{
  "data": {
    "a": {
      "slug": "mastra",
      "name": "Mastra",
      "vendor": "Kepler Software, Inc.",
      "vendorUrl": "https://mastra.ai",
      "kind": "framework",
      "category": "frameworks",
      "summary": "Open-source TypeScript framework from Mastra for building agents and workflows, with memory, RAG, evals, tracing, an MCP client and server, and a local Studio. An optional hosted platform runs deployments and observability.",
      "url": "https://www.anchorterminal.com/tools/mastra",
      "markdownUrl": "https://www.anchorterminal.com/tools/mastra.md",
      "slimMarkdownUrl": "https://www.anchorterminal.com/tools/mastra.min.md",
      "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/mastra.json",
      "dns": "mastra.grade.anchorterminal.com",
      "repo": "https://github.com/mastra-ai/mastra",
      "license": "Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing",
      "transports": [],
      "packages": [
        {
          "registry": "npm",
          "name": "@mastra/core"
        },
        {
          "registry": "npm",
          "name": "@mastra/mcp"
        },
        {
          "registry": "npm",
          "name": "mastra"
        }
      ],
      "auth": "api-key",
      "authNotes": "The framework has no account of its own. The model router takes `provider/model` strings and each provider's own key. The hosted Mastra platform needs an account.",
      "pricing": "free",
      "pricingNotes": "Free and open source. You pay for model calls. The hosted platform has a $0 Starter plan with 100K observability events and 24 CPU hours, then $10 per 100K events and $0.35 a CPU hour, and Teams at $250 a month (https://mastra.ai/pricing, checked 2026-11-06).",
      "priceSummary": "Free · OSS",
      "where": "library",
      "x402": {
        "level": "no",
        "evidence": "No x402, MPP or L402 in the Mastra docs, the repository or the pricing page (checked 2026-10-06).",
        "endpoints": []
      },
      "toolCount": null,
      "popularity": {
        "githubStars": 29383,
        "npmWeekly": 3116983,
        "pypiWeekly": null,
        "asOf": "2026-11-06"
      },
      "docsUrl": "https://mastra.ai/docs",
      "llmsTxt": "https://mastra.ai/llms.txt",
      "capabilities": [
        "agent.framework",
        "agent.durable",
        "agent.mcp-client",
        "agent.multi-agent"
      ],
      "tags": [
        "framework",
        "typescript",
        "open-source",
        "llms-txt",
        "mcp",
        "telemetry-default-on"
      ],
      "lastRelease": "2026-11-04",
      "graded": true,
      "anchor": {
        "graded": true,
        "score": 74.2,
        "grade": "BB",
        "agentReady": true,
        "rank": 91,
        "ranked": true,
        "rankOf": 1510,
        "categoryRank": 7,
        "methodology": "0.7",
        "run": "2026-10-01",
        "scores": {
          "ergonomics": 92,
          "maintenance": 96,
          "payments": 60,
          "reliability": 87,
          "schema": 98,
          "security": 67,
          "transparency": 72
        },
        "pending": [
          "performance",
          "tasks"
        ],
        "assessment": {
          "confidence": "medium",
          "date": "2026-11-06"
        },
        "negative": -8,
        "negativeNotes": [
          "2026-06-17. Malicious versions of Mastra's npm packages were published, among them @mastra/core 1.42.1 at 01:15 UTC, and GitHub malware advisories that day (GHSA-pp62-grrw-hvfp and others) say any machine that installed one should be treated as fully compromised. All 21 Mastra packages we checked on OSV carry one. Mastra published clean versions the same day and the changelogs name an \"easy-day-js\" supply-chain incident, but we found no advisory or post-mortem from Mastra. Fixed and under four months old, so 8 points. https://osv.dev/vulnerability/MAL-2026-6011"
        ],
        "verdict": "A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes.",
        "bestFor": "TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.",
        "strengths": [
          "MCP client with requireToolApproval per server or per tool, allowedHosts and a curated environment for stdio servers",
          "Guardrail processors for prompt injection, PII, moderation and cost limits, run on input and output",
          "Workflows with snapshots, suspend and resume, and durable agents on Inngest or an evented engine",
          "Apache 2.0 core, 1.0 since 20 January 2026, with 27 releases of @mastra/core in 90 days to 6 November",
          "llms.txt with a when-to-use section and condensed instructions for coding agents"
        ],
        "weaknesses": [
          "Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026",
          "CLI, server and Studio send usage analytics by default, including token counts every 15 minutes, off with MASTRA_TELEMETRY_DISABLED=1",
          "No SECURITY.md, no security.txt and no bug bounty found",
          "Code under ee/ is source-available under the Mastra Enterprise License, not Apache 2.0",
          "TypeScript only, Node 22.13 or newer"
        ],
        "agentNotes": [
          "Set MASTRA_TELEMETRY_DISABLED=1 in every environment that runs the CLI, the server or Studio",
          "Pin exact versions with a lockfile, and make sure no 17 June 2026 release such as @mastra/core 1.42.1 is installed",
          "Set requireToolApproval on MCP servers that write, and allowedHosts when server URLs come from configuration",
          "Add PromptInjectionDetector as an input processor when tools return web or user content",
          "Use supervisor agents through generate() or stream(). `.network()` is deprecated"
        ],
        "metrics": {
          "kind": "library",
          "measured": false
        },
        "reviewCount": 0,
        "avgRating": 0,
        "history": [
          {
            "basis": "public evidence",
            "confidence": "medium",
            "grade": "BB",
            "methodology": "0.7",
            "pending": [
              "performance",
              "tasks"
            ],
            "run": "2026-10-01",
            "runLabel": "October 2026 research run",
            "score": 74.2
          }
        ],
        "editorialScores": {
          "ergonomics": 92,
          "maintenance": 96,
          "payments": 60,
          "reliability": 87,
          "schema": 98,
          "security": 67,
          "transparency": 72
        },
        "provenanceScore": 71,
        "checked": {
          "categories": {
            "ergonomics": "2026-11-06",
            "maintenance": "2026-11-06",
            "payments": "2026-11-06",
            "reliability": "2026-11-06",
            "schema": "2026-11-06",
            "security": "2026-11-06",
            "transparency": "2026-11-06"
          },
          "last": "2026-11-06",
          "oldest": "2026-11-06",
          "stale": false,
          "staleAfterDays": 90
        }
      },
      "connect": {
        "install": "npm create mastra@latest   # or: npm i @mastra/core @mastra/mcp"
      },
      "letme": {
        "capability": "https://letme.dev/agent.framework",
        "tool": "https://letme.dev/mastra"
      },
      "area": "frameworks",
      "provenance": {
        "legalEntity": "Kepler Software, Inc.",
        "domain": "mastra.ai",
        "domainRegistered": "2024-10-01",
        "endpointOnVendorDomain": null,
        "terms": "https://mastra.ai/terms-of-service",
        "privacy": "https://mastra.ai/privacy-policy",
        "statusPage": "https://statuspage.incident.io/mastra-platform",
        "changelog": "https://github.com/mastra-ai/mastra/blob/main/packages/core/CHANGELOG.md",
        "securityTxt": "none",
        "checked": "2026-11-06",
        "notes": [
          "The privacy policy names Kepler Software Inc as operator of mastra.ai and shows a last-published date of 25 April 2025.",
          "The licence file is copyright Kepler Software, Inc.",
          "mastra.ai/.well-known/security.txt returns 404 (rechecked 6 November 2026), and the repository has no SECURITY.md.",
          "RDAP gives mastra.ai a registration date of 2024-10-01.",
          "The status page covers the hosted platform, not the framework."
        ],
        "score": 71
      },
      "pageJsonUrl": "https://www.anchorterminal.com/tools/mastra.json",
      "live": {
        "slug": "mastra",
        "vendorStatus": {
          "page": "https://statuspage.incident.io/mastra-platform",
          "indicator": "none",
          "summary": "All Systems Operational",
          "checkedAt": "2026-11-07T19:22:27.41396844Z"
        },
        "versions": [
          {
            "registry": "github",
            "name": "mastra-ai/mastra",
            "version": "@mastra/core@1.82.0",
            "released": "2026-11-04",
            "seenAt": "2026-11-06T23:43:05.299046627Z"
          },
          {
            "registry": "npm",
            "name": "@mastra/core",
            "version": "1.82.0",
            "seenAt": "2026-11-06T23:43:01.102546802Z"
          },
          {
            "registry": "npm",
            "name": "@mastra/mcp",
            "version": "2.8.0",
            "seenAt": "2026-11-06T23:43:01.962943277Z"
          },
          {
            "registry": "npm",
            "name": "mastra",
            "version": "1.38.0",
            "seenAt": "2026-11-06T23:43:03.330470883Z"
          }
        ],
        "githubStars": 29384,
        "npmWeekly": 3116983,
        "securityTxt": {
          "url": "https://mastra.ai/.well-known/security.txt",
          "state": "none",
          "checkedAt": "2026-11-07T16:00:45.130857018Z"
        },
        "llmsTxt": {
          "url": "https://mastra.ai/llms.txt",
          "ok": true,
          "status": 200,
          "checkedAt": "2026-11-07T15:32:57.501317652Z"
        },
        "pages": [
          {
            "url": "https://raw.githubusercontent.com/mastra-ai/mastra/main/packages/core/CHANGELOG.md",
            "kind": "changelog",
            "status": 200,
            "checkedAt": "2026-11-07T14:21:37.959722321Z",
            "changedAt": "0001-01-01T00:00:00Z",
            "fingerprint": "0bdb3498f7aa"
          },
          {
            "url": "https://mastra.ai/pricing",
            "kind": "pricing",
            "status": 200,
            "checkedAt": "2026-11-07T14:13:54.312763229Z",
            "changedAt": "0001-01-01T00:00:00Z",
            "fingerprint": "0204673a21a8"
          },
          {
            "url": "https://mastra.ai/privacy-policy",
            "kind": "privacy",
            "status": 200,
            "checkedAt": "2026-11-07T14:13:56.829832485Z",
            "changedAt": "0001-01-01T00:00:00Z",
            "fingerprint": "1621ce3063d8"
          },
          {
            "url": "https://mastra.ai/terms-of-service",
            "kind": "terms",
            "status": 200,
            "checkedAt": "2026-11-07T14:13:58.580048861Z",
            "changedAt": "0001-01-01T00:00:00Z",
            "fingerprint": "edbcf520f26c"
          }
        ],
        "updatedAt": "2026-11-07T19:22:27.41396844Z"
      }
    },
    "answer": "Mastra scores 74.2 (BB) on agent readiness against smolagents's 58.7 (C), and leads in 6 of 7 scored categories.",
    "b": {
      "slug": "smolagents",
      "name": "smolagents",
      "vendor": "Hugging Face",
      "vendorUrl": "https://github.com/huggingface/smolagents",
      "kind": "framework",
      "category": "frameworks",
      "summary": "smolagents is Hugging Face's small Python library for agents that write and run Python code (CodeAgent) or call tools as JSON (ToolCallingAgent), with MCP tools, any model provider and sandboxed execution through E2B, Docker, Modal or Blaxel.",
      "url": "https://www.anchorterminal.com/tools/smolagents",
      "markdownUrl": "https://www.anchorterminal.com/tools/smolagents.md",
      "slimMarkdownUrl": "https://www.anchorterminal.com/tools/smolagents.min.md",
      "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/smolagents.json",
      "dns": "smolagents.grade.anchorterminal.com",
      "repo": "https://github.com/huggingface/smolagents",
      "license": "Apache-2.0",
      "transports": [],
      "packages": [
        {
          "registry": "pypi",
          "name": "smolagents"
        }
      ],
      "auth": "none",
      "authNotes": "A library with no credentials of its own. The default InferenceClientModel uses a Hugging Face token; other providers and remote sandboxes take their own keys.",
      "pricing": "free",
      "pricingNotes": "Free and open source under Apache-2.0. You pay for model calls and for any remote sandbox (E2B, Modal, Blaxel) you use.",
      "priceSummary": "Free · OSS",
      "where": "library",
      "x402": {
        "level": "no",
        "evidence": "No x402, MPP or L402 in the docs or the repository (checked 2026-11-06).",
        "endpoints": []
      },
      "toolCount": null,
      "popularity": {
        "githubStars": 30234,
        "npmWeekly": null,
        "pypiWeekly": 171063,
        "asOf": "2026-11-06"
      },
      "docsUrl": "https://huggingface.co/docs/smolagents/index",
      "llmsTxt": "https://huggingface.co/docs/smolagents/llms.txt",
      "capabilities": [
        "agent.framework",
        "agent.mcp-client",
        "agent.multi-agent"
      ],
      "tags": [
        "framework",
        "python",
        "open-source",
        "llms-txt",
        "mcp",
        "code-agent",
        "sandbox"
      ],
      "lastRelease": "2026-05-29",
      "graded": true,
      "anchor": {
        "graded": true,
        "score": 58.7,
        "grade": "C",
        "agentReady": false,
        "rank": 739,
        "ranked": true,
        "rankOf": 1510,
        "categoryRank": 18,
        "methodology": "0.7",
        "run": "2026-10-01",
        "scores": {
          "ergonomics": 68,
          "maintenance": 34,
          "payments": 60,
          "reliability": 64,
          "schema": 81,
          "security": 66,
          "transparency": 65
        },
        "pending": [
          "performance",
          "tasks"
        ],
        "assessment": {
          "confidence": "medium",
          "date": "2026-11-06"
        },
        "negative": -6,
        "negativeNotes": [
          "2025-12-23 to 2026-03-27. GHSA-q9r5-6hrr-9ph7 (CVE-2025-14931, critical, from the Zero Day Initiative) reports remote code execution through pickle deserialisation in the remote Python executor; the fix for remote executors merged on 15 February 2026, about eight weeks after publication. CVE-2026-2654 (SSRF, 1.24.0) and CVE-2026-4963 (code injection in LocalPythonExecutor, an incomplete earlier fix) are rated low, and both records say the vendor did not respond. Fixed or low, under 12 months old, 6 points. https://osv.dev/vulnerability/GHSA-q9r5-6hrr-9ph7"
        ],
        "verdict": "A compact Python library for code-writing and tool-calling agents, with MCP tools, any model provider and remote sandboxes through E2B, Docker, Modal or Blaxel. The newest release is 1.26.0 of 29 May 2026, a critical remote-executor RCE took about eight weeks to fix, and the local executor isn't a security boundary.",
        "bestFor": "Small Python projects and research that want code-writing agents with minimal abstraction.",
        "strengths": [
          "CodeAgent and ToolCallingAgent in a small, readable codebase",
          "MCP tools from any server through MCPClient",
          "Remote execution through E2B, Docker, Modal or Blaxel, with a guide on when it's needed",
          "No telemetry found in the source",
          "llms.txt and Markdown docs on huggingface.co"
        ],
        "weaknesses": [
          "No release since 1.26.0 on 29 May 2026, and few commits to main since August",
          "The local Python executor isn't a security boundary, per its own guide",
          "A critical RCE in the remote executor (published December 2025) was fixed in February 2026",
          "No human approval hook, retry or resume built in",
          "Breaking removals such as WasmExecutor shipped in minor releases"
        ],
        "agentNotes": [
          "Run CodeAgent with `executor_type` set to e2b, docker, modal or blaxel whenever the model or its inputs aren't trusted",
          "Use smolagents 1.24.0 or later to get the remote-executor deserialisation fix",
          "Set max_steps and final_answer_checks so a run stops on its own",
          "Pass structured_output explicitly to MCPClient to avoid the default-change warning",
          "Pin the version, since minor releases have removed APIs"
        ],
        "metrics": {
          "kind": "local",
          "measured": false
        },
        "reviewCount": 0,
        "avgRating": 0,
        "history": [
          {
            "basis": "public evidence",
            "confidence": "medium",
            "grade": "C",
            "methodology": "0.7",
            "pending": [
              "performance",
              "tasks"
            ],
            "run": "2026-10-01",
            "runLabel": "October 2026 research run",
            "score": 58.7
          }
        ],
        "editorialScores": {
          "ergonomics": 68,
          "maintenance": 34,
          "payments": 60,
          "reliability": 64,
          "schema": 81,
          "security": 66,
          "transparency": 67
        },
        "provenanceScore": 62,
        "checked": {
          "categories": {
            "ergonomics": "2026-11-06",
            "maintenance": "2026-11-06",
            "payments": "2026-11-06",
            "reliability": "2026-11-06",
            "schema": "2026-11-06",
            "security": "2026-11-06",
            "transparency": "2026-11-06"
          },
          "last": "2026-11-06",
          "oldest": "2026-11-06",
          "stale": false,
          "staleAfterDays": 90
        }
      },
      "connect": {
        "install": "pip install smolagents   # MCP: pip install 'smolagents[mcp]'"
      },
      "letme": {
        "capability": "https://letme.dev/agent.framework",
        "tool": "https://letme.dev/smolagents"
      },
      "sameCompany": [
        "hugging-face-inference-providers",
        "hugging-face-inference-endpoints",
        "carbon-x",
        "smollm3-3b"
      ],
      "area": "frameworks",
      "provenance": {
        "legalEntity": "Hugging Face, Inc.",
        "domain": "huggingface.co",
        "domainRegistered": "",
        "endpointOnVendorDomain": null,
        "terms": "https://huggingface.co/terms-of-service",
        "privacy": "https://huggingface.co/privacy",
        "statusPage": "",
        "changelog": "https://github.com/huggingface/smolagents/releases",
        "securityTxt": "unknown",
        "checked": "2026-11-06",
        "notes": [
          "SECURITY.md takes reports through GitHub private vulnerability reporting or security@huggingface.co, with no bounty.",
          "huggingface.co/robots.txt allows all crawlers.",
          "The terms and privacy links are Hugging Face's site-wide documents; the library itself collects nothing."
        ],
        "score": 62
      },
      "pageJsonUrl": "https://www.anchorterminal.com/tools/smolagents.json",
      "live": {
        "slug": "smolagents",
        "versions": [
          {
            "registry": "github",
            "name": "huggingface/smolagents",
            "version": "v1.26.0",
            "released": "2026-05-29",
            "seenAt": "2026-11-07T00:06:55.865567193Z"
          },
          {
            "registry": "pypi",
            "name": "smolagents",
            "version": "1.26.0",
            "released": "2026-05-29",
            "seenAt": "2026-11-07T00:06:55.546186347Z"
          }
        ],
        "githubStars": 30238,
        "pypiWeekly": 171063,
        "securityTxt": {
          "url": "https://huggingface.co/.well-known/security.txt",
          "state": "valid",
          "expires": "2030-07-01T08:42:00.000Z",
          "checkedAt": "2026-11-07T16:00:00.493446773Z"
        },
        "llmsTxt": {
          "url": "https://huggingface.co/docs/smolagents/llms.txt",
          "ok": true,
          "status": 200,
          "checkedAt": "2026-11-07T15:33:57.593545427Z"
        },
        "updatedAt": "2026-11-07T16:00:00.493446773Z"
      }
    },
    "edges": [
      {
        "by": 62,
        "category": "maintenance",
        "leads": "mastra",
        "name": "Maintenance \u0026 community",
        "reasons": {
          "a": "@mastra/core 1.82.0 on 2026-11-04 (30). 27 stable releases in the 90 days to 6 November, 8 of them since 6 October (20). 436 open issues on 6 November, all 50 newest issues commented and 24 of them closed (22). Client, MCP and store packages are current, and @mastra/mcp 1.x stays supported beside 2.x (15). Renovate and CI configured, with the newest runs on main passing (9). 30+20+22+15+9 = 96.",
          "b": "v1.26.0 on 29 May 2026, 161 days before this check (10). No release in the 90 days to 6 November (0). 416 open issues and 1,045 open issues and pull requests on 6 November, with 144 issues opened in the 90 days to 3 November. Of the 50 newest, 26 had a comment and 1 was closed. Two 2026 CVE records say the vendor didn't respond to the reporter, and seven commits reached main from 8 August to 6 November (6). Python only, and the package is the current one (10). CI with actions pinned to commit SHAs and Dependabot for actions (8). 10+0+6+10+8 = 34."
        },
        "scores": {
          "a": 96,
          "b": 34
        }
      },
      {
        "by": 24,
        "category": "ergonomics",
        "leads": "mastra",
        "name": "Agent ergonomics",
        "reasons": {
          "a": "An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10).",
          "b": "Framework reading. MCPClient loads an MCP server's tools in a few lines (20). max_steps, planning intervals and final_answer_checks bound a run (16). Errors from tools and code go back to the model as observations (14). No built-in retry, idempotency or resume beyond replaying memory (8). Few required parameters and many providers, Python only, and the default model needs a Hugging Face token (10). 20+16+14+8+10 = 68."
        },
        "scores": {
          "a": 92,
          "b": 68
        }
      },
      {
        "by": 23,
        "category": "reliability",
        "leads": "mastra",
        "name": "Reliability",
        "reasons": {
          "a": "Official npm packages, Node 22.13 or newer (20). Public CI workflows for unit, store, workspace and e2e tests; on 6 November the newest runs on main (Version Packages, Trigger Cloud Integration Tests) succeeded, while the test workflows themselves run on pull requests (22). 436 open issues and 795 open issues and pull requests on 6 November from GitHub's API, with 2,077 issues opened in the 90 days to 3 November; all 50 newest had a comment and 24 were closed, with issue-triage automation (18). A changesets CHANGELOG per package, a CI gate that needs approval for any major bump and migration guides, but no written versioning policy found, and `.network()` is deprecated without a removal date (12). 1.82.0 (15). 20+22+18+12+15 = 87, up from 74 on 6 October, when GitHub couldn't be read.",
          "b": "Local-package reading. Official PyPI package with Python 3.10 or newer (20). A public tests workflow runs pytest on Python 3.10 and 3.12 for pushes and pull requests; whether main passes wasn't read (15). 416 open issues and 1,045 open issues and pull requests on 6 November, with 144 issues opened in the 90 days to 3 November. Of the 50 newest, 26 had a comment and 1 was closed. Two 2026 CVE records say the vendor didn't respond to the reporter, and seven commits reached main from 8 August to 6 November (6). Release notes on GitHub tags but no changelog file, and the remote WasmExecutor was removed in a minor release (8). 1.0 since 31 December 2024 (15). 20+15+6+8+15 = 64."
        },
        "scores": {
          "a": 87,
          "b": 64
        }
      },
      {
        "by": 17,
        "category": "schema",
        "leads": "mastra",
        "name": "Schema \u0026 documentation",
        "reasons": {
          "a": "Typed TypeScript API with a reference section (25). llms.txt with a when-to-use list and condensed instructions for coding agents (10). The docs say when to use durable agents, and point multi-agent users from `.network()` to supervisor agents (20). Tools take Zod schemas (15). Examples on every page, and MastraError with ids and categories documented, though errors are spread across pages (13). Per-package changelogs and migration guides (15).",
          "b": "Framework reading. A typed Python API with reference pages for agents, models, tools and executors (22). llms.txt and Markdown pages on huggingface.co (10). The docs say when to use CodeAgent or ToolCallingAgent and when a sandbox is needed (17). Tools declare typed inputs in a schema dictionary or from a decorated function (12). Many runnable examples; error classes exist but aren't catalogued (10). Versions tagged with release notes, no changelog file (10). 22+10+17+12+10+10 = 81."
        },
        "scores": {
          "a": 98,
          "b": 81
        }
      },
      {
        "by": 7,
        "category": "transparency",
        "leads": "mastra",
        "name": "Transparency \u0026 trust",
        "reasons": {
          "a": "Apache 2.0 for the core, with ee/ directories source-available under the Mastra Enterprise License (25). The privacy policy (last published 25 April 2025) covers the website, the Teams plan states six months' retention, and the subprocessor list sits in a trust centre our reader couldn't render (15). Migration guides and deprecation warnings, without dated removal windows (12). Every telemetry stream is documented with links to its source and one opt-out, and the reference now spells out what the project identifiers can be correlated with (20).",
          "b": "Apache-2.0 (30). The library stores nothing itself; the default model sends prompts to Hugging Face's inference providers, which the docs show (20). Breaking removals such as WasmExecutor shipped in minor releases, without a written deprecation policy (5). No telemetry, though no page states it (12). 30+20+5+12 = 67."
        },
        "scores": {
          "a": 72,
          "b": 65
        }
      }
    ],
    "facts": [
      {
        "a": "Agent framework",
        "b": "Agent framework",
        "name": "Kind"
      },
      {
        "a": "Kepler Software, Inc.",
        "b": "Hugging Face",
        "name": "Vendor"
      },
      {
        "a": "no (local only)",
        "b": "no (local only)",
        "name": "Hosted endpoint"
      },
      {
        "a": "",
        "b": "",
        "name": "Transports"
      },
      {
        "a": "API key",
        "b": "None",
        "name": "Auth"
      },
      {
        "a": "Free",
        "b": "Free",
        "name": "Pricing"
      },
      {
        "a": "no",
        "b": "no",
        "name": "x402"
      },
      {
        "a": "Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing",
        "b": "Apache-2.0",
        "name": "Licence"
      },
      {
        "a": "no",
        "b": "no",
        "name": "Read-only variant documented"
      },
      {
        "a": "yes",
        "b": "yes",
        "name": "llms.txt"
      },
      {
        "a": "2026-11-04",
        "b": "2026-05-29",
        "name": "Last release"
      },
      {
        "a": "2026-10-26",
        "b": "2022-09-15",
        "name": "Terms last updated"
      },
      {
        "a": "no date given",
        "b": "2023-03-28",
        "name": "Privacy policy last updated"
      },
      {
        "a": "yes",
        "b": "not found in the text",
        "name": "Customer content may train models"
      },
      {
        "a": "yes",
        "b": "not found in the text",
        "name": "Terms restrict automated access"
      },
      {
        "a": "not found in the text",
        "b": "not found in the text",
        "name": "Terms restrict benchmarking"
      },
      {
        "a": "yes",
        "b": "yes",
        "name": "Terms or service can change without notice"
      },
      {
        "a": "yes",
        "b": "not found in the text",
        "name": "Arbitration or class-action waiver"
      },
      {
        "a": "29k stars, 3.1M npm/wk",
        "b": "30k stars, 171k PyPI/wk",
        "name": "Popularity"
      }
    ],
    "faq": [
      {
        "answer": "Mastra scores 74.2 (BB) on agent readiness against smolagents's 58.7 (C), and leads in 6 of 7 scored categories.",
        "question": "Which is better for AI agents, Mastra or smolagents?"
      },
      {
        "answer": "Yes. Mastra is open source (Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing). smolagents is open source (Apache-2.0).",
        "question": "Are Mastra and smolagents open source?"
      }
    ],
    "goodFor": [
      {
        "aheadOn": [
          "Reliability, 87 against 64",
          "Schema \u0026 documentation, 98 against 81",
          "Agent ergonomics, 92 against 68",
          "Maintenance \u0026 community, 96 against 34",
          "Transparency \u0026 trust, 72 against 65"
        ],
        "also": [
          "Agent-ready, a grade of BB or better"
        ],
        "goodFor": "TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.",
        "slug": "mastra",
        "watchFor": "Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026"
      },
      {
        "aheadOn": null,
        "also": [
          "No key needed to call it"
        ],
        "goodFor": "Small Python projects and research that want code-writing agents with minimal abstraction.",
        "slug": "smolagents",
        "watchFor": "No release since 1.26.0 on 29 May 2026, and few commits to main since August"
      }
    ],
    "history": null,
    "job": {
      "capability": "agent.framework",
      "name": "Agent frameworks"
    },
    "others": [
      {
        "json": "https://www.anchorterminal.com/compare/agentos-vs-mastra.json",
        "title": "AgentOS vs Mastra",
        "url": "https://www.anchorterminal.com/compare/agentos-vs-mastra"
      },
      {
        "json": "https://www.anchorterminal.com/compare/agentos-vs-smolagents.json",
        "title": "AgentOS vs smolagents",
        "url": "https://www.anchorterminal.com/compare/agentos-vs-smolagents"
      },
      {
        "json": "https://www.anchorterminal.com/compare/agno-vs-mastra.json",
        "title": "Agno vs Mastra",
        "url": "https://www.anchorterminal.com/compare/agno-vs-mastra"
      },
      {
        "json": "https://www.anchorterminal.com/compare/agno-vs-smolagents.json",
        "title": "Agno vs smolagents",
        "url": "https://www.anchorterminal.com/compare/agno-vs-smolagents"
      },
      {
        "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra.json",
        "title": "BoxLang AI vs Mastra",
        "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra"
      },
      {
        "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-smolagents.json",
        "title": "BoxLang AI vs smolagents",
        "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-smolagents"
      },
      {
        "json": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-mastra.json",
        "title": "Claude Agent SDK vs Mastra",
        "url": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-mastra"
      },
      {
        "json": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-smolagents.json",
        "title": "Claude Agent SDK vs smolagents",
        "url": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-smolagents"
      },
      {
        "json": "https://www.anchorterminal.com/compare/crewai-vs-mastra.json",
        "title": "CrewAI vs Mastra",
        "url": "https://www.anchorterminal.com/compare/crewai-vs-mastra"
      },
      {
        "json": "https://www.anchorterminal.com/compare/crewai-vs-smolagents.json",
        "title": "CrewAI vs smolagents",
        "url": "https://www.anchorterminal.com/compare/crewai-vs-smolagents"
      },
      {
        "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra.json",
        "title": "Cursor Agent SDK vs Mastra",
        "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra"
      },
      {
        "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-smolagents.json",
        "title": "Cursor Agent SDK vs smolagents",
        "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-smolagents"
      },
      {
        "json": "https://www.anchorterminal.com/compare/docker-agent-vs-mastra.json",
        "title": "Docker Agent vs Mastra",
        "url": "https://www.anchorterminal.com/compare/docker-agent-vs-mastra"
      },
      {
        "json": "https://www.anchorterminal.com/compare/docker-agent-vs-smolagents.json",
        "title": "Docker Agent vs smolagents",
        "url": "https://www.anchorterminal.com/compare/docker-agent-vs-smolagents"
      },
      {
        "json": "https://www.anchorterminal.com/compare/google-adk-vs-mastra.json",
        "title": "Agent Development Kit (ADK) vs Mastra",
        "url": "https://www.anchorterminal.com/compare/google-adk-vs-mastra"
      },
      {
        "json": "https://www.anchorterminal.com/compare/google-adk-vs-smolagents.json",
        "title": "Agent Development Kit (ADK) vs smolagents",
        "url": "https://www.anchorterminal.com/compare/google-adk-vs-smolagents"
      },
      {
        "json": "https://www.anchorterminal.com/compare/guilds-run-vs-mastra.json",
        "title": "guilds.run vs Mastra",
        "url": "https://www.anchorterminal.com/compare/guilds-run-vs-mastra"
      },
      {
        "json": "https://www.anchorterminal.com/compare/guilds-run-vs-smolagents.json",
        "title": "guilds.run vs smolagents",
        "url": "https://www.anchorterminal.com/compare/guilds-run-vs-smolagents"
      },
      {
        "json": "https://www.anchorterminal.com/compare/langgraph-vs-mastra.json",
        "title": "LangGraph vs Mastra",
        "url": "https://www.anchorterminal.com/compare/langgraph-vs-mastra"
      },
      {
        "json": "https://www.anchorterminal.com/compare/langgraph-vs-smolagents.json",
        "title": "LangGraph vs smolagents",
        "url": "https://www.anchorterminal.com/compare/langgraph-vs-smolagents"
      },
      {
        "json": "https://www.anchorterminal.com/compare/llamaindex-vs-mastra.json",
        "title": "LlamaIndex Framework vs Mastra",
        "url": "https://www.anchorterminal.com/compare/llamaindex-vs-mastra"
      },
      {
        "json": "https://www.anchorterminal.com/compare/llamaindex-vs-smolagents.json",
        "title": "LlamaIndex Framework vs smolagents",
        "url": "https://www.anchorterminal.com/compare/llamaindex-vs-smolagents"
      },
      {
        "json": "https://www.anchorterminal.com/compare/mastra-vs-microsoft-agent-framework.json",
        "title": "Mastra vs Microsoft Agent Framework",
        "url": "https://www.anchorterminal.com/compare/mastra-vs-microsoft-agent-framework"
      },
      {
        "json": "https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk.json",
        "title": "Mastra vs OpenAI Agents SDK",
        "url": "https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk"
      },
      {
        "json": "https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai.json",
        "title": "Mastra vs Pydantic AI",
        "url": "https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai"
      },
      {
        "json": "https://www.anchorterminal.com/compare/mastra-vs-strands-agents.json",
        "title": "Mastra vs Strands Agents",
        "url": "https://www.anchorterminal.com/compare/mastra-vs-strands-agents"
      },
      {
        "json": "https://www.anchorterminal.com/compare/mastra-vs-tradingagents.json",
        "title": "Mastra vs TradingAgents",
        "url": "https://www.anchorterminal.com/compare/mastra-vs-tradingagents"
      },
      {
        "json": "https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk.json",
        "title": "Mastra vs AI SDK",
        "url": "https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk"
      },
      {
        "json": "https://www.anchorterminal.com/compare/microsoft-agent-framework-vs-smolagents.json",
        "title": "Microsoft Agent Framework vs smolagents",
        "url": "https://www.anchorterminal.com/compare/microsoft-agent-framework-vs-smolagents"
      },
      {
        "json": "https://www.anchorterminal.com/compare/openai-agents-sdk-vs-smolagents.json",
        "title": "OpenAI Agents SDK vs smolagents",
        "url": "https://www.anchorterminal.com/compare/openai-agents-sdk-vs-smolagents"
      },
      {
        "json": "https://www.anchorterminal.com/compare/pydantic-ai-vs-smolagents.json",
        "title": "Pydantic AI vs smolagents",
        "url": "https://www.anchorterminal.com/compare/pydantic-ai-vs-smolagents"
      },
      {
        "json": "https://www.anchorterminal.com/compare/smolagents-vs-strands-agents.json",
        "title": "smolagents vs Strands Agents",
        "url": "https://www.anchorterminal.com/compare/smolagents-vs-strands-agents"
      },
      {
        "json": "https://www.anchorterminal.com/compare/smolagents-vs-tradingagents.json",
        "title": "smolagents vs TradingAgents",
        "url": "https://www.anchorterminal.com/compare/smolagents-vs-tradingagents"
      },
      {
        "json": "https://www.anchorterminal.com/compare/smolagents-vs-vercel-ai-sdk.json",
        "title": "smolagents vs AI SDK",
        "url": "https://www.anchorterminal.com/compare/smolagents-vs-vercel-ai-sdk"
      }
    ],
    "panel": null,
    "scores": [
      {
        "by": 23,
        "edge": "mastra",
        "key": "reliability",
        "mastra": 87,
        "name": "Reliability",
        "smolagents": 64,
        "weight": 16
      },
      {
        "key": "performance",
        "name": "Performance",
        "pending": true,
        "weight": 10
      },
      {
        "by": 17,
        "edge": "mastra",
        "key": "schema",
        "mastra": 98,
        "name": "Schema \u0026 documentation",
        "smolagents": 81,
        "weight": 13
      },
      {
        "by": 24,
        "edge": "mastra",
        "key": "ergonomics",
        "mastra": 92,
        "name": "Agent ergonomics",
        "smolagents": 68,
        "weight": 13
      },
      {
        "by": 1,
        "edge": "mastra",
        "key": "security",
        "mastra": 67,
        "name": "Security \u0026 auth",
        "smolagents": 66,
        "weight": 14
      },
      {
        "by": 0,
        "edge": "",
        "key": "payments",
        "mastra": 60,
        "name": "Payments \u0026 pricing",
        "smolagents": 60,
        "weight": 10
      },
      {
        "key": "tasks",
        "name": "Task success",
        "pending": true,
        "weight": 10
      },
      {
        "by": 62,
        "edge": "mastra",
        "key": "maintenance",
        "mastra": 96,
        "name": "Maintenance \u0026 community",
        "smolagents": 34,
        "weight": 7
      },
      {
        "by": 7,
        "edge": "mastra",
        "key": "transparency",
        "mastra": 72,
        "name": "Transparency \u0026 trust",
        "smolagents": 65,
        "weight": 7
      }
    ],
    "summary": "Mastra scores 74.2 (BB) on agent readiness against smolagents's 58.7 (C), and leads in 6 of 7 scored categories. Both do agent frameworks.",
    "tasks": null,
    "tutorials": [],
    "verdicts": {
      "mastra": "A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes.",
      "smolagents": "A compact Python library for code-writing and tool-calling agents, with MCP tools, any model provider and remote sandboxes through E2B, Docker, Modal or Blaxel. The newest release is 1.26.0 of 29 May 2026, a critical remote-executor RCE took about eight weeks to fix, and the local executor isn't a security boundary."
    }
  },
  "kind": "anchor.page",
  "links": {
    "api": "https://www.anchorterminal.com/api/v1/index.json",
    "html": "https://www.anchorterminal.com/compare/mastra-vs-smolagents",
    "json": "https://www.anchorterminal.com/compare/mastra-vs-smolagents.json",
    "llms": "https://www.anchorterminal.com/llms.txt",
    "markdown": "https://www.anchorterminal.com/compare/mastra-vs-smolagents.md",
    "mcp": "https://www.anchorterminal.com/mcp",
    "slim": "https://www.anchorterminal.com/compare/mastra-vs-smolagents.min.md"
  },
  "markdown": "Mastra scores 74.2 (BB) on agent readiness against smolagents's 58.7 (C), and leads in 6 of 7 scored categories. Both do agent frameworks.\n\n- Mastra: grade BB, 74.2/100, rank #91 of 1510. Markdown https://www.anchorterminal.com/tools/mastra.md · JSON https://www.anchorterminal.com/api/v1/tools/mastra.json\n- smolagents: grade C, 58.7/100, rank #739 of 1510. Markdown https://www.anchorterminal.com/tools/smolagents.md · JSON https://www.anchorterminal.com/api/v1/tools/smolagents.json\n- Best agent frameworks and SDKs: https://www.anchorterminal.com/best/frameworks/index.md\n- All 171 frameworks comparisons: https://www.anchorterminal.com/compare/frameworks/index.md\n\n## Which one, for what\n\n### Mastra (BB)\n\nGood for: TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.\n\nAhead on:\n- Reliability, 87 against 64\n- Schema \u0026 documentation, 98 against 81\n- Agent ergonomics, 92 against 68\n- Maintenance \u0026 community, 96 against 34\n- Transparency \u0026 trust, 72 against 65\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n\nWatch for: Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026\n\n### smolagents (C)\n\nGood for: Small Python projects and research that want code-writing agents with minimal abstraction.\n\nAlso in its favour:\n- No key needed to call it\n\nWatch for: No release since 1.26.0 on 29 May 2026, and few commits to main since August\n\n\n## Why the edge\n\n### Maintenance \u0026 community: Mastra +62\n\n- Mastra (96): @mastra/core 1.82.0 on 2026-11-04 (30). 27 stable releases in the 90 days to 6 November, 8 of them since 6 October (20). 436 open issues on 6 November, all 50 newest issues commented and 24 of them closed (22). Client, MCP and store packages are current, and @mastra/mcp 1.x stays supported beside 2.x (15). Renovate and CI configured, with the newest runs on main passing (9). 30+20+22+15+9 = 96.\n- smolagents (34): v1.26.0 on 29 May 2026, 161 days before this check (10). No release in the 90 days to 6 November (0). 416 open issues and 1,045 open issues and pull requests on 6 November, with 144 issues opened in the 90 days to 3 November. Of the 50 newest, 26 had a comment and 1 was closed. Two 2026 CVE records say the vendor didn't respond to the reporter, and seven commits reached main from 8 August to 6 November (6). Python only, and the package is the current one (10). CI with actions pinned to commit SHAs and Dependabot for actions (8). 10+0+6+10+8 = 34.\n\n### Agent ergonomics: Mastra +24\n\n- Mastra (92): An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10).\n- smolagents (68): Framework reading. MCPClient loads an MCP server's tools in a few lines (20). max_steps, planning intervals and final_answer_checks bound a run (16). Errors from tools and code go back to the model as observations (14). No built-in retry, idempotency or resume beyond replaying memory (8). Few required parameters and many providers, Python only, and the default model needs a Hugging Face token (10). 20+16+14+8+10 = 68.\n\n### Reliability: Mastra +23\n\n- Mastra (87): Official npm packages, Node 22.13 or newer (20). Public CI workflows for unit, store, workspace and e2e tests; on 6 November the newest runs on main (Version Packages, Trigger Cloud Integration Tests) succeeded, while the test workflows themselves run on pull requests (22). 436 open issues and 795 open issues and pull requests on 6 November from GitHub's API, with 2,077 issues opened in the 90 days to 3 November; all 50 newest had a comment and 24 were closed, with issue-triage automation (18). A changesets CHANGELOG per package, a CI gate that needs approval for any major bump and migration guides, but no written versioning policy found, and `.network()` is deprecated without a removal date (12). 1.82.0 (15). 20+22+18+12+15 = 87, up from 74 on 6 October, when GitHub couldn't be read.\n- smolagents (64): Local-package reading. Official PyPI package with Python 3.10 or newer (20). A public tests workflow runs pytest on Python 3.10 and 3.12 for pushes and pull requests; whether main passes wasn't read (15). 416 open issues and 1,045 open issues and pull requests on 6 November, with 144 issues opened in the 90 days to 3 November. Of the 50 newest, 26 had a comment and 1 was closed. Two 2026 CVE records say the vendor didn't respond to the reporter, and seven commits reached main from 8 August to 6 November (6). Release notes on GitHub tags but no changelog file, and the remote WasmExecutor was removed in a minor release (8). 1.0 since 31 December 2024 (15). 20+15+6+8+15 = 64.\n\n### Schema \u0026 documentation: Mastra +17\n\n- Mastra (98): Typed TypeScript API with a reference section (25). llms.txt with a when-to-use list and condensed instructions for coding agents (10). The docs say when to use durable agents, and point multi-agent users from `.network()` to supervisor agents (20). Tools take Zod schemas (15). Examples on every page, and MastraError with ids and categories documented, though errors are spread across pages (13). Per-package changelogs and migration guides (15).\n- smolagents (81): Framework reading. A typed Python API with reference pages for agents, models, tools and executors (22). llms.txt and Markdown pages on huggingface.co (10). The docs say when to use CodeAgent or ToolCallingAgent and when a sandbox is needed (17). Tools declare typed inputs in a schema dictionary or from a decorated function (12). Many runnable examples; error classes exist but aren't catalogued (10). Versions tagged with release notes, no changelog file (10). 22+10+17+12+10+10 = 81.\n\n### Transparency \u0026 trust: Mastra +7\n\n- Mastra (72): Apache 2.0 for the core, with ee/ directories source-available under the Mastra Enterprise License (25). The privacy policy (last published 25 April 2025) covers the website, the Teams plan states six months' retention, and the subprocessor list sits in a trust centre our reader couldn't render (15). Migration guides and deprecation warnings, without dated removal windows (12). Every telemetry stream is documented with links to its source and one opt-out, and the reference now spells out what the project identifiers can be correlated with (20).\n- smolagents (65): Apache-2.0 (30). The library stores nothing itself; the default model sends prompts to Hugging Face's inference providers, which the docs show (20). Breaking removals such as WasmExecutor shipped in minor releases, without a written deprecation policy (5). No telemetry, though no page states it (12). 30+20+5+12 = 67.\n\n## Score by category\n\n| Category | Weight | Mastra | smolagents | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 87 | 64 | Mastra +23 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 98 | 81 | Mastra +17 |\n| Agent ergonomics | 13% (16.2 this run) | 92 | 68 | Mastra +24 |\n| Security \u0026 auth | 14% (17.5 this run) | 67 | 66 | Mastra +1 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 60 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 96 | 34 | Mastra +62 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 72 | 65 | Mastra +7 |\n| Negative events | ≤15 | -8 | -6 | |\n| **Total** | | **74.2 · BB** | **58.7 · C** | |\n\n## Facts side by side\n\n| Fact | Mastra | smolagents |\n| --- | --- | --- |\n| Kind | Agent framework | Agent framework |\n| Vendor | Kepler Software, Inc. | Hugging Face |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports |  |  |\n| Auth | API key | None |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing | Apache-2.0 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-11-04 | 2026-05-29 |\n| Terms last updated | 2026-10-26 | 2022-09-15 |\n| Privacy policy last updated | no date given | 2023-03-28 |\n| Customer content may train models | yes | not found in the text |\n| Terms restrict automated access | yes | not found in the text |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | yes | yes |\n| Arbitration or class-action waiver | yes | not found in the text |\n| Popularity | 29k stars, 3.1M npm/wk | 30k stars, 171k PyPI/wk |\n\n## Verdicts\n\n**Mastra.** A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes.\n\n**smolagents.** A compact Python library for code-writing and tool-calling agents, with MCP tools, any model provider and remote sandboxes through E2B, Docker, Modal or Blaxel. The newest release is 1.26.0 of 29 May 2026, a critical remote-executor RCE took about eight weeks to fix, and the local executor isn't a security boundary.\n\n## Before you call either\n\n### Mastra\n\n1. Set MASTRA_TELEMETRY_DISABLED=1 in every environment that runs the CLI, the server or Studio\n2. Pin exact versions with a lockfile, and make sure no 17 June 2026 release such as @mastra/core 1.42.1 is installed\n3. Set requireToolApproval on MCP servers that write, and allowedHosts when server URLs come from configuration\n4. Add PromptInjectionDetector as an input processor when tools return web or user content\n5. Use supervisor agents through generate() or stream(). `.network()` is deprecated\n\n### smolagents\n\n1. Run CodeAgent with `executor_type` set to e2b, docker, modal or blaxel whenever the model or its inputs aren't trusted\n2. Use smolagents 1.24.0 or later to get the remote-executor deserialisation fix\n3. Set max_steps and final_answer_checks so a run stops on its own\n4. Pass structured_output explicitly to MCPClient to avoid the default-change warning\n5. Pin the version, since minor releases have removed APIs\n\n## Questions\n\n### Which is better for AI agents, Mastra or smolagents?\n\nMastra scores 74.2 (BB) on agent readiness against smolagents's 58.7 (C), and leads in 6 of 7 scored categories.\n\n### Are Mastra and smolagents open source?\n\nYes. Mastra is open source (Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing). smolagents is open source (Apache-2.0).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/mastra-vs-smolagents.json, and with the fewest tokens: https://www.anchorterminal.com/compare/mastra-vs-smolagents.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"mastra\", \"b\": \"smolagents\"}`. From a terminal: `anchor compare mastra smolagents`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/mastra.json and https://www.anchorterminal.com/api/v1/tools/smolagents.json\n\n## Other comparisons with Mastra or smolagents\n\n- [AgentOS vs Mastra](https://www.anchorterminal.com/compare/agentos-vs-mastra.md)\n- [AgentOS vs smolagents](https://www.anchorterminal.com/compare/agentos-vs-smolagents.md)\n- [Agno vs Mastra](https://www.anchorterminal.com/compare/agno-vs-mastra.md)\n- [Agno vs smolagents](https://www.anchorterminal.com/compare/agno-vs-smolagents.md)\n- [BoxLang AI vs Mastra](https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra.md)\n- [BoxLang AI vs smolagents](https://www.anchorterminal.com/compare/boxlang-ai-vs-smolagents.md)\n- [Claude Agent SDK vs Mastra](https://www.anchorterminal.com/compare/claude-agent-sdk-vs-mastra.md)\n- [Claude Agent SDK vs smolagents](https://www.anchorterminal.com/compare/claude-agent-sdk-vs-smolagents.md)\n- [CrewAI vs Mastra](https://www.anchorterminal.com/compare/crewai-vs-mastra.md)\n- [CrewAI vs smolagents](https://www.anchorterminal.com/compare/crewai-vs-smolagents.md)\n- [Cursor Agent SDK vs Mastra](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra.md)\n- [Cursor Agent SDK vs smolagents](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-smolagents.md)\n- [Docker Agent vs Mastra](https://www.anchorterminal.com/compare/docker-agent-vs-mastra.md)\n- [Docker Agent vs smolagents](https://www.anchorterminal.com/compare/docker-agent-vs-smolagents.md)\n- [Agent Development Kit (ADK) vs Mastra](https://www.anchorterminal.com/compare/google-adk-vs-mastra.md)\n- [Agent Development Kit (ADK) vs smolagents](https://www.anchorterminal.com/compare/google-adk-vs-smolagents.md)\n- [guilds.run vs Mastra](https://www.anchorterminal.com/compare/guilds-run-vs-mastra.md)\n- [guilds.run vs smolagents](https://www.anchorterminal.com/compare/guilds-run-vs-smolagents.md)\n- [LangGraph vs Mastra](https://www.anchorterminal.com/compare/langgraph-vs-mastra.md)\n- [LangGraph vs smolagents](https://www.anchorterminal.com/compare/langgraph-vs-smolagents.md)\n- [LlamaIndex Framework vs Mastra](https://www.anchorterminal.com/compare/llamaindex-vs-mastra.md)\n- [LlamaIndex Framework vs smolagents](https://www.anchorterminal.com/compare/llamaindex-vs-smolagents.md)\n- [Mastra vs Microsoft Agent Framework](https://www.anchorterminal.com/compare/mastra-vs-microsoft-agent-framework.md)\n- [Mastra vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk.md)\n- [Mastra vs Pydantic AI](https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai.md)\n- [Mastra vs Strands Agents](https://www.anchorterminal.com/compare/mastra-vs-strands-agents.md)\n- [Mastra vs TradingAgents](https://www.anchorterminal.com/compare/mastra-vs-tradingagents.md)\n- [Mastra vs AI SDK](https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk.md)\n- [Microsoft Agent Framework vs smolagents](https://www.anchorterminal.com/compare/microsoft-agent-framework-vs-smolagents.md)\n- [OpenAI Agents SDK vs smolagents](https://www.anchorterminal.com/compare/openai-agents-sdk-vs-smolagents.md)\n- [Pydantic AI vs smolagents](https://www.anchorterminal.com/compare/pydantic-ai-vs-smolagents.md)\n- [smolagents vs Strands Agents](https://www.anchorterminal.com/compare/smolagents-vs-strands-agents.md)\n- [smolagents vs TradingAgents](https://www.anchorterminal.com/compare/smolagents-vs-tradingagents.md)\n- [smolagents vs AI SDK](https://www.anchorterminal.com/compare/smolagents-vs-vercel-ai-sdk.md)\n",
  "meta": {
    "attribution": "Anchor Terminal (https://www.anchorterminal.com)",
    "attributionRequired": true,
    "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)",
    "docs": "https://www.anchorterminal.com/docs/",
    "generatedAt": "2026-11-07",
    "license": "CC-BY-4.0",
    "method": "https://www.anchorterminal.com/benchmark/",
    "methodology": "0.7",
    "openapi": "https://www.anchorterminal.com/openapi.json",
    "preview": false,
    "run": "2026-10-01",
    "runLabel": "October 2026 research run",
    "terms": "https://www.anchorterminal.com/terms/#data"
  },
  "page": {
    "breadcrumbs": [
      {
        "name": "Home",
        "url": "https://www.anchorterminal.com/"
      },
      {
        "name": "Compare",
        "url": "https://www.anchorterminal.com/compare/"
      },
      {
        "name": "Mastra vs smolagents",
        "url": ""
      }
    ],
    "description": "Mastra scores 74.2 (BB) to smolagents's 58.7 (C) for agent frameworks. Prices, MCP, x402, uptime and agent notes side by side.",
    "facts": [
      "Mastra BB 74.2",
      "smolagents C 58.7",
      "scores"
    ],
    "h1": "Mastra vs smolagents",
    "image": "https://www.anchorterminal.com/assets/og/default.png",
    "path": "/compare/mastra-vs-smolagents",
    "published": "2026-10-01",
    "section": "tools",
    "title": "Mastra vs smolagents for AI agents in 2026: scores and prices",
    "toc": null,
    "updated": "2026-11-07",
    "url": "https://www.anchorterminal.com/compare/mastra-vs-smolagents"
  },
  "tokens": {
    "markdown": 3900,
    "slim": 1980
  },
  "version": 1
}
