Head to head · Agent frameworks · October 2026 research run

Mastra vs smolagents

Mastra scores 74.2 (BB) on agent readiness against smolagents's 58.7 (C), and leads in 6 of 7 scored categories. Both do agent frameworks.

Best agent frameworks and SDKs · All 171 frameworks comparisons

Which one, for what

Mastra BB

Best for TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.

Ahead on

  • Reliability, 87 against 64
  • Schema & documentation, 98 against 81
  • Agent ergonomics, 92 against 68
  • Maintenance & community, 96 against 34
  • Transparency & trust, 72 against 65

Also in its favour

  • Agent-ready, a grade of BB or better

Watch for

Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026

smolagents C

Best for Small Python projects and research that want code-writing agents with minimal abstraction.

Also in its favour

  • No key needed to call it

Watch for

No release since 1.26.0 on 29 May 2026, and few commits to main since August

Why the edge

Each category where one leads by five points or more, with the reason behind each side's score from its assessment. The numbers are in the table below; this is what they stand for.

Maintenance & community Mastra +62

Mastra 96

@mastra/core 1.82.0 on 2026-11-04 (30). 27 stable releases in the 90 days to 6 November, 8 of them since 6 October (20). 436 open issues on 6 November, all 50 newest issues commented and 24 of them closed (22). Client, MCP and store packages are current, and @mastra/mcp 1.x stays supported beside 2.x (15). Renovate and CI configured, with the newest runs on main passing (9). 30+20+22+15+9 = 96.

smolagents 34

v1.26.0 on 29 May 2026, 161 days before this check (10). No release in the 90 days to 6 November (0). 416 open issues and 1,045 open issues and pull requests on 6 November, with 144 issues opened in the 90 days to 3 November. Of the 50 newest, 26 had a comment and 1 was closed. Two 2026 CVE records say the vendor didn't respond to the reporter, and seven commits reached main from 8 August to 6 November (6). Python only, and the package is the current one (10). CI with actions pinned to commit SHAs and Dependabot for actions (8). 10+0+6+10+8 = 34.

Agent ergonomics Mastra +24

Mastra 92

An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10).

smolagents 68

Framework reading. MCPClient loads an MCP server's tools in a few lines (20). max_steps, planning intervals and final_answer_checks bound a run (16). Errors from tools and code go back to the model as observations (14). No built-in retry, idempotency or resume beyond replaying memory (8). Few required parameters and many providers, Python only, and the default model needs a Hugging Face token (10). 20+16+14+8+10 = 68.

Reliability Mastra +23

Mastra 87

Official npm packages, Node 22.13 or newer (20). Public CI workflows for unit, store, workspace and e2e tests; on 6 November the newest runs on main (Version Packages, Trigger Cloud Integration Tests) succeeded, while the test workflows themselves run on pull requests (22). 436 open issues and 795 open issues and pull requests on 6 November from GitHub's API, with 2,077 issues opened in the 90 days to 3 November; all 50 newest had a comment and 24 were closed, with issue-triage automation (18). A changesets CHANGELOG per package, a CI gate that needs approval for any major bump and migration guides, but no written versioning policy found, and .network() is deprecated without a removal date (12). 1.82.0 (15). 20+22+18+12+15 = 87, up from 74 on 6 October, when GitHub couldn't be read.

smolagents 64

Local-package reading. Official PyPI package with Python 3.10 or newer (20). A public tests workflow runs pytest on Python 3.10 and 3.12 for pushes and pull requests; whether main passes wasn't read (15). 416 open issues and 1,045 open issues and pull requests on 6 November, with 144 issues opened in the 90 days to 3 November. Of the 50 newest, 26 had a comment and 1 was closed. Two 2026 CVE records say the vendor didn't respond to the reporter, and seven commits reached main from 8 August to 6 November (6). Release notes on GitHub tags but no changelog file, and the remote WasmExecutor was removed in a minor release (8). 1.0 since 31 December 2024 (15). 20+15+6+8+15 = 64.

