# Mastra vs Strands Agents

> Strands Agents scores 80 (A) to Mastra's 74.2 (BB) for agent frameworks. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/mastra-vs-strands-agents
- Markdown: https://www.anchorterminal.com/compare/mastra-vs-strands-agents.md (~3,650 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Strands Agents scores 80 (A) on agent readiness against Mastra's 74.2 (BB), and leads in 1 of 7 scored categories. Mastra leads on agent ergonomics and maintenance & community. Both do agent frameworks.

- Mastra: grade BB, 74.2/100, rank #91 of 1510. Markdown https://www.anchorterminal.com/tools/mastra.md · JSON https://www.anchorterminal.com/api/v1/tools/mastra.json
- Strands Agents: grade A, 80/100, rank #15 of 1510. Markdown https://www.anchorterminal.com/tools/strands-agents.md · JSON https://www.anchorterminal.com/api/v1/tools/strands-agents.json
- Best agent frameworks and SDKs: https://www.anchorterminal.com/best/frameworks/index.md
- All 171 frameworks comparisons: https://www.anchorterminal.com/compare/frameworks/index.md

## Which one, for what

### Mastra (BB)

Good for: TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.

Ahead on:
- Agent ergonomics, 92 against 87
- Maintenance & community, 96 against 87

Watch for: Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026

### Strands Agents (A)

Good for: Python or TypeScript teams, especially on AWS, who want a model-driven loop with MCP, multi-agent patterns and approval gates.

Ahead on:
- Security & auth, 89 against 67

Also in its favour:
- No key needed to call it

Watch for: Three advisories in October 2026 on A2A session sharing and world-readable default session files, fixed in 1.43.0 and 1.48.0


## Why the edge

### Security & auth: Strands Agents +22

- Mastra (67): The CLI sends PostHog analytics, server startup sends token counts per model and a count of registered agents, tools and MCP servers, and Studio sends browser analytics, all on by default and documented, with one opt-out, MASTRA_TELEMETRY_DISABLED=1. Since #26986 (16 October 2026) each server process also reports token use per provider and model every 15 minutes, and the telemetry reference read on 6 November says server events carry a project identifier that is a raw Platform UUID or a hash of the Git origin remote, so they "aren't anonymous" (12). requireToolApproval on agents and MCP servers, allowedHosts for MCP HTTP, a curated environment for stdio servers, and sandboxed workspaces (20). PromptInjectionDetector, PII and moderation processors, and docs that call tool results untrusted model input (15). Built-in tracing with OpenTelemetry and other exporters (15). No SECURITY.md, no security.txt and no bug bounty found. A blog post says Mastra is SOC 2 Type II audited, which isn't scored for a framework, and we found no public advisory from Mastra about the June incident (5). Framework reading. 15+20+15+15+5 = 70 on 6 October, 12+20+15+15+5 = 67 on 6 November.
- Strands Agents (89): Framework reading (telemetry defaults, approvals, guardrails, sandboxing). No usage analytics found in either SDK, and OpenTelemetry is opt-in (25). Interrupts and the harness's interventions gate tool calls behind human approval or Cedar policies, but the default sandbox is the local host (16). Guardrails, PII redaction and trusted message history pages, with Bedrock Guardrails integration (13). OpenTelemetry traces for every model and tool call (15). The AWS Vulnerability Disclosure Program on HackerOne and three advisories in October 2026 published with fixed versions (20). 25+16+13+15+20 = 89.

### Maintenance & community: Mastra +9

- Mastra (96): @mastra/core 1.82.0 on 2026-11-04 (30). 27 stable releases in the 90 days to 6 November, 8 of them since 6 October (20). 436 open issues on 6 November, all 50 newest issues commented and 24 of them closed (22). Client, MCP and store packages are current, and @mastra/mcp 1.x stays supported beside 2.x (15). Renovate and CI configured, with the newest runs on main passing (9). 30+20+22+15+9 = 96.
- Strands Agents (87): Python 1.64.0 and TypeScript 1.24.0 tagged on 4 November 2026 (30). Python 1.55.0 on 8 September, 1.61.0 on 14 October, 1.62.0 on 21 October and 1.63.0 on 30 October among many releases in 90 days (20). 664 open issues and 1,151 open issues and pull requests on 6 November, with 545 issues opened in the 90 days to 3 November. Of the 50 newest, 12 had a comment and 15 were closed, and 9 of the 40 newest open items carry a bug label. An issue-responder workflow runs on new issues (12). Both official SDKs are current (15). Dependency floors, security-audit workflows and CI passing on main (10). 30+20+12+15+10 = 87.

### Agent ergonomics: Mastra +5

- Mastra (92): An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10).
- Strands Agents (87): Framework reading. An MCPClient is passed straight to the agent in a few lines and its lifecycle is managed, with tool filtering per client (22). Conversation managers, turn limits, token budgets and cancellation bound each run (20). Stop reasons and typed events, and hooks that can retry a model or tool call (16). Retry strategies, session managers that persist and resume a conversation, and interrupts that resume where they paused (17). Two official languages, but the default provider is Bedrock, which needs AWS credentials and model access (12). 22+20+16+17+12 = 87.

## Score by category

| Category | Weight | Mastra | Strands Agents | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 87 | 87 | even |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 98 | 95 | Mastra +3 |
| Agent ergonomics | 13% (16.2 this run) | 92 | 87 | Mastra +5 |
| Security & auth | 14% (17.5 this run) | 67 | 89 | Strands Agents +22 |
| Payments & pricing | 10% (12.5 this run) | 60 | 60 | even |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 96 | 87 | Mastra +9 |
| Transparency & trust | 7% (8.8 this run) | 72 | 72 | even |
| Negative events | ≤15 | -8 | -4 | |
| **Total** | | **74.2 · BB** | **80 · A** | |

## Facts side by side

| Fact | Mastra | Strands Agents |
| --- | --- | --- |
| Kind | Agent framework | Agent framework |
| Vendor | Kepler Software, Inc. | Amazon Web Services |
| Hosted endpoint | no (local only) | no (local only) |
| Transports |  |  |
| Auth | API key | None |
| Pricing | Free | Free |
| x402 | no | no |
| Licence | Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing | Apache-2.0 |
| Read-only variant documented | no | no |
| llms.txt | yes | yes |
| Last release | 2026-11-04 | 2026-11-04 |
| Terms last updated | 2026-10-26 | no document linked |
| Privacy policy last updated | no date given | no document linked |
| Customer content may train models | yes | not read yet |
| Terms restrict automated access | yes | not read yet |
| Terms restrict benchmarking | not found in the text | not read yet |
| Terms or service can change without notice | yes | not read yet |
| Arbitration or class-action waiver | yes | not read yet |
| Popularity | 29k stars, 3.1M npm/wk | 9.1k stars, 698k npm/wk, 8.9M PyPI/wk |

## Verdicts

**Mastra.** A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes.

**Strands Agents.** An Apache-2.0 agent SDK for Python and TypeScript with a managed MCP client, multi-agent patterns, interrupts and Cedar policies for approval, opt-in OpenTelemetry and no usage analytics. Bedrock is the default model, the default sandbox is the local host, and three session-isolation advisories were fixed in October 2026.

## Before you call either

### Mastra

1. Set MASTRA_TELEMETRY_DISABLED=1 in every environment that runs the CLI, the server or Studio
2. Pin exact versions with a lockfile, and make sure no 17 June 2026 release such as @mastra/core 1.42.1 is installed
3. Set requireToolApproval on MCP servers that write, and allowedHosts when server URLs come from configuration
4. Add PromptInjectionDetector as an input processor when tools return web or user content
5. Use supervisor agents through generate() or stream(). `.network()` is deprecated

### Strands Agents

1. Upgrade to strands-agents 1.48.0 or later, and set a private session directory rather than the /tmp default
2. Pass a model explicitly when AWS credentials aren't configured, since Bedrock is the default
3. Use interrupts or the harness's `interventions` for tools that write, send or pay
4. Run shell and file tools in the Docker or SSH sandbox when the agent runs untrusted code
5. Pin a minor version when using A2A, MCP or experimental modules

## Questions

### Which is better for AI agents, Mastra or Strands Agents?

Strands Agents scores 80 (A) on agent readiness against Mastra's 74.2 (BB), and leads in 1 of 7 scored categories. Mastra leads on agent ergonomics and maintenance & community.

### Are Mastra and Strands Agents open source?

Yes. Mastra is open source (Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing). Strands Agents is open source (Apache-2.0).


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/mastra-vs-strands-agents.json, and with the fewest tokens: https://www.anchorterminal.com/compare/mastra-vs-strands-agents.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "mastra", "b": "strands-agents"}`. From a terminal: `anchor compare mastra strands-agents`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/mastra.json and https://www.anchorterminal.com/api/v1/tools/strands-agents.json

## Other comparisons with Mastra or Strands Agents

- [AgentOS vs Mastra](https://www.anchorterminal.com/compare/agentos-vs-mastra.md)
- [AgentOS vs Strands Agents](https://www.anchorterminal.com/compare/agentos-vs-strands-agents.md)
- [Agno vs Mastra](https://www.anchorterminal.com/compare/agno-vs-mastra.md)
- [Agno vs Strands Agents](https://www.anchorterminal.com/compare/agno-vs-strands-agents.md)
- [BoxLang AI vs Mastra](https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra.md)
- [BoxLang AI vs Strands Agents](https://www.anchorterminal.com/compare/boxlang-ai-vs-strands-agents.md)
- [Claude Agent SDK vs Mastra](https://www.anchorterminal.com/compare/claude-agent-sdk-vs-mastra.md)
- [Claude Agent SDK vs Strands Agents](https://www.anchorterminal.com/compare/claude-agent-sdk-vs-strands-agents.md)
- [CrewAI vs Mastra](https://www.anchorterminal.com/compare/crewai-vs-mastra.md)
- [CrewAI vs Strands Agents](https://www.anchorterminal.com/compare/crewai-vs-strands-agents.md)
- [Cursor Agent SDK vs Mastra](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra.md)
- [Cursor Agent SDK vs Strands Agents](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-strands-agents.md)
- [Docker Agent vs Mastra](https://www.anchorterminal.com/compare/docker-agent-vs-mastra.md)
- [Docker Agent vs Strands Agents](https://www.anchorterminal.com/compare/docker-agent-vs-strands-agents.md)
- [Agent Development Kit (ADK) vs Mastra](https://www.anchorterminal.com/compare/google-adk-vs-mastra.md)
- [Agent Development Kit (ADK) vs Strands Agents](https://www.anchorterminal.com/compare/google-adk-vs-strands-agents.md)
- [guilds.run vs Mastra](https://www.anchorterminal.com/compare/guilds-run-vs-mastra.md)
- [guilds.run vs Strands Agents](https://www.anchorterminal.com/compare/guilds-run-vs-strands-agents.md)
- [LangGraph vs Mastra](https://www.anchorterminal.com/compare/langgraph-vs-mastra.md)
- [LangGraph vs Strands Agents](https://www.anchorterminal.com/compare/langgraph-vs-strands-agents.md)
- [LlamaIndex Framework vs Mastra](https://www.anchorterminal.com/compare/llamaindex-vs-mastra.md)
- [LlamaIndex Framework vs Strands Agents](https://www.anchorterminal.com/compare/llamaindex-vs-strands-agents.md)
- [Mastra vs Microsoft Agent Framework](https://www.anchorterminal.com/compare/mastra-vs-microsoft-agent-framework.md)
- [Mastra vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk.md)
- [Mastra vs Pydantic AI](https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai.md)
- [Mastra vs smolagents](https://www.anchorterminal.com/compare/mastra-vs-smolagents.md)
- [Mastra vs TradingAgents](https://www.anchorterminal.com/compare/mastra-vs-tradingagents.md)
- [Mastra vs AI SDK](https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk.md)
- [Microsoft Agent Framework vs Strands Agents](https://www.anchorterminal.com/compare/microsoft-agent-framework-vs-strands-agents.md)
- [OpenAI Agents SDK vs Strands Agents](https://www.anchorterminal.com/compare/openai-agents-sdk-vs-strands-agents.md)
- [Pydantic AI vs Strands Agents](https://www.anchorterminal.com/compare/pydantic-ai-vs-strands-agents.md)
- [smolagents vs Strands Agents](https://www.anchorterminal.com/compare/smolagents-vs-strands-agents.md)
- [Strands Agents vs TradingAgents](https://www.anchorterminal.com/compare/strands-agents-vs-tradingagents.md)
- [Strands Agents vs AI SDK](https://www.anchorterminal.com/compare/strands-agents-vs-vercel-ai-sdk.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp