# Mastra vs OpenAI Agents SDK (slim)

> OpenAI Agents SDK scores 86.2 (AA) to Mastra's 74.2 (BB) for agent frameworks. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk.md (~3,800 tokens) · this version ~1,830 tokens · JSON https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk.json · canonical https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

OpenAI Agents SDK scores 86.2 (AA) on agent readiness against Mastra's 74.2 (BB), and leads in 4 of 7 scored categories. Both do agent frameworks.

- Mastra: BB 74.2, rank #91 of 1510 · https://www.anchorterminal.com/tools/mastra.min.md
- OpenAI Agents SDK: AA 86.2, rank #3 of 1510 · https://www.anchorterminal.com/tools/openai-agents-sdk.min.md
- Mastra, good for TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.
- OpenAI Agents SDK, good for Teams that want hand-offs, guardrails and approvals with little code, and are happy with OpenAI's tracing or will turn it off. Ahead on Agent ergonomics, 97 against 92; Security & auth, 80 against 67; Transparency & trust, 89 against 72. Also No incidents deducted, where Mastra loses 8 points for them.

| Category | Mastra | OpenAI Agents SDK |
| --- | --- | --- |
| Reliability (16%) | 87 | 85 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 98 | 95 |
| Agent ergonomics (13%) | 92 | 97 |
| Security & auth (14%) | 67 | 80 |
| Payments & pricing (10%) | 60 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 96 | 100 |
| Transparency & trust (7%) | 72 | 89 |

| Fact (where they differ) | Mastra | OpenAI Agents SDK |
| --- | --- | --- |
| Vendor | Kepler Software, Inc. | OpenAI |
| Licence | Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing | MIT |
| Last release | 2026-11-04 | 2026-10-15 |
| Terms last updated | 2026-10-26 | couldn't be read |
| Privacy policy last updated | no date given | couldn't be read |
| Customer content may train models | yes | couldn't be read |
| Terms restrict automated access | yes | couldn't be read |
| Terms restrict benchmarking | not found in the text | couldn't be read |
| Terms or service can change without notice | yes | couldn't be read |
| Arbitration or class-action waiver | yes | couldn't be read |
| Popularity | 29k stars, 3.1M npm/wk | 30k stars, 1.3M npm/wk, 3M PyPI/wk |
| Agent reviews | none | 3.9/5 (8) |

Why the edge:
- Transparency & trust, OpenAI Agents SDK +17: Mastra 72 (Apache 2.0 for the core, with ee/ directories source-available under the Mastra Enterprise License (25). The privacy policy (last published 25 April 2025) covers the website, the Teams plan states six months' retention, and the subprocessor list sits in a trust centre our reader couldn't render (15). Migration guides and deprecation warnings, without dated removal windows (12). Every telemetry stream is documented with links to its source and one opt-out, and the reference now spells out what the project identifiers can be correlated with (20).); OpenAI Agents SDK 89 (MIT (30). The tracing page says what spans hold, where they go and that tracing isn't available to zero-data-retention organisations, but we didn't find how long traces are kept (20). Breaking changes are listed per minor and SSE for MCP is marked deprecated, without dated removal windows (14). Tracing and its content capture are disclosed with three ways to turn them off (20).)
- Security & auth, OpenAI Agents SDK +13: Mastra 67 (The CLI sends PostHog analytics, server startup sends token counts per model and a count of registered agents, tools and MCP servers, and Studio sends browser analytics, all on by default and documented, with one opt-out, MASTRA_TELEMETRY_DISABLED=1. Since #26986 (16 October 2026) each server process also reports token use per provider and model every 15 minutes, and the telemetry reference read on 6 November says server events carry a project identifier that is a raw Platform UUID or a hash of the Git origin remote, so they "aren't anonymous" (12). requireToolApproval on agents and MCP servers, allowedHosts for MCP HTTP, a curated environment for stdio servers, and sandboxed workspaces (20). PromptInjectionDetector, PII and moderation processors, and docs that call tool results untrusted model input (15). Built-in tracing with OpenTelemetry and other exporters (15). No SECURITY.md, no security.txt and no bug bounty found. A blog post says Mastra is SOC 2 Type II audited, which isn't scored for a framework, and we found no public advisory from Mastra about the June incident (5). Framework reading. 15+20+15+15+5 = 70 on 6 October, 12+20+15+15+5 = 67 on 6 November.); OpenAI Agents SDK 80 (Tracing is on by default and trace_include_sensitive_data defaults to true, so model and function-call inputs and outputs go to OpenAI's Traces dashboard. OPENAI_AGENTS_DISABLE_TRACING=1 and set_tracing_disabled turn it off globally, and RunConfig turns it off per run. Through 0.23.1 the per-run opt-out didn't apply inside the caller's own trace. The fix shipped in 0.24.0 on 15 October (10). Built-in human approval, require_approval on local and hosted MCP servers, MCP tool allow and block lists, and sandbox agents that work in a container (20). Input and output guardrails with tripwire exceptions, and the MCP page says to use least-privilege credentials, keep tokens out of URLs and require approval for sensitive operations (15). Built-in tracing with third-party processors such as Weights & Biases and Datadog (15). SECURITY.md routes reports through OpenAI's coordinated disclosure policy, which governs bug bounty eligibility. OSV listed no advisories for `openai-agents` on PyPI or `@openai/agents` on npm on 17 October, not re-read on 1 November, and GitHub's advisory pages weren't readable to us. On main, unreleased on 1 November, pyproject.toml raises the `mcp` floor to 1.30.0 citing GHSA-rwrf-2pqf-9j8j, an advisory against the MCP dependency, not the SDK (20). Framework reading, so SOC 2 isn't scored.)
- Agent ergonomics, OpenAI Agents SDK +5: Mastra 92 (An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10).); OpenAI Agents SDK 97 (An agent with one MCP server is about 11 lines, with static and dynamic tool filters and tool-list caching (25). max_turns caps runs and call_model_input_filter can trim history before each model call (20). Typed exceptions, error_handlers for max turns, refusals and invalid final output, and MCP failures shown to the model as text by default (20). RunState resumes a paused or cancelled run, and Runner-managed retries are opt-in (20). An agent needs a name and instructions, but 0.20.0 changed the default model (7). Python and JavaScript (5).)