Schema & documentation Mastra +17

Mastra 98

Typed TypeScript API with a reference section (25). llms.txt with a when-to-use list and condensed instructions for coding agents (10). The docs say when to use durable agents, and point multi-agent users from .network() to supervisor agents (20). Tools take Zod schemas (15). Examples on every page, and MastraError with ids and categories documented, though errors are spread across pages (13). Per-package changelogs and migration guides (15).

smolagents 81

Framework reading. A typed Python API with reference pages for agents, models, tools and executors (22). llms.txt and Markdown pages on huggingface.co (10). The docs say when to use CodeAgent or ToolCallingAgent and when a sandbox is needed (17). Tools declare typed inputs in a schema dictionary or from a decorated function (12). Many runnable examples; error classes exist but aren't catalogued (10). Versions tagged with release notes, no changelog file (10). 22+10+17+12+10+10 = 81.

Transparency & trust Mastra +7

Mastra 72

Apache 2.0 for the core, with ee/ directories source-available under the Mastra Enterprise License (25). The privacy policy (last published 25 April 2025) covers the website, the Teams plan states six months' retention, and the subprocessor list sits in a trust centre our reader couldn't render (15). Migration guides and deprecation warnings, without dated removal windows (12). Every telemetry stream is documented with links to its source and one opt-out, and the reference now spells out what the project identifiers can be correlated with (20).

smolagents 65

Apache-2.0 (30). The library stores nothing itself; the default model sends prompts to Hugging Face's inference providers, which the docs show (20). Breaking removals such as WasmExecutor shipped in minor releases, without a written deprecation policy (5). No telemetry, though no page states it (12). 30+20+5+12 = 67.

Score by category

CategoryWeight this runMastrasmolagentsEdge
Reliability16%208764Mastra +23
Performance10%pendingpendingpendingnot scored in this run
Schema & documentation13%16.29881Mastra +17
Agent ergonomics13%16.29268Mastra +24
Security & auth14%17.56766Mastra +1
Payments & pricing10%12.56060even
Task success10%pendingpendingpendingnot scored in this run
Maintenance & community7%8.89634Mastra +62
Transparency & trust7%8.87265Mastra +7
Negative events≤15-8-6
TotalBB 74.2/100C 58.7/100

Facts side by side

FactMastrasmolagents
KindAgent frameworkAgent framework
VendorKepler Software, Inc.Hugging Face
Hosted endpointno (local only)no (local only)
Transports
AuthAPI keyNone
PricingFreeFree
x402nono
LicenceApache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testingApache-2.0
Read-only variant documentednono
llms.txtyesyes
Last release2026-11-042026-05-29
Terms last updated2026-10-262022-09-15
Privacy policy last updatedno date given2023-03-28
Customer content may train modelsyesnot found in the text
Terms restrict automated accessyesnot found in the text
Terms restrict benchmarkingnot found in the textnot found in the text
Terms or service can change without noticeyesyes
Arbitration or class-action waiveryesnot found in the text
Popularity29k stars, 3.1M npm/wk30k stars, 171k PyPI/wk

Verdicts

Mastra

A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes.

smolagents

A compact Python library for code-writing and tool-calling agents, with MCP tools, any model provider and remote sandboxes through E2B, Docker, Modal or Blaxel. The newest release is 1.26.0 of 29 May 2026, a critical remote-executor RCE took about eight weeks to fix, and the local executor isn't a security boundary.

Before you call either

Mastra

  1. Set MASTRA_TELEMETRY_DISABLED=1 in every environment that runs the CLI, the server or Studio
  2. Pin exact versions with a lockfile, and make sure no 17 June 2026 release such as @mastra/core 1.42.1 is installed
  3. Set requireToolApproval on MCP servers that write, and allowedHosts when server URLs come from configuration
  4. Add PromptInjectionDetector as an input processor when tools return web or user content
  5. Use supervisor agents through generate() or stream(). .network() is deprecated

smolagents

  1. Run CodeAgent with executor_type set to e2b, docker, modal or blaxel whenever the model or its inputs aren't trusted
  2. Use smolagents 1.24.0 or later to get the remote-executor deserialisation fix
  3. Set max_steps and final_answer_checks so a run stops on its own
  4. Pass structured_output explicitly to MCPClient to avoid the default-change warning
  5. Pin the version, since minor releases have removed APIs

Questions

Which is better for AI agents, Mastra or smolagents?

Mastra scores 74.2 (BB) on agent readiness against smolagents's 58.7 (C), and leads in 6 of 7 scored categories.

Are Mastra and smolagents open source?

Yes. Mastra is open source (Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing). smolagents is open source (Apache-2.0).

Other comparisons with Mastra or smolagents

Machine-readable

For companies

Do agents find, use and choose your tools?

An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.