{ "data": { "a": { "slug": "mastra", "name": "Mastra", "vendor": "Kepler Software, Inc.", "vendorUrl": "https://mastra.ai", "kind": "framework", "category": "frameworks", "summary": "Open-source TypeScript framework from Mastra for building agents and workflows, with memory, RAG, evals, tracing, an MCP client and server, and a local Studio. An optional hosted platform runs deployments and observability.", "url": "https://www.anchorterminal.com/tools/mastra", "markdownUrl": "https://www.anchorterminal.com/tools/mastra.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/mastra.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/mastra.json", "dns": "mastra.grade.anchorterminal.com", "repo": "https://github.com/mastra-ai/mastra", "license": "Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing", "transports": [], "packages": [ { "registry": "npm", "name": "@mastra/core" }, { "registry": "npm", "name": "@mastra/mcp" }, { "registry": "npm", "name": "mastra" } ], "auth": "api-key", "authNotes": "The framework has no account of its own. The model router takes `provider/model` strings and each provider's own key. The hosted Mastra platform needs an account.", "pricing": "free", "pricingNotes": "Free and open source. You pay for model calls. The hosted platform has a $0 Starter plan with 100K observability events and 24 CPU hours, then $10 per 100K events and $0.35 a CPU hour, and Teams at $250 a month (https://mastra.ai/pricing, checked 2026-11-06).", "priceSummary": "Free · OSS", "where": "library", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Mastra docs, the repository or the pricing page (checked 2026-10-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 29383, "npmWeekly": 3116983, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://mastra.ai/docs", "llmsTxt": "https://mastra.ai/llms.txt", "capabilities": [ "agent.framework", "agent.durable", "agent.mcp-client", "agent.multi-agent" ], "tags": [ "framework", "typescript", "open-source", "llms-txt", "mcp", "telemetry-default-on" ], "lastRelease": "2026-11-04", "graded": true, "anchor": { "graded": true, "score": 74.2, "grade": "BB", "agentReady": true, "rank": 91, "ranked": true, "rankOf": 1510, "categoryRank": 7, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 92, "maintenance": 96, "payments": 60, "reliability": 87, "schema": 98, "security": 67, "transparency": 72 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": -8, "negativeNotes": [ "2026-06-17. Malicious versions of Mastra's npm packages were published, among them @mastra/core 1.42.1 at 01:15 UTC, and GitHub malware advisories that day (GHSA-pp62-grrw-hvfp and others) say any machine that installed one should be treated as fully compromised. All 21 Mastra packages we checked on OSV carry one. Mastra published clean versions the same day and the changelogs name an \"easy-day-js\" supply-chain incident, but we found no advisory or post-mortem from Mastra. Fixed and under four months old, so 8 points. https://osv.dev/vulnerability/MAL-2026-6011" ], "verdict": "A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes.", "bestFor": "TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.", "strengths": [ "MCP client with requireToolApproval per server or per tool, allowedHosts and a curated environment for stdio servers", "Guardrail processors for prompt injection, PII, moderation and cost limits, run on input and output", "Workflows with snapshots, suspend and resume, and durable agents on Inngest or an evented engine", "Apache 2.0 core, 1.0 since 20 January 2026, with 27 releases of @mastra/core in 90 days to 6 November", "llms.txt with a when-to-use section and condensed instructions for coding agents" ], "weaknesses": [ "Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026", "CLI, server and Studio send usage analytics by default, including token counts every 15 minutes, off with MASTRA_TELEMETRY_DISABLED=1", "No SECURITY.md, no security.txt and no bug bounty found", "Code under ee/ is source-available under the Mastra Enterprise License, not Apache 2.0", "TypeScript only, Node 22.13 or newer" ], "agentNotes": [ "Set MASTRA_TELEMETRY_DISABLED=1 in every environment that runs the CLI, the server or Studio", "Pin exact versions with a lockfile, and make sure no 17 June 2026 release such as @mastra/core 1.42.1 is installed", "Set requireToolApproval on MCP servers that write, and allowedHosts when server URLs come from configuration", "Add PromptInjectionDetector as an input processor when tools return web or user content", "Use supervisor agents through generate() or stream(). `.network()` is deprecated" ], "metrics": { "kind": "library", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 74.2 } ], "editorialScores": { "ergonomics": 92, "maintenance": 96, "payments": 60, "reliability": 87, "schema": 98, "security": 67, "transparency": 72 }, "provenanceScore": 71, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm create mastra@latest # or: npm i @mastra/core @mastra/mcp" }, "letme": { "capability": "https://letme.dev/agent.framework", "tool": "https://letme.dev/mastra" }, "area": "frameworks", "provenance": { "legalEntity": "Kepler Software, Inc.", "domain": "mastra.ai", "domainRegistered": "2024-10-01", "endpointOnVendorDomain": null, "terms": "https://mastra.ai/terms-of-service", "privacy": "https://mastra.ai/privacy-policy", "statusPage": "https://statuspage.incident.io/mastra-platform", "changelog": "https://github.com/mastra-ai/mastra/blob/main/packages/core/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The privacy policy names Kepler Software Inc as operator of mastra.ai and shows a last-published date of 25 April 2025.", "The licence file is copyright Kepler Software, Inc.", "mastra.ai/.well-known/security.txt returns 404 (rechecked 6 November 2026), and the repository has no SECURITY.md.", "RDAP gives mastra.ai a registration date of 2024-10-01.", "The status page covers the hosted platform, not the framework." ], "score": 71 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/mastra.json", "live": { "slug": "mastra", "vendorStatus": { "page": "https://statuspage.incident.io/mastra-platform", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T19:22:27.41396844Z" }, "versions": [ { "registry": "github", "name": "mastra-ai/mastra", "version": "@mastra/core@1.82.0", "released": "2026-11-04", "seenAt": "2026-11-06T23:43:05.299046627Z" }, { "registry": "npm", "name": "@mastra/core", "version": "1.82.0", "seenAt": "2026-11-06T23:43:01.102546802Z" }, { "registry": "npm", "name": "@mastra/mcp", "version": "2.8.0", "seenAt": "2026-11-06T23:43:01.962943277Z" }, { "registry": "npm", "name": "mastra", "version": "1.38.0", "seenAt": "2026-11-06T23:43:03.330470883Z" } ], "githubStars": 29384, "npmWeekly": 3116983, "securityTxt": { "url": "https://mastra.ai/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:45.130857018Z" }, "llmsTxt": { "url": "https://mastra.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:57.501317652Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/mastra-ai/mastra/main/packages/core/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:21:37.959722321Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "0bdb3498f7aa" }, { "url": "https://mastra.ai/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:13:54.312763229Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "0204673a21a8" }, { "url": "https://mastra.ai/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:13:56.829832485Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1621ce3063d8" }, { "url": "https://mastra.ai/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:13:58.580048861Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "edbcf520f26c" } ], "updatedAt": "2026-11-07T19:22:27.41396844Z" } }, "answer": "Mastra scores 74.2 (BB) on agent readiness against TradingAgents's 61.4 (C), and leads in 6 of 7 scored categories.", "b": { "slug": "tradingagents", "name": "TradingAgents", "vendor": "Tauric Research", "vendorUrl": "https://tauric.ai", "kind": "framework", "category": "frameworks", "summary": "TradingAgents, from Tauric Research, is an open-source Python framework on LangGraph in which LLM agents for analysis, research debate, trading and risk review produce a five-tier rating and a report for one ticker and date.", "url": "https://www.anchorterminal.com/tools/tradingagents", "markdownUrl": "https://www.anchorterminal.com/tools/tradingagents.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/tradingagents.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/tradingagents.json", "dns": "tradingagents.grade.anchorterminal.com", "repo": "https://github.com/TauricResearch/TradingAgents", "license": "Apache-2.0", "transports": [], "packages": [], "auth": "api-key", "authNotes": "The framework has no account of its own. Each model provider's key is read from the environment or a .env file, which the package loads on import by walking up from the working directory. A ChatGPT Plus or Pro plan can be used instead through OpenAI's sign-in for open-source apps (PKCE, dynamic client registration, loopback redirect), with tokens kept in ~/.tradingagents/chatgpt-auth.json readable only by its owner and revoked by `tradingagents logout chatgpt`. Bedrock uses AWS credentials. Alpha Vantage, FRED and TypeSafe's Jev take optional keys; Yahoo Finance, SEC EDGAR, Reddit, StockTwits and Polymarket need none.", "pricing": "free", "pricingNotes": "Free under Apache 2.0, with nothing to buy from Tauric Research to run it. Each run calls the chosen model provider many times (four analysts, a debate, a trader, three risk debaters and two managers by default), billed by that provider, or counted against a ChatGPT plan's usage limits. Alpha Vantage and Jev bill on their own terms when their keys are set. Tauric Research's hosted services at tauric.ai are invitation or enterprise access with no public price, and are not this listing (checked 2026-10-25).", "priceSummary": "Free · OSS", "where": "library", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the source, README or changelog of v0.7.0 (checked 2026-10-25).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-02" }, "docsUrl": "https://github.com/TauricResearch/TradingAgents#readme", "capabilities": [ "agent.framework", "agent.multi-agent", "agent.durable" ], "tags": [ "framework", "python", "langgraph", "open-source", "apache-2.0", "self-hosted", "local", "cli", "docker", "free", "pre-1.0" ], "lastRelease": "2026-10-27", "graded": true, "anchor": { "graded": true, "score": 61.4, "grade": "C", "agentReady": false, "rank": 617, "ranked": true, "rankOf": 1510, "categoryRank": 16, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 61, "maintenance": 78, "payments": 60, "reliability": 52, "schema": 61, "security": 62, "transparency": 68 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-02" }, "negative": 0, "verdict": "An Apache 2.0 LangGraph framework at 0.7.1 with seven releases in 90 days, a dated changelog with upgrade notes, a public test matrix and point-in-time rules for historical runs. It has no MCP client or server, no PyPI package and no documentation beyond the README, and its output is a model-written rating that places no orders.", "bestFor": "Researchers who want a fixed multi-agent analysis of one listed instrument or crypto pair on a date, with point-in-time data for backtests, and who will run Python.", "strengths": [ "Apache 2.0, with seven releases between 31 August and 27 October 2026 and \"Upgrading from\" notes in a dated changelog", "CI runs about 1,009 test functions on Python 3.11 to 3.14, a clean-install import check and Ruff on every push and pull request", "Past-dated runs read SEC EDGAR statements as filed on that date and withhold Yahoo statements and insider trades that can't be dated", "Runs headless from flags and TRADINGAGENTS_* variables, and checkpoint resume and backtest run IDs skip work already done", "Places no orders and holds no broker credentials; tools only read market, filing, news and social data" ], "weaknesses": [ "No MCP client or MCP server, so an agent drives it only through Python or the CLI", "Not on PyPI; installs from a clone, Docker or the wheel attached to each GitHub release since 0.7.0", "Documentation is the README and changelog only, with no API reference or llms.txt", "0.5.1, a patch release, moved import paths and removed classes without a deprecation period", "News, Reddit and StockTwits text goes into prompts with no documented guidance on prompt injection" ], "agentNotes": [ "Run headless with `tradingagents --ticker \u003cT\u003e --date \u003cYYYY-MM-DD\u003e --analysts market,news,fundamentals --save --no-show`; a missing answer stops the run and names the flag", "Guard on the REVIEW signal before mapping `propagate()`'s decision to a rating; it means no rating could be parsed", "Set SEC_EDGAR_USER_AGENT to the operator's own name and address before fetching US fundamentals", "Keep provider keys out of the working directory tree unless intended, since the package loads the nearest .env on import", "Treat the rating as model output for research; the framework places no orders and its results vary between runs" ], "metrics": { "kind": "library", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 61.4 } ], "editorialScores": { "ergonomics": 61, "maintenance": 78, "payments": 60, "reliability": 52, "schema": 61, "security": 62, "transparency": 73 }, "provenanceScore": 62, "checked": { "categories": { "ergonomics": "2026-11-02", "maintenance": "2026-11-02", "payments": "2026-11-02", "reliability": "2026-11-02", "schema": "2026-11-02", "security": "2026-11-02", "transparency": "2026-11-02" }, "last": "2026-11-02", "lastMoved": "2026-11-02", "oldest": "2026-11-02", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "git clone https://github.com/TauricResearch/TradingAgents.git \u0026\u0026 cd TradingAgents \u0026\u0026 pip install ." }, "letme": { "capability": "https://letme.dev/agent.framework", "tool": "https://letme.dev/tradingagents" }, "area": "frameworks", "provenance": { "legalEntity": "Tauric Research", "domain": "tauric.ai", "domainRegistered": "2025-03-26", "endpointOnVendorDomain": null, "terms": "https://tauric.ai/terms", "privacy": "https://tauric.ai/privacy", "statusPage": "", "changelog": "https://github.com/TauricResearch/TradingAgents/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-02", "notes": [ "The terms and privacy policy, both effective 31 October 2026, name Tauric Research and California law and cover tauric.ai's hosted services. No legal form or address was found. The framework itself is under Apache 2.0, whose LICENSE file carries no copyright line.", "tauric.ai/.well-known/security.txt answered 404 on 2 November 2026 (on 25 October it returned the site's HTML page). The repository's issue template sends security reports to GitHub private vulnerability reporting; there is no SECURITY.md.", "RDAP gives tauric.ai a registration date of 2025-03-26.", "No status page; the software runs on the user's machine.", "tauric.ai's robots.txt carries Content-Signal: ai-train=yes, search=yes, ai-input=yes." ], "score": 62 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/tradingagents.json", "live": { "slug": "tradingagents", "versions": [ { "registry": "github", "name": "TauricResearch/TradingAgents", "version": "v0.7.1", "released": "2026-10-27", "seenAt": "2026-11-07T00:12:38.886880905Z" } ], "githubStars": 121015, "securityTxt": { "url": "https://tauric.ai/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:01:04.508537721Z" }, "domain": { "domain": "tauric.ai", "registered": "2025-03-26", "source": "https://rdap.identitydigital.services/rdap/domain/tauric.ai", "checkedAt": "2026-11-01T14:17:50.711505753Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/TauricResearch/TradingAgents/main/CHANGELOG.md", "kind": "deprecations", "status": 304, "checkedAt": "2026-11-07T14:19:27.182748345Z", "changedAt": "2026-10-28T04:42:43.2803853Z", "fingerprint": "17477e48440b" }, { "url": "https://tauric.ai/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:21:51.458749311Z", "changedAt": "2026-11-06T13:43:19.647848599Z", "fingerprint": "d55215742695" }, { "url": "https://tauric.ai/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:21:53.696550753Z", "changedAt": "2026-11-06T13:43:21.904160871Z", "fingerprint": "9a81673b9bce" } ], "github": { "repo": "tauricresearch/tradingagents", "checkedAt": "2026-11-02T08:27:02.133359759Z", "stars": 119716, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-27T08:43:04Z", "openIssues": 38, "openPRs": 68, "issuesOpened90d": 100, "issuesClosed90d": 228, "prsMerged90d": 15, "ci": { "branch": "main", "runs": 43, "success": 43, "failure": 0, "other": 0, "latest": "success", "latestAt": "2026-10-27T08:39:50Z" }, "replies": { "sampled": 25, "unanswered": 3, "medianDays": 4.6 } }, "updatedAt": "2026-11-07T16:01:04.508537721Z" } }, "edges": [ { "by": 37, "category": "schema", "leads": "mastra", "name": "Schema \u0026 documentation", "reasons": { "a": "Typed TypeScript API with a reference section (25). llms.txt with a when-to-use list and condensed instructions for coding agents (10). The docs say when to use durable agents, and point multi-agent users from `.network()` to supervisor agents (20). Tools take Zod schemas (15). Examples on every page, and MastraError with ids and categories documented, though errors are spread across pages (13). Per-package changelogs and migration guides (15).", "b": "Framework reading. No API reference or docs site. Typed interfaces exist in the source, Pydantic models for the research manager's, trader's and portfolio manager's outputs and Annotated signatures on the twelve data tools, with no py.typed marker (10 of 25). The README and changelog are Markdown in the repository; no llms.txt (4 of 10). The README states limits plainly, that runs vary, which statements past-dated runs withhold and why, and that it is a research tool, not advice (15 of 20). Configuration is a plain dict of string keys, though environment overrides are coerced to the default's type and fail loudly on a bad value (8 of 15). Runnable Python and CLI examples throughout the README; the vendor error hierarchy is documented only in source docstrings (9 of 15). Dated changelog for every release from 0.1.0 with upgrade notes (15)." }, "scores": { "a": 98, "b": 61 } }, { "by": 35, "category": "reliability", "leads": "mastra", "name": "Reliability", "reasons": { "a": "Official npm packages, Node 22.13 or newer (20). Public CI workflows for unit, store, workspace and e2e tests; on 6 November the newest runs on main (Version Packages, Trigger Cloud Integration Tests) succeeded, while the test workflows themselves run on pull requests (22). 436 open issues and 795 open issues and pull requests on 6 November from GitHub's API, with 2,077 issues opened in the 90 days to 3 November; all 50 newest had a comment and 24 were closed, with issue-triage automation (18). A changesets CHANGELOG per package, a CI gate that needs approval for any major bump and migration guides, but no written versioning policy found, and `.network()` is deprecated without a removal date (12). 1.82.0 (15). 20+22+18+12+15 = 87, up from 74 on 6 October, when GitHub couldn't be read.", "b": "Read with the local-software lines, because the owner runs it. Python 3.11 or later is stated and CI tests 3.11 to 3.14, but the project publishes no PyPI package. No workflow uploads one, and the README installs from a clone or Docker Compose. From 0.7.0 a release workflow builds a wheel and source archive from each tag and attaches them to the GitHub release (12 of 20). Public CI on every push and pull request runs the test suite (about 1,009 test functions at v0.7.1) on four Python versions and once in America/New_York, a clean-install import check and Ruff. The 25 October check read the pass state from shields.io, a third-party copy of GitHub data this run doesn't use, so that reading is struck, and the pass state on main is unread (15, as berth and agentvfs). Issue counts came from the same source and are struck too. On the clone, 0.7.1 (27 October) fixes 22 numbered issues, 17 of them above #1518, the newest fixed in 0.7.0 on 16 October, and credits 15 outside contributors; open crash or regression issues and reply times are unread (15, as berth on the same pattern). The changelog follows Keep a Changelog and Semantic Versioning and lists breaking changes under \"Upgrading from\", but 0.5.1, a patch release, moved import paths and removed classes (10 of 15). Version 0.7.1 with no stability statement (0). 12+15+15+10+0 = 52." }, "scores": { "a": 87, "b": 52 } }, { "by": 31, "category": "ergonomics", "leads": "mastra", "name": "Agent ergonomics", "reasons": { "a": "An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10).", "b": "Framework reading, scored on what an outside agent needs to call it. No MCP client or server, so it can't be attached as tools; a run is four lines of Python (`TradingAgentsGraph(config=...).propagate(ticker, date)`) or one headless CLI command with flags (10 of 25). Analyst selection, debate and risk rounds (default 1), `max_tool_rounds` (20), `max_recur_limit` (100), article limits and `--no-html` size a run (14 of 20). A typed vendor error hierarchy separates unavailable from absent data, the headless CLI names the missing flag before a run starts, and an unparseable decision returns REVIEW rather than Hold (15 of 20). Checkpoint resume is opt-in, a backtest rerun with the same `run_id` skips finished cells, and settlement writes each decision once; nothing writes to an outside system (15 of 20). Sensible defaults, but the default provider is OpenAI's GPT-6 models with a key, and Python only (7 of 15)." }, "scores": { "a": 92, "b": 61 } }, { "by": 18, "category": "maintenance", "leads": "mastra", "name": "Maintenance \u0026 community", "reasons": { "a": "@mastra/core 1.82.0 on 2026-11-04 (30). 27 stable releases in the 90 days to 6 November, 8 of them since 6 October (20). 436 open issues on 6 November, all 50 newest issues commented and 24 of them closed (22). Client, MCP and store packages are current, and @mastra/mcp 1.x stays supported beside 2.x (15). Renovate and CI configured, with the newest runs on main passing (9). 30+20+22+15+9 = 96.", "b": "0.7.1 on 27 October 2026 (30). Seven releases in the 90 days to 2 November, 0.4.0 (31 August), 0.5.0, 0.5.1, 0.5.2, 0.6.0, 0.7.0 and 0.7.1 (20). The earlier issue and pull request counts came from shields.io and are struck. On the clone, fixes cite issue numbers and each release credits the people who reported or fixed them (15 outside contributors in 0.7.1), but 251 of the 258 commits since 4 August are by one maintainer's accounts and reply times couldn't be read (13 of 25, as pipecat on clone evidence). No PyPI package; versions ship as GitHub releases with a wheel since 0.7.0 (8 of 15). CI with tests, lint and a clean-install check; dependencies set lower bounds only and no Dependabot configuration is in the repository (7 of 10). 30+20+13+8+7 = 78." }, "scores": { "a": 96, "b": 78 } }, { "by": 5, "category": "security", "leads": "mastra", "name": "Security \u0026 auth", "reasons": { "a": "The CLI sends PostHog analytics, server startup sends token counts per model and a count of registered agents, tools and MCP servers, and Studio sends browser analytics, all on by default and documented, with one opt-out, MASTRA_TELEMETRY_DISABLED=1. Since #26986 (16 October 2026) each server process also reports token use per provider and model every 15 minutes, and the telemetry reference read on 6 November says server events carry a project identifier that is a raw Platform UUID or a hash of the Git origin remote, so they \"aren't anonymous\" (12). requireToolApproval on agents and MCP servers, allowedHosts for MCP HTTP, a curated environment for stdio servers, and sandboxed workspaces (20). PromptInjectionDetector, PII and moderation processors, and docs that call tool results untrusted model input (15). Built-in tracing with OpenTelemetry and other exporters (15). No SECURITY.md, no security.txt and no bug bounty found. A blog post says Mastra is SOC 2 Type II audited, which isn't scored for a framework, and we found no public advisory from Mastra about the June incident (5). Framework reading. 15+20+15+15+5 = 70 on 6 October, 12+20+15+15+5 = 67 on 6 November.", "b": "Framework reading. 30 for what leaves the machine and how credentials are held, 20 for least privilege and approvals, 15 for prompt injection, 15 for audit and 20 for the security programme. Keys are read from the environment, and the package loads the nearest .env on import by walking up from the working directory. The ChatGPT sign-in uses PKCE and dynamic client registration, keeps tokens in a 0600 file and revokes them on logout. The only calls of its own are the interactive CLI's daily release and notice check, with no run data, off without a terminal or with TRADINGAGENTS_NO_UPDATE_CHECK=1. SEC EDGAR gets a placeholder contact address unless one is set (24 of 30). It places no orders and holds no broker credentials, the data tools only read, and every ticker is validated before it is used in a file path. No approval hooks, which nothing in it needs (14 of 20). News, Reddit and StockTwits text goes into prompts. The source names prompt injection as the reason for path validation, but no guidance on injection was found in the README (5 of 15). Saved reports record the run's settings and each agent's report, the memory log keeps every decision, and `debug=True` streams the graph (11 of 15). Security reports go to GitHub private vulnerability reporting per the issue template, and the changelog has Security sections for a langchain-core patch and a dependency removed over CVE-2026-22218. No SECURITY.md, no security.txt on tauric.ai (404 on 2 November), no bounty, and the repository's advisories page wasn't read (8 of 20). 24+14+5+11+8 = 62." }, "scores": { "a": 67, "b": 62 } } ], "facts": [ { "a": "Agent framework", "b": "Agent framework", "name": "Kind" }, { "a": "Kepler Software, Inc.", "b": "Tauric Research", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "", "name": "Transports" }, { "a": "API key", "b": "API key", "name": "Auth" }, { "a": "Free", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing", "b": "Apache-2.0", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "no", "name": "llms.txt" }, { "a": "2026-11-04", "b": "2026-10-27", "name": "Last release" }, { "a": "2026-10-26", "b": "2026-10-23", "name": "Terms last updated" }, { "a": "no date given", "b": "2026-10-23", "name": "Privacy policy last updated" }, { "a": "yes", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "29k stars, 3.1M npm/wk", "b": "none", "name": "Popularity" } ], "faq": [ { "answer": "Mastra scores 74.2 (BB) on agent readiness against TradingAgents's 61.4 (C), and leads in 6 of 7 scored categories.", "question": "Which is better for AI agents, Mastra or TradingAgents?" }, { "answer": "Yes. Mastra is open source (Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing). TradingAgents is open source (Apache-2.0).", "question": "Are Mastra and TradingAgents open source?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 87 against 52", "Schema \u0026 documentation, 98 against 61", "Agent ergonomics, 92 against 61", "Security \u0026 auth, 67 against 62", "Maintenance \u0026 community, 96 against 78" ], "also": [ "Agent-ready, a grade of BB or better" ], "goodFor": "TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.", "slug": "mastra", "watchFor": "Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026" }, { "aheadOn": null, "also": [ "No incidents deducted, where Mastra loses 8 points for them" ], "goodFor": "Researchers who want a fixed multi-agent analysis of one listed instrument or crypto pair on a date, with point-in-time data for backtests, and who will run Python.", "slug": "tradingagents", "watchFor": "No MCP client or MCP server, so an agent drives it only through Python or the CLI" } ], "history": { "mastra": null, "tradingagents": [ { "causes": [ "correction" ], "date": "2026-11-02", "delta": -3.3, "from": 64.7, "fromGrade": "B", "to": 61.4, "toGrade": "C" }, { "causes": [ "method" ], "date": "2026-10-30", "delta": -0.1, "from": 64.8, "fromGrade": "B", "to": 64.7, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 64.7, "fromGrade": "B", "to": 64.8, "toGrade": "B" } ] }, "job": { "capability": "agent.framework", "name": "Agent frameworks" }, "others": [ { "json": "https://www.anchorterminal.com/compare/agentos-vs-mastra.json", "title": "AgentOS vs Mastra", "url": "https://www.anchorterminal.com/compare/agentos-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/agentos-vs-tradingagents.json", "title": "AgentOS vs TradingAgents", "url": "https://www.anchorterminal.com/compare/agentos-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/agno-vs-mastra.json", "title": "Agno vs Mastra", "url": "https://www.anchorterminal.com/compare/agno-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/agno-vs-tradingagents.json", "title": "Agno vs TradingAgents", "url": "https://www.anchorterminal.com/compare/agno-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra.json", "title": "BoxLang AI vs Mastra", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/boxlang-ai-vs-tradingagents.json", "title": "BoxLang AI vs TradingAgents", "url": "https://www.anchorterminal.com/compare/boxlang-ai-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-mastra.json", "title": "Claude Agent SDK vs Mastra", "url": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-tradingagents.json", "title": "Claude Agent SDK vs TradingAgents", "url": "https://www.anchorterminal.com/compare/claude-agent-sdk-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/crewai-vs-mastra.json", "title": "CrewAI vs Mastra", "url": "https://www.anchorterminal.com/compare/crewai-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/crewai-vs-tradingagents.json", "title": "CrewAI vs TradingAgents", "url": "https://www.anchorterminal.com/compare/crewai-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra.json", "title": "Cursor Agent SDK vs Mastra", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-tradingagents.json", "title": "Cursor Agent SDK vs TradingAgents", "url": "https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/docker-agent-vs-mastra.json", "title": "Docker Agent vs Mastra", "url": "https://www.anchorterminal.com/compare/docker-agent-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/docker-agent-vs-tradingagents.json", "title": "Docker Agent vs TradingAgents", "url": "https://www.anchorterminal.com/compare/docker-agent-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/google-adk-vs-mastra.json", "title": "Agent Development Kit (ADK) vs Mastra", "url": "https://www.anchorterminal.com/compare/google-adk-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/google-adk-vs-tradingagents.json", "title": "Agent Development Kit (ADK) vs TradingAgents", "url": "https://www.anchorterminal.com/compare/google-adk-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/guilds-run-vs-mastra.json", "title": "guilds.run vs Mastra", "url": "https://www.anchorterminal.com/compare/guilds-run-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/guilds-run-vs-tradingagents.json", "title": "guilds.run vs TradingAgents", "url": "https://www.anchorterminal.com/compare/guilds-run-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/langgraph-vs-mastra.json", "title": "LangGraph vs Mastra", "url": "https://www.anchorterminal.com/compare/langgraph-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/langgraph-vs-tradingagents.json", "title": "LangGraph vs TradingAgents", "url": "https://www.anchorterminal.com/compare/langgraph-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/llamaindex-vs-mastra.json", "title": "LlamaIndex Framework vs Mastra", "url": "https://www.anchorterminal.com/compare/llamaindex-vs-mastra" }, { "json": "https://www.anchorterminal.com/compare/llamaindex-vs-tradingagents.json", "title": "LlamaIndex Framework vs TradingAgents", "url": "https://www.anchorterminal.com/compare/llamaindex-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-microsoft-agent-framework.json", "title": "Mastra vs Microsoft Agent Framework", "url": "https://www.anchorterminal.com/compare/mastra-vs-microsoft-agent-framework" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk.json", "title": "Mastra vs OpenAI Agents SDK", "url": "https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai.json", "title": "Mastra vs Pydantic AI", "url": "https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-smolagents.json", "title": "Mastra vs smolagents", "url": "https://www.anchorterminal.com/compare/mastra-vs-smolagents" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-strands-agents.json", "title": "Mastra vs Strands Agents", "url": "https://www.anchorterminal.com/compare/mastra-vs-strands-agents" }, { "json": "https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk.json", "title": "Mastra vs AI SDK", "url": "https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk" }, { "json": "https://www.anchorterminal.com/compare/microsoft-agent-framework-vs-tradingagents.json", "title": "Microsoft Agent Framework vs TradingAgents", "url": "https://www.anchorterminal.com/compare/microsoft-agent-framework-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/openai-agents-sdk-vs-tradingagents.json", "title": "OpenAI Agents SDK vs TradingAgents", "url": "https://www.anchorterminal.com/compare/openai-agents-sdk-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/pydantic-ai-vs-tradingagents.json", "title": "Pydantic AI vs TradingAgents", "url": "https://www.anchorterminal.com/compare/pydantic-ai-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/smolagents-vs-tradingagents.json", "title": "smolagents vs TradingAgents", "url": "https://www.anchorterminal.com/compare/smolagents-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/strands-agents-vs-tradingagents.json", "title": "Strands Agents vs TradingAgents", "url": "https://www.anchorterminal.com/compare/strands-agents-vs-tradingagents" }, { "json": "https://www.anchorterminal.com/compare/tradingagents-vs-vercel-ai-sdk.json", "title": "TradingAgents vs AI SDK", "url": "https://www.anchorterminal.com/compare/tradingagents-vs-vercel-ai-sdk" } ], "panel": null, "scores": [ { "by": 35, "edge": "mastra", "key": "reliability", "mastra": 87, "name": "Reliability", "tradingagents": 52, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 37, "edge": "mastra", "key": "schema", "mastra": 98, "name": "Schema \u0026 documentation", "tradingagents": 61, "weight": 13 }, { "by": 31, "edge": "mastra", "key": "ergonomics", "mastra": 92, "name": "Agent ergonomics", "tradingagents": 61, "weight": 13 }, { "by": 5, "edge": "mastra", "key": "security", "mastra": 67, "name": "Security \u0026 auth", "tradingagents": 62, "weight": 14 }, { "by": 0, "edge": "", "key": "payments", "mastra": 60, "name": "Payments \u0026 pricing", "tradingagents": 60, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 18, "edge": "mastra", "key": "maintenance", "mastra": 96, "name": "Maintenance \u0026 community", "tradingagents": 78, "weight": 7 }, { "by": 4, "edge": "mastra", "key": "transparency", "mastra": 72, "name": "Transparency \u0026 trust", "tradingagents": 68, "weight": 7 } ], "summary": "Mastra scores 74.2 (BB) on agent readiness against TradingAgents's 61.4 (C), and leads in 6 of 7 scored categories. Both do agent frameworks.", "tasks": null, "tutorials": [], "verdicts": { "mastra": "A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes.", "tradingagents": "An Apache 2.0 LangGraph framework at 0.7.1 with seven releases in 90 days, a dated changelog with upgrade notes, a public test matrix and point-in-time rules for historical runs. It has no MCP client or server, no PyPI package and no documentation beyond the README, and its output is a model-written rating that places no orders." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/mastra-vs-tradingagents", "json": "https://www.anchorterminal.com/compare/mastra-vs-tradingagents.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/mastra-vs-tradingagents.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/mastra-vs-tradingagents.min.md" }, "markdown": "Mastra scores 74.2 (BB) on agent readiness against TradingAgents's 61.4 (C), and leads in 6 of 7 scored categories. Both do agent frameworks.\n\n- Mastra: grade BB, 74.2/100, rank #91 of 1510. Markdown https://www.anchorterminal.com/tools/mastra.md · JSON https://www.anchorterminal.com/api/v1/tools/mastra.json\n- TradingAgents: grade C, 61.4/100, rank #617 of 1510. Markdown https://www.anchorterminal.com/tools/tradingagents.md · JSON https://www.anchorterminal.com/api/v1/tools/tradingagents.json\n- Best agent frameworks and SDKs: https://www.anchorterminal.com/best/frameworks/index.md\n- All 171 frameworks comparisons: https://www.anchorterminal.com/compare/frameworks/index.md\n\n## Which one, for what\n\n### Mastra (BB)\n\nGood for: TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.\n\nAhead on:\n- Reliability, 87 against 52\n- Schema \u0026 documentation, 98 against 61\n- Agent ergonomics, 92 against 61\n- Security \u0026 auth, 67 against 62\n- Maintenance \u0026 community, 96 against 78\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n\nWatch for: Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026\n\n### TradingAgents (C)\n\nGood for: Researchers who want a fixed multi-agent analysis of one listed instrument or crypto pair on a date, with point-in-time data for backtests, and who will run Python.\n\nAlso in its favour:\n- No incidents deducted, where Mastra loses 8 points for them\n\nWatch for: No MCP client or MCP server, so an agent drives it only through Python or the CLI\n\n\n## Why the edge\n\n### Schema \u0026 documentation: Mastra +37\n\n- Mastra (98): Typed TypeScript API with a reference section (25). llms.txt with a when-to-use list and condensed instructions for coding agents (10). The docs say when to use durable agents, and point multi-agent users from `.network()` to supervisor agents (20). Tools take Zod schemas (15). Examples on every page, and MastraError with ids and categories documented, though errors are spread across pages (13). Per-package changelogs and migration guides (15).\n- TradingAgents (61): Framework reading. No API reference or docs site. Typed interfaces exist in the source, Pydantic models for the research manager's, trader's and portfolio manager's outputs and Annotated signatures on the twelve data tools, with no py.typed marker (10 of 25). The README and changelog are Markdown in the repository; no llms.txt (4 of 10). The README states limits plainly, that runs vary, which statements past-dated runs withhold and why, and that it is a research tool, not advice (15 of 20). Configuration is a plain dict of string keys, though environment overrides are coerced to the default's type and fail loudly on a bad value (8 of 15). Runnable Python and CLI examples throughout the README; the vendor error hierarchy is documented only in source docstrings (9 of 15). Dated changelog for every release from 0.1.0 with upgrade notes (15).\n\n### Reliability: Mastra +35\n\n- Mastra (87): Official npm packages, Node 22.13 or newer (20). Public CI workflows for unit, store, workspace and e2e tests; on 6 November the newest runs on main (Version Packages, Trigger Cloud Integration Tests) succeeded, while the test workflows themselves run on pull requests (22). 436 open issues and 795 open issues and pull requests on 6 November from GitHub's API, with 2,077 issues opened in the 90 days to 3 November; all 50 newest had a comment and 24 were closed, with issue-triage automation (18). A changesets CHANGELOG per package, a CI gate that needs approval for any major bump and migration guides, but no written versioning policy found, and `.network()` is deprecated without a removal date (12). 1.82.0 (15). 20+22+18+12+15 = 87, up from 74 on 6 October, when GitHub couldn't be read.\n- TradingAgents (52): Read with the local-software lines, because the owner runs it. Python 3.11 or later is stated and CI tests 3.11 to 3.14, but the project publishes no PyPI package. No workflow uploads one, and the README installs from a clone or Docker Compose. From 0.7.0 a release workflow builds a wheel and source archive from each tag and attaches them to the GitHub release (12 of 20). Public CI on every push and pull request runs the test suite (about 1,009 test functions at v0.7.1) on four Python versions and once in America/New_York, a clean-install import check and Ruff. The 25 October check read the pass state from shields.io, a third-party copy of GitHub data this run doesn't use, so that reading is struck, and the pass state on main is unread (15, as berth and agentvfs). Issue counts came from the same source and are struck too. On the clone, 0.7.1 (27 October) fixes 22 numbered issues, 17 of them above #1518, the newest fixed in 0.7.0 on 16 October, and credits 15 outside contributors; open crash or regression issues and reply times are unread (15, as berth on the same pattern). The changelog follows Keep a Changelog and Semantic Versioning and lists breaking changes under \"Upgrading from\", but 0.5.1, a patch release, moved import paths and removed classes (10 of 15). Version 0.7.1 with no stability statement (0). 12+15+15+10+0 = 52.\n\n### Agent ergonomics: Mastra +31\n\n- Mastra (92): An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10).\n- TradingAgents (61): Framework reading, scored on what an outside agent needs to call it. No MCP client or server, so it can't be attached as tools; a run is four lines of Python (`TradingAgentsGraph(config=...).propagate(ticker, date)`) or one headless CLI command with flags (10 of 25). Analyst selection, debate and risk rounds (default 1), `max_tool_rounds` (20), `max_recur_limit` (100), article limits and `--no-html` size a run (14 of 20). A typed vendor error hierarchy separates unavailable from absent data, the headless CLI names the missing flag before a run starts, and an unparseable decision returns REVIEW rather than Hold (15 of 20). Checkpoint resume is opt-in, a backtest rerun with the same `run_id` skips finished cells, and settlement writes each decision once; nothing writes to an outside system (15 of 20). Sensible defaults, but the default provider is OpenAI's GPT-6 models with a key, and Python only (7 of 15).\n\n### Maintenance \u0026 community: Mastra +18\n\n- Mastra (96): @mastra/core 1.82.0 on 2026-11-04 (30). 27 stable releases in the 90 days to 6 November, 8 of them since 6 October (20). 436 open issues on 6 November, all 50 newest issues commented and 24 of them closed (22). Client, MCP and store packages are current, and @mastra/mcp 1.x stays supported beside 2.x (15). Renovate and CI configured, with the newest runs on main passing (9). 30+20+22+15+9 = 96.\n- TradingAgents (78): 0.7.1 on 27 October 2026 (30). Seven releases in the 90 days to 2 November, 0.4.0 (31 August), 0.5.0, 0.5.1, 0.5.2, 0.6.0, 0.7.0 and 0.7.1 (20). The earlier issue and pull request counts came from shields.io and are struck. On the clone, fixes cite issue numbers and each release credits the people who reported or fixed them (15 outside contributors in 0.7.1), but 251 of the 258 commits since 4 August are by one maintainer's accounts and reply times couldn't be read (13 of 25, as pipecat on clone evidence). No PyPI package; versions ship as GitHub releases with a wheel since 0.7.0 (8 of 15). CI with tests, lint and a clean-install check; dependencies set lower bounds only and no Dependabot configuration is in the repository (7 of 10). 30+20+13+8+7 = 78.\n\n### Security \u0026 auth: Mastra +5\n\n- Mastra (67): The CLI sends PostHog analytics, server startup sends token counts per model and a count of registered agents, tools and MCP servers, and Studio sends browser analytics, all on by default and documented, with one opt-out, MASTRA_TELEMETRY_DISABLED=1. Since #26986 (16 October 2026) each server process also reports token use per provider and model every 15 minutes, and the telemetry reference read on 6 November says server events carry a project identifier that is a raw Platform UUID or a hash of the Git origin remote, so they \"aren't anonymous\" (12). requireToolApproval on agents and MCP servers, allowedHosts for MCP HTTP, a curated environment for stdio servers, and sandboxed workspaces (20). PromptInjectionDetector, PII and moderation processors, and docs that call tool results untrusted model input (15). Built-in tracing with OpenTelemetry and other exporters (15). No SECURITY.md, no security.txt and no bug bounty found. A blog post says Mastra is SOC 2 Type II audited, which isn't scored for a framework, and we found no public advisory from Mastra about the June incident (5). Framework reading. 15+20+15+15+5 = 70 on 6 October, 12+20+15+15+5 = 67 on 6 November.\n- TradingAgents (62): Framework reading. 30 for what leaves the machine and how credentials are held, 20 for least privilege and approvals, 15 for prompt injection, 15 for audit and 20 for the security programme. Keys are read from the environment, and the package loads the nearest .env on import by walking up from the working directory. The ChatGPT sign-in uses PKCE and dynamic client registration, keeps tokens in a 0600 file and revokes them on logout. The only calls of its own are the interactive CLI's daily release and notice check, with no run data, off without a terminal or with TRADINGAGENTS_NO_UPDATE_CHECK=1. SEC EDGAR gets a placeholder contact address unless one is set (24 of 30). It places no orders and holds no broker credentials, the data tools only read, and every ticker is validated before it is used in a file path. No approval hooks, which nothing in it needs (14 of 20). News, Reddit and StockTwits text goes into prompts. The source names prompt injection as the reason for path validation, but no guidance on injection was found in the README (5 of 15). Saved reports record the run's settings and each agent's report, the memory log keeps every decision, and `debug=True` streams the graph (11 of 15). Security reports go to GitHub private vulnerability reporting per the issue template, and the changelog has Security sections for a langchain-core patch and a dependency removed over CVE-2026-22218. No SECURITY.md, no security.txt on tauric.ai (404 on 2 November), no bounty, and the repository's advisories page wasn't read (8 of 20). 24+14+5+11+8 = 62.\n\n## Score by category\n\n| Category | Weight | Mastra | TradingAgents | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 87 | 52 | Mastra +35 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 98 | 61 | Mastra +37 |\n| Agent ergonomics | 13% (16.2 this run) | 92 | 61 | Mastra +31 |\n| Security \u0026 auth | 14% (17.5 this run) | 67 | 62 | Mastra +5 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 60 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 96 | 78 | Mastra +18 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 72 | 68 | Mastra +4 |\n| Negative events | ≤15 | -8 | 0 | |\n| **Total** | | **74.2 · BB** | **61.4 · C** | |\n\n## Facts side by side\n\n| Fact | Mastra | TradingAgents |\n| --- | --- | --- |\n| Kind | Agent framework | Agent framework |\n| Vendor | Kepler Software, Inc. | Tauric Research |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | API key | API key |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing | Apache-2.0 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | no |\n| Last release | 2026-11-04 | 2026-10-27 |\n| Terms last updated | 2026-10-26 | 2026-10-23 |\n| Privacy policy last updated | no date given | 2026-10-23 |\n| Customer content may train models | yes | not found in the text |\n| Terms restrict automated access | yes | not found in the text |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | yes | not found in the text |\n| Arbitration or class-action waiver | yes | not found in the text |\n| Popularity | 29k stars, 3.1M npm/wk | none |\n\n## How the scores have moved\n\n### Mastra\n\nNo score change since it was listed.\n\n### TradingAgents\n\n- -3.3 on 2 November 2026 (B to C): correction\n- -0.1 on 30 October 2026: checklist\n- +0.1 on 27 October 2026: checklist\n\n## Verdicts\n\n**Mastra.** A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes.\n\n**TradingAgents.** An Apache 2.0 LangGraph framework at 0.7.1 with seven releases in 90 days, a dated changelog with upgrade notes, a public test matrix and point-in-time rules for historical runs. It has no MCP client or server, no PyPI package and no documentation beyond the README, and its output is a model-written rating that places no orders.\n\n## Before you call either\n\n### Mastra\n\n1. Set MASTRA_TELEMETRY_DISABLED=1 in every environment that runs the CLI, the server or Studio\n2. Pin exact versions with a lockfile, and make sure no 17 June 2026 release such as @mastra/core 1.42.1 is installed\n3. Set requireToolApproval on MCP servers that write, and allowedHosts when server URLs come from configuration\n4. Add PromptInjectionDetector as an input processor when tools return web or user content\n5. Use supervisor agents through generate() or stream(). `.network()` is deprecated\n\n### TradingAgents\n\n1. Run headless with `tradingagents --ticker \u003cT\u003e --date \u003cYYYY-MM-DD\u003e --analysts market,news,fundamentals --save --no-show`; a missing answer stops the run and names the flag\n2. Guard on the REVIEW signal before mapping `propagate()`'s decision to a rating; it means no rating could be parsed\n3. Set SEC_EDGAR_USER_AGENT to the operator's own name and address before fetching US fundamentals\n4. Keep provider keys out of the working directory tree unless intended, since the package loads the nearest .env on import\n5. Treat the rating as model output for research; the framework places no orders and its results vary between runs\n\n## Questions\n\n### Which is better for AI agents, Mastra or TradingAgents?\n\nMastra scores 74.2 (BB) on agent readiness against TradingAgents's 61.4 (C), and leads in 6 of 7 scored categories.\n\n### Are Mastra and TradingAgents open source?\n\nYes. Mastra is open source (Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing). TradingAgents is open source (Apache-2.0).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/mastra-vs-tradingagents.json, and with the fewest tokens: https://www.anchorterminal.com/compare/mastra-vs-tradingagents.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"mastra\", \"b\": \"tradingagents\"}`. From a terminal: `anchor compare mastra tradingagents`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/mastra.json and https://www.anchorterminal.com/api/v1/tools/tradingagents.json\n\n## Other comparisons with Mastra or TradingAgents\n\n- [AgentOS vs Mastra](https://www.anchorterminal.com/compare/agentos-vs-mastra.md)\n- [AgentOS vs TradingAgents](https://www.anchorterminal.com/compare/agentos-vs-tradingagents.md)\n- [Agno vs Mastra](https://www.anchorterminal.com/compare/agno-vs-mastra.md)\n- [Agno vs TradingAgents](https://www.anchorterminal.com/compare/agno-vs-tradingagents.md)\n- [BoxLang AI vs Mastra](https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra.md)\n- [BoxLang AI vs TradingAgents](https://www.anchorterminal.com/compare/boxlang-ai-vs-tradingagents.md)\n- [Claude Agent SDK vs Mastra](https://www.anchorterminal.com/compare/claude-agent-sdk-vs-mastra.md)\n- [Claude Agent SDK vs TradingAgents](https://www.anchorterminal.com/compare/claude-agent-sdk-vs-tradingagents.md)\n- [CrewAI vs Mastra](https://www.anchorterminal.com/compare/crewai-vs-mastra.md)\n- [CrewAI vs TradingAgents](https://www.anchorterminal.com/compare/crewai-vs-tradingagents.md)\n- [Cursor Agent SDK vs Mastra](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra.md)\n- [Cursor Agent SDK vs TradingAgents](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-tradingagents.md)\n- [Docker Agent vs Mastra](https://www.anchorterminal.com/compare/docker-agent-vs-mastra.md)\n- [Docker Agent vs TradingAgents](https://www.anchorterminal.com/compare/docker-agent-vs-tradingagents.md)\n- [Agent Development Kit (ADK) vs Mastra](https://www.anchorterminal.com/compare/google-adk-vs-mastra.md)\n- [Agent Development Kit (ADK) vs TradingAgents](https://www.anchorterminal.com/compare/google-adk-vs-tradingagents.md)\n- [guilds.run vs Mastra](https://www.anchorterminal.com/compare/guilds-run-vs-mastra.md)\n- [guilds.run vs TradingAgents](https://www.anchorterminal.com/compare/guilds-run-vs-tradingagents.md)\n- [LangGraph vs Mastra](https://www.anchorterminal.com/compare/langgraph-vs-mastra.md)\n- [LangGraph vs TradingAgents](https://www.anchorterminal.com/compare/langgraph-vs-tradingagents.md)\n- [LlamaIndex Framework vs Mastra](https://www.anchorterminal.com/compare/llamaindex-vs-mastra.md)\n- [LlamaIndex Framework vs TradingAgents](https://www.anchorterminal.com/compare/llamaindex-vs-tradingagents.md)\n- [Mastra vs Microsoft Agent Framework](https://www.anchorterminal.com/compare/mastra-vs-microsoft-agent-framework.md)\n- [Mastra vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk.md)\n- [Mastra vs Pydantic AI](https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai.md)\n- [Mastra vs smolagents](https://www.anchorterminal.com/compare/mastra-vs-smolagents.md)\n- [Mastra vs Strands Agents](https://www.anchorterminal.com/compare/mastra-vs-strands-agents.md)\n- [Mastra vs AI SDK](https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk.md)\n- [Microsoft Agent Framework vs TradingAgents](https://www.anchorterminal.com/compare/microsoft-agent-framework-vs-tradingagents.md)\n- [OpenAI Agents SDK vs TradingAgents](https://www.anchorterminal.com/compare/openai-agents-sdk-vs-tradingagents.md)\n- [Pydantic AI vs TradingAgents](https://www.anchorterminal.com/compare/pydantic-ai-vs-tradingagents.md)\n- [smolagents vs TradingAgents](https://www.anchorterminal.com/compare/smolagents-vs-tradingagents.md)\n- [Strands Agents vs TradingAgents](https://www.anchorterminal.com/compare/strands-agents-vs-tradingagents.md)\n- [TradingAgents vs AI SDK](https://www.anchorterminal.com/compare/tradingagents-vs-vercel-ai-sdk.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Mastra vs TradingAgents", "url": "" } ], "description": "Mastra scores 74.2 (BB) to TradingAgents's 61.4 (C) for agent frameworks. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Mastra BB 74.2", "TradingAgents C 61.4", "scores" ], "h1": "Mastra vs TradingAgents", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/mastra-vs-tradingagents", "published": "2026-10-01", "section": "tools", "title": "Mastra vs TradingAgents for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/mastra-vs-tradingagents" }, "tokens": { "markdown": 5000, "slim": 2930 }, "version": 1 }