AI](https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai.md)\n- [Mastra vs smolagents](https://www.anchorterminal.com/compare/mastra-vs-smolagents.md)\n- [Mastra vs Strands Agents](https://www.anchorterminal.com/compare/mastra-vs-strands-agents.md)\n- [Mastra vs TradingAgents](https://www.anchorterminal.com/compare/mastra-vs-tradingagents.md)\n- [Mastra vs AI SDK](https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk.md)\n- [Microsoft Agent Framework vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/microsoft-agent-framework-vs-openai-agents-sdk.md)\n- [OpenAI Agents SDK vs Pydantic AI](https://www.anchorterminal.com/compare/openai-agents-sdk-vs-pydantic-ai.md)\n- [OpenAI Agents SDK vs smolagents](https://www.anchorterminal.com/compare/openai-agents-sdk-vs-smolagents.md)\n- [OpenAI Agents SDK vs Strands Agents](https://www.anchorterminal.com/compare/openai-agents-sdk-vs-strands-agents.md)\n- [OpenAI Agents SDK vs TradingAgents](https://www.anchorterminal.com/compare/openai-agents-sdk-vs-tradingagents.md)\n- [OpenAI Agents SDK vs AI SDK](https://www.anchorterminal.com/compare/openai-agents-sdk-vs-vercel-ai-sdk.md)\n",
  "meta": {
    "attribution": "Anchor Terminal (https://www.anchorterminal.com)",
    "attributionRequired": true,
    "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)",
    "docs": "https://www.anchorterminal.com/docs/",
    "generatedAt": "2026-11-07",
    "license": "CC-BY-4.0",
    "method": "https://www.anchorterminal.com/benchmark/",
    "methodology": "0.7",
    "openapi": "https://www.anchorterminal.com/openapi.json",
    "preview": false,
    "run": "2026-10-01",
    "runLabel": "October 2026 research run",
    "terms": "https://www.anchorterminal.com/terms/#data"
  },
  "page": {
    "breadcrumbs": [
      {
        "name": "Home",
        "url": "https://www.anchorterminal.com/"
      },
      {
        "name": "Compare",
        "url": "https://www.anchorterminal.com/compare/"
      },
      {
        "name": "Mastra vs OpenAI Agents SDK",
        "url": ""
      }
    ],
    "description": "OpenAI Agents SDK scores 86.2 (AA) to Mastra's 74.2 (BB) for agent frameworks. Prices, MCP, x402, uptime and agent notes side by side.",
    "facts": [
      "Mastra BB 74.2",
      "OpenAI Agents SDK AA 86.2",
      "scores"
    ],
    "h1": "Mastra vs OpenAI Agents SDK",
    "image": "https://www.anchorterminal.com/assets/og/default.png",
    "path": "/compare/mastra-vs-openai-agents-sdk",
    "published": "2026-10-01",
    "section": "tools",
    "title": "Mastra vs OpenAI Agents SDK for AI agents in 2026: scores and prices",
    "toc": null,
    "updated": "2026-11-07",
    "url": "https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk"
  },
  "tokens": {
    "markdown": 3800,
    "slim": 1830
  },
  "version": 1
}
