# Mastra vs AI SDK (slim)

> AI SDK scores 89.8 (AA) to Mastra's 74.2 (BB) for agent frameworks. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk.md (~3,700 tokens) · this version ~1,730 tokens · JSON https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk.json · canonical https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

AI SDK scores 89.8 (AA) on agent readiness against Mastra's 74.2 (BB), and leads in 6 of 7 scored categories. Both do agent frameworks.

- Mastra: BB 74.2, rank #91 of 1510 · https://www.anchorterminal.com/tools/mastra.min.md
- AI SDK: AA 89.8, rank #1 of 1510 · https://www.anchorterminal.com/tools/vercel-ai-sdk.min.md
- Mastra, good for TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.
- AI SDK, good for TypeScript teams building agents and chat UIs who want one API across many providers and a short path to MCP. Ahead on Reliability, 93 against 87; Security & auth, 90 against 67; Transparency & trust, 89 against 72. Also No incidents deducted, where Mastra loses 8 points for them.

| Category | Mastra | AI SDK |
| --- | --- | --- |
| Reliability (16%) | 87 | 93 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 98 | 100 |
| Agent ergonomics (13%) | 92 | 95 |
| Security & auth (14%) | 67 | 90 |
| Payments & pricing (10%) | 60 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 96 | 97 |
| Transparency & trust (7%) | 72 | 89 |

| Fact (where they differ) | Mastra | AI SDK |
| --- | --- | --- |
| Vendor | Kepler Software, Inc. | Vercel Inc. |
| Licence | Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing | Apache-2.0 |
| Last release | 2026-11-04 | 2026-11-05 |
| Terms last updated | 2026-10-26 | 2026-06-01 |
| Privacy policy last updated | no date given | 2026-06-01 |
| Customer content may train models | yes | yes, with an opt-out |
| Terms restrict automated access | yes | not found in the text |
| Terms or service can change without notice | yes | not found in the text |
| Popularity | 29k stars, 3.1M npm/wk | 28k stars, 44.9M npm/wk |

Why the edge:
- Security & auth, AI SDK +23: Mastra 67 (The CLI sends PostHog analytics, server startup sends token counts per model and a count of registered agents, tools and MCP servers, and Studio sends browser analytics, all on by default and documented, with one opt-out, MASTRA_TELEMETRY_DISABLED=1. Since #26986 (16 October 2026) each server process also reports token use per provider and model every 15 minutes, and the telemetry reference read on 6 November says server events carry a project identifier that is a raw Platform UUID or a hash of the Git origin remote, so they "aren't anonymous" (12). requireToolApproval on agents and MCP servers, allowedHosts for MCP HTTP, a curated environment for stdio servers, and sandboxed workspaces (20). PromptInjectionDetector, PII and moderation processors, and docs that call tool results untrusted model input (15). Built-in tracing with OpenTelemetry and other exporters (15). No SECURITY.md, no security.txt and no bug bounty found. A blog post says Mastra is SOC 2 Type II audited, which isn't scored for a framework, and we found no public advisory from Mastra about the June incident (5). Framework reading. 15+20+15+15+5 = 70 on 6 October, 12+20+15+15+5 = 67 on 6 November.); AI SDK 90 (No telemetry until an OpenTelemetry integration is registered. String model IDs route to Vercel's AI Gateway by default, which is documented and needs a Vercel key, so it isn't silent (25). Per-tool approval, HMAC-signed approvals against forged client history, and Open Policy Agent rules in @ai-sdk/policy-opa, though sandboxes are experimental (20). ToolLoopAgent rejects system messages in prompts by default as an injection risk, URL fetches are checked against private addresses, and MCP HTTP transport refuses redirects by default, but there's no guardrail primitive (10). OpenTelemetry spans for every model and tool call to any backend, opt-in (15). HackerOne programme, a valid security.txt, SECURITY.md and two low-severity advisories published with fixed versions (20). Framework reading, so SOC 2 isn't scored.)
- Transparency & trust, AI SDK +17: Mastra 72 (Apache 2.0 for the core, with ee/ directories source-available under the Mastra Enterprise License (25). The privacy policy (last published 25 April 2025) covers the website, the Teams plan states six months' retention, and the subprocessor list sits in a trust centre our reader couldn't render (15). Migration guides and deprecation warnings, without dated removal windows (12). Every telemetry stream is documented with links to its source and one opt-out, and the reference now spells out what the project identifiers can be correlated with (20).); AI SDK 89 (Apache 2.0 (30). The library stores nothing. The AI Gateway's ZDR page says it doesn't retain prompts or outputs and per-request ZDR is available on Pro and Enterprise, and Vercel's privacy notice is dated 1 June 2026, but we didn't read a DPA or subprocessor list (22). Deprecated APIs are removed only at majors with a migration guide, and 6.x and 5.x keep getting releases, without a written support window (14). Telemetry is opt-in and documented, with switches for inputs and outputs (20).)
- Reliability, AI SDK +6: Mastra 87 (Official npm packages, Node 22.13 or newer (20). Public CI workflows for unit, store, workspace and e2e tests; on 6 November the newest runs on main (Version Packages, Trigger Cloud Integration Tests) succeeded, while the test workflows themselves run on pull requests (22). 436 open issues and 795 open issues and pull requests on 6 November from GitHub's API, with 2,077 issues opened in the 90 days to 3 November; all 50 newest had a comment and 24 were closed, with issue-triage automation (18). A changesets CHANGELOG per package, a CI gate that needs approval for any major bump and migration guides, but no written versioning policy found, and `.network()` is deprecated without a removal date (12). 1.82.0 (15). 20+22+18+12+15 = 87, up from 74 on 6 October, when GitHub couldn't be read.); AI SDK 93 (Official npm packages, with `ai` 7.x requiring Node 22 or newer (20). A public CI workflow with lint, type checks, unit tests, Node-version tests, MCP tests on Windows and e2e tests runs on every push to main, and the newest completed CI runs on main passed on 6 November (25). 1,517 open issues and pull requests on 6 November from GitHub's API, with 1,059 issues opened in the 90 days to 3 November; 47 of