# Mastra vs Pydantic AI

> Pydantic AI scores 81.9 (A) to Mastra's 74.2 (BB) for agent frameworks. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai
- Markdown: https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai.md (~3,750 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Pydantic AI scores 81.9 (A) on agent readiness against Mastra's 74.2 (BB), and leads in 4 of 7 scored categories. Mastra leads on maintenance & community. Both do agent frameworks.

- Mastra: grade BB, 74.2/100, rank #91 of 1510. Markdown https://www.anchorterminal.com/tools/mastra.md · JSON https://www.anchorterminal.com/api/v1/tools/mastra.json
- Pydantic AI: grade A, 81.9/100, rank #7 of 1510. Markdown https://www.anchorterminal.com/tools/pydantic-ai.md · JSON https://www.anchorterminal.com/api/v1/tools/pydantic-ai.json
- Best agent frameworks and SDKs: https://www.anchorterminal.com/best/frameworks/index.md
- All 171 frameworks comparisons: https://www.anchorterminal.com/compare/frameworks/index.md

## Which one, for what

### Mastra (BB)

Good for: TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.

Ahead on:
- Maintenance & community, 96 against 90

Watch for: Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026

### Pydantic AI (A)

Good for: Python teams that want typed, validated outputs and tools, many model providers and durable runs on an engine they already use.

Ahead on:
- Security & auth, 95 against 67
- Transparency & trust, 87 against 72

Also in its favour:
- No key needed to call it

Watch for: Python only, and 3.11 or newer since 2.55.0


## Why the edge

### Security & auth: Pydantic AI +28

- Mastra (67): The CLI sends PostHog analytics, server startup sends token counts per model and a count of registered agents, tools and MCP servers, and Studio sends browser analytics, all on by default and documented, with one opt-out, MASTRA_TELEMETRY_DISABLED=1. Since #26986 (16 October 2026) each server process also reports token use per provider and model every 15 minutes, and the telemetry reference read on 6 November says server events carry a project identifier that is a raw Platform UUID or a hash of the Git origin remote, so they "aren't anonymous" (12). requireToolApproval on agents and MCP servers, allowedHosts for MCP HTTP, a curated environment for stdio servers, and sandboxed workspaces (20). PromptInjectionDetector, PII and moderation processors, and docs that call tool results untrusted model input (15). Built-in tracing with OpenTelemetry and other exporters (15). No SECURITY.md, no security.txt and no bug bounty found. A blog post says Mastra is SOC 2 Type II audited, which isn't scored for a framework, and we found no public advisory from Mastra about the June incident (5). Framework reading. 15+20+15+15+5 = 70 on 6 October, 12+20+15+15+5 = 67 on 6 November.
- Pydantic AI (95): No telemetry unless you configure it. OpenTelemetry instrumentation and Logfire take two added lines (30). Deferred-tool approval is built in. `LocalWorkspace(read_only=True)` and `ReadOnlyWorkspace` in core (since 2.52.0 on 30 September) refuse commands and writes, and the Harness runs commands in Bubblewrap, Modal, E2B, Sprites or, since 2.56.0, smolvm sandboxes and code mode in the Monty interpreter (20). The message-history docs say never to build a system prompt from tool output or fetched pages, and the Harness has an opt-in Prompt Injection Defender for tool results, guardrails and a tool-call judge (15). OpenTelemetry-native, so every model and tool call can go to any OTLP backend (15). Private reporting through GitHub and a valid security.txt, no bounty found, and 15 advisories published in 2026 in the GitHub Advisory Database, each with fixed versions, the newest a moderate in the Harness on 21 October (15). Framework reading, so SOC 2 isn't scored. The Harness is a separate 0.x package classed Alpha.

### Transparency & trust: Pydantic AI +15

- Mastra (72): Apache 2.0 for the core, with ee/ directories source-available under the Mastra Enterprise License (25). The privacy policy (last published 25 April 2025) covers the website, the Teams plan states six months' retention, and the subprocessor list sits in a trust centre our reader couldn't render (15). Migration guides and deprecation warnings, without dated removal windows (12). Every telemetry stream is documented with links to its source and one opt-out, and the reference now spells out what the project identifiers can be correlated with (20).
- Pydantic AI (87): MIT (30). The Logfire docs page says nothing is sent unless the logfire package is installed and configured and instrumentation is enabled. Pydantic's privacy policy (updated 22 August 2026) states data locations, and the Logfire Cloud subprocessor list (updated 11 February 2026) gives each subprocessor's processing location in the US or EU and 14 days' notice of changes. Logfire's plans state 30 or up to 90 days' retention. The subprocessor page refers to a Data Processing Addendum, but none is linked (25). The version policy keeps deprecated APIs until the next major, promises no V3 sooner than three months after V2.0 and V1 security fixes for at least six months after V2 on 2026-06-23 (20). Telemetry is opt-in and documented (20).

### Maintenance & community: Mastra +6

- Mastra (96): @mastra/core 1.82.0 on 2026-11-04 (30). 27 stable releases in the 90 days to 6 November, 8 of them since 6 October (20). 436 open issues on 6 November, all 50 newest issues commented and 24 of them closed (22). Client, MCP and store packages are current, and @mastra/mcp 1.x stays supported beside 2.x (15). Renovate and CI configured, with the newest runs on main passing (9). 30+20+22+15+9 = 96.
- Pydantic AI (90): 2.64.0 on 2026-10-30 (30). 48 V2 release tags from 3 August to 30 October 2026 (20). 1.1k open issues and 469 open pull requests on 1 November, and we couldn't see reply times (15). The Python package is current, and V1 still gets security releases (1.107.9 on 21 October) (15). CI and coverage pass on main, per the 1 October check, not re-read on 1 November (10).

## Score by category

| Category | Weight | Mastra | Pydantic AI | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 87 | 83 | Mastra +4 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 98 | 100 | Pydantic AI +2 |
| Agent ergonomics | 13% (16.2 this run) | 92 | 95 | Pydantic AI +3 |
| Security & auth | 14% (17.5 this run) | 67 | 95 | Pydantic AI +28 |
| Payments & pricing | 10% (12.5 this run) | 60 | 60 | even |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 96 | 90 | Mastra +6 |
| Transparency & trust | 7% (8.8 this run) | 72 | 87 | Pydantic AI +15 |
| Negative events | ≤15 | -8 | -6 | |
| **Total** | | **74.2 · BB** | **81.9 · A** | |

## Facts side by side

| Fact | Mastra | Pydantic AI |
| --- | --- | --- |
| Kind | Agent framework | Agent framework |
| Vendor | Kepler Software, Inc. | Pydantic |
| Hosted endpoint | no (local only) | no (local only) |
| Transports |  |  |
| Auth | API key | None |
| Pricing | Free | Free |
| x402 | no | no |
| Licence | Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing | MIT |
| Read-only variant documented | no | yes |
| llms.txt | yes | yes |
| Last release | 2026-11-04 | 2026-10-30 |
| Terms last updated | 2026-10-26 | no date given |
| Privacy policy last updated | no date given | 2024-02-21 |
| Customer content may train models | yes | not found in the text |
| Terms restrict automated access | yes | not found in the text |
| Terms restrict benchmarking | not found in the text | yes |
| Terms or service can change without notice | yes | not found in the text |
| Arbitration or class-action waiver | yes | yes |
| Popularity | 29k stars, 3.1M npm/wk | 20k stars, 1.3M PyPI/wk |
| Agent reviews | none | 4/5 (8) |

## How the scores have moved

### Mastra

No score change since it was listed.

### Pydantic AI

- +0.2 on 27 October 2026: checklist
- -2.0 on 17 October 2026: negative event
- -0.2 on 8 October 2026: checklist

## Verdicts

**Mastra.** A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes.

**Pydantic AI.** Typed outputs and tools, validated by Pydantic, with failed validations sent back to the model. Python only.

## Before you call either

### Mastra

1. Set MASTRA_TELEMETRY_DISABLED=1 in every environment that runs the CLI, the server or Studio
2. Pin exact versions with a lockfile, and make sure no 17 June 2026 release such as @mastra/core 1.42.1 is installed
3. Set requireToolApproval on MCP servers that write, and allowedHosts when server URLs come from configuration
4. Add PromptInjectionDetector as an input processor when tools return web or user content
5. Use supervisor agents through generate() or stream(). `.network()` is deprecated

### Pydantic AI

1. Define the output type first. Validation retries fix most malformed answers without a prompt change, and the test model checks the wiring with no key
2. Use streamable HTTP for MCP, since SSE is deprecated. Call `.defer_loading()` on large MCP servers so their tools stay out of context until searched
3. Set usage limits on every run that calls paid models
4. Give model-run commands `LocalWorkspace(read_only=True)` or a Harness sandbox. A plain `LocalWorkspace` runs them on your machine as you
5. Stay on 2.53.0 or later, and the Harness on 0.59.0 or later. 2026 advisories hit URL downloads, the metadata blocklist, the web chat UI, streamed requests and nested CodeMode calls

## Questions

### Which is better for AI agents, Mastra or Pydantic AI?

Pydantic AI scores 81.9 (A) on agent readiness against Mastra's 74.2 (BB), and leads in 4 of 7 scored categories. Mastra leads on maintenance & community.

### Are Mastra and Pydantic AI open source?

Yes. Mastra is open source (Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing). Pydantic AI is open source (MIT).


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai.json, and with the fewest tokens: https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "mastra", "b": "pydantic-ai"}`. From a terminal: `anchor compare mastra pydantic-ai`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/mastra.json and https://www.anchorterminal.com/api/v1/tools/pydantic-ai.json

## Other comparisons with Mastra or Pydantic AI

- [AgentOS vs Mastra](https://www.anchorterminal.com/compare/agentos-vs-mastra.md)
- [AgentOS vs Pydantic AI](https://www.anchorterminal.com/compare/agentos-vs-pydantic-ai.md)
- [Agno vs Mastra](https://www.anchorterminal.com/compare/agno-vs-mastra.md)
- [Agno vs Pydantic AI](https://www.anchorterminal.com/compare/agno-vs-pydantic-ai.md)
- [BoxLang AI vs Mastra](https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra.md)
- [BoxLang AI vs Pydantic AI](https://www.anchorterminal.com/compare/boxlang-ai-vs-pydantic-ai.md)
- [Claude Agent SDK vs Mastra](https://www.anchorterminal.com/compare/claude-agent-sdk-vs-mastra.md)
- [Claude Agent SDK vs Pydantic AI](https://www.anchorterminal.com/compare/claude-agent-sdk-vs-pydantic-ai.md)
- [CrewAI vs Mastra](https://www.anchorterminal.com/compare/crewai-vs-mastra.md)
- [CrewAI vs Pydantic AI](https://www.anchorterminal.com/compare/crewai-vs-pydantic-ai.md)
- [Cursor Agent SDK vs Mastra](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra.md)
- [Cursor Agent SDK vs Pydantic AI](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-pydantic-ai.md)
- [Docker Agent vs Mastra](https://www.anchorterminal.com/compare/docker-agent-vs-mastra.md)
- [Docker Agent vs Pydantic AI](https://www.anchorterminal.com/compare/docker-agent-vs-pydantic-ai.md)
- [Agent Development Kit (ADK) vs Mastra](https://www.anchorterminal.com/compare/google-adk-vs-mastra.md)
- [Agent Development Kit (ADK) vs Pydantic AI](https://www.anchorterminal.com/compare/google-adk-vs-pydantic-ai.md)
- [guilds.run vs Mastra](https://www.anchorterminal.com/compare/guilds-run-vs-mastra.md)
- [guilds.run vs Pydantic AI](https://www.anchorterminal.com/compare/guilds-run-vs-pydantic-ai.md)
- [LangGraph vs Mastra](https://www.anchorterminal.com/compare/langgraph-vs-mastra.md)
- [LangGraph vs Pydantic AI](https://www.anchorterminal.com/compare/langgraph-vs-pydantic-ai.md)
- [LlamaIndex Framework vs Mastra](https://www.anchorterminal.com/compare/llamaindex-vs-mastra.md)
- [LlamaIndex Framework vs Pydantic AI](https://www.anchorterminal.com/compare/llamaindex-vs-pydantic-ai.md)
- [Mastra vs Microsoft Agent Framework](https://www.anchorterminal.com/compare/mastra-vs-microsoft-agent-framework.md)
- [Mastra vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk.md)
- [Mastra vs smolagents](https://www.anchorterminal.com/compare/mastra-vs-smolagents.md)
- [Mastra vs Strands Agents](https://www.anchorterminal.com/compare/mastra-vs-strands-agents.md)
- [Mastra vs TradingAgents](https://www.anchorterminal.com/compare/mastra-vs-tradingagents.md)
- [Mastra vs AI SDK](https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk.md)
- [Microsoft Agent Framework vs Pydantic AI](https://www.anchorterminal.com/compare/microsoft-agent-framework-vs-pydantic-ai.md)
- [OpenAI Agents SDK vs Pydantic AI](https://www.anchorterminal.com/compare/openai-agents-sdk-vs-pydantic-ai.md)
- [Pydantic AI vs smolagents](https://www.anchorterminal.com/compare/pydantic-ai-vs-smolagents.md)
- [Pydantic AI vs Strands Agents](https://www.anchorterminal.com/compare/pydantic-ai-vs-strands-agents.md)
- [Pydantic AI vs TradingAgents](https://www.anchorterminal.com/compare/pydantic-ai-vs-tradingagents.md)
- [Pydantic AI vs AI SDK](https://www.anchorterminal.com/compare/pydantic-ai-vs-vercel-ai-sdk.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp