Mastra vs TradingAgents

Mastra 98

Typed TypeScript API with a reference section (25). llms.txt with a when-to-use list and condensed instructions for coding agents (10). The docs say when to use durable agents, and point multi-agent users from .network() to supervisor agents (20). Tools take Zod schemas (15). Examples on every page, and MastraError with ids and categories documented, though errors are spread across pages (13). Per-package changelogs and migration guides (15).

TradingAgents 61

Framework reading. No API reference or docs site. Typed interfaces exist in the source, Pydantic models for the research manager's, trader's and portfolio manager's outputs and Annotated signatures on the twelve data tools, with no py.typed marker (10 of 25). The README and changelog are Markdown in the repository; no llms.txt (4 of 10). The README states limits plainly, that runs vary, which statements past-dated runs withhold and why, and that it is a research tool, not advice (15 of 20). Configuration is a plain dict of string keys, though environment overrides are coerced to the default's type and fail loudly on a bad value (8 of 15). Runnable Python and CLI examples throughout the README; the vendor error hierarchy is documented only in source docstrings (9 of 15). Dated changelog for every release from 0.1.0 with upgrade notes (15).

Mastra 87

Official npm packages, Node 22.13 or newer (20). Public CI workflows for unit, store, workspace and e2e tests; on 6 November the newest runs on main (Version Packages, Trigger Cloud Integration Tests) succeeded, while the test workflows themselves run on pull requests (22). 436 open issues and 795 open issues and pull requests on 6 November from GitHub's API, with 2,077 issues opened in the 90 days to 3 November; all 50 newest had a comment and 24 were closed, with issue-triage automation (18). A changesets CHANGELOG per package, a CI gate that needs approval for any major bump and migration guides, but no written versioning policy found, and .network() is deprecated without a removal date (12). 1.82.0 (15). 20+22+18+12+15 = 87, up from 74 on 6 October, when GitHub couldn't be read.

TradingAgents 52

Read with the local-software lines, because the owner runs it. Python 3.11 or later is stated and CI tests 3.11 to 3.14, but the project publishes no PyPI package. No workflow uploads one, and the README installs from a clone or Docker Compose. From 0.7.0 a release workflow builds a wheel and source archive from each tag and attaches them to the GitHub release (12 of 20). Public CI on every push and pull request runs the test suite (about 1,009 test functions at v0.7.1) on four Python versions and once in America/New_York, a clean-install import check and Ruff. The 25 October check read the pass state from shields.io, a third-party copy of GitHub data this run doesn't use, so that reading is struck, and the pass state on main is unread (15, as berth and agentvfs). Issue counts came from the same source and are struck too. On the clone, 0.7.1 (27 October) fixes 22 numbered issues, 17 of them above #1518, the newest fixed in 0.7.0 on 16 October, and credits 15 outside contributors; open crash or regression issues and reply times are unread (15, as berth on the same pattern). The changelog follows Keep a Changelog and Semantic Versioning and lists breaking changes under "Upgrading from", but 0.5.1, a patch release, moved import paths and removed classes (10 of 15). Version 0.7.1 with no stability statement (0). 12+15+15+10+0 = 52.

Mastra 92

An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10).

TradingAgents 61

Framework reading, scored on what an outside agent needs to call it. No MCP client or server, so it can't be attached as tools; a run is four lines of Python (TradingAgentsGraph(config=...).propagate(ticker, date)) or one headless CLI command with flags (10 of 25). Analyst selection, debate and risk rounds (default 1), max_tool_rounds (20), max_recur_limit (100), article limits and --no-html size a run (14 of 20). A typed vendor error hierarchy separates unavailable from absent data, the headless CLI names the missing flag before a run starts, and an unparseable decision returns REVIEW rather than Hold (15 of 20). Checkpoint resume is opt-in, a backtest rerun with the same run_id skips finished cells, and settlement writes each decision once; nothing writes to an outside system (15 of 20). Sensible defaults, but the default provider is OpenAI's GPT-6 models with a key, and Python only (7 of 15).

Mastra 96

@mastra/core 1.82.0 on 2026-11-04 (30). 27 stable releases in the 90 days to 6 November, 8 of them since 6 October (20). 436 open issues on 6 November, all 50 newest issues commented and 24 of them closed (22). Client, MCP and store packages are current, and @mastra/mcp 1.x stays supported beside 2.x (15). Renovate and CI configured, with the newest runs on main passing (9). 30+20+22+15+9 = 96.

TradingAgents 78

0.7.1 on 27 October 2026 (30). Seven releases in the 90 days to 2 November, 0.4.0 (31 August), 0.5.0, 0.5.1, 0.5.2, 0.6.0, 0.7.0 and 0.7.1 (20). The earlier issue and pull request counts came from shields.io and are struck. On the clone, fixes cite issue numbers and each release credits the people who reported or fixed them (15 outside contributors in 0.7.1), but 251 of the 258 commits since 4 August are by one maintainer's accounts and reply times couldn't be read (13 of 25, as pipecat on clone evidence). No PyPI package; versions ship as GitHub releases with a wheel since 0.7.0 (8 of 15). CI with tests, lint and a clean-install check; dependencies set lower bounds only and no Dependabot configuration is in the repository (7 of 10). 30+20+13+8+7 = 78.

Mastra 67

The CLI sends PostHog analytics, server startup sends token counts per model and a count of registered agents, tools and MCP servers, and Studio sends browser analytics, all on by default and documented, with one opt-out, MASTRA_TELEMETRY_DISABLED=1. Since #26986 (16 October 2026) each server process also reports token use per provider and model every 15 minutes, and the telemetry reference read on 6 November says server events carry a project identifier that is a raw Platform UUID or a hash of the Git origin remote, so they "aren't anonymous" (12). requireToolApproval on agents and MCP servers, allowedHosts for MCP HTTP, a curated environment for stdio servers, and sandboxed workspaces (20). PromptInjectionDetector, PII and moderation processors, and docs that call tool results untrusted model input (15). Built-in tracing with OpenTelemetry and other exporters (15). No SECURITY.md, no security.txt and no bug bounty found. A blog post says Mastra is SOC 2 Type II audited, which isn't scored for a framework, and we found no public advisory from Mastra about the June incident (5). Framework reading. 15+20+15+15+5 = 70 on 6 October, 12+20+15+15+5 = 67 on 6 November.

TradingAgents 62

Framework reading. 30 for what leaves the machine and how credentials are held, 20 for least privilege and approvals, 15 for prompt injection, 15 for audit and 20 for the security programme. Keys are read from the environment, and the package loads the nearest .env on import by walking up from the working directory. The ChatGPT sign-in uses PKCE and dynamic client registration, keeps tokens in a 0600 file and revokes them on logout. The only calls of its own are the interactive CLI's daily release and notice check, with no run data, off without a terminal or with TRADINGAGENTS_NO_UPDATE_CHECK=1. SEC EDGAR gets a placeholder contact address unless one is set (24 of 30). It places no orders and holds no broker credentials, the data tools only read, and every ticker is validated before it is used in a file path. No approval hooks, which nothing in it needs (14 of 20). News, Reddit and StockTwits text goes into prompts. The source names prompt injection as the reason for path validation, but no guidance on injection was found in the README (5 of 15). Saved reports record the run's settings and each agent's report, the memory log keeps every decision, and debug=True streams the graph (11 of 15). Security reports go to GitHub private vulnerability reporting per the issue template, and the changelog has Security sections for a langchain-core patch and a dependency removed over CVE-2026-22218. No SECURITY.md, no security.txt on tauric.ai (404 on 2 November), no bounty, and the repository's advisories page wasn't read (8 of 20). 24+14+5+11+8 = 62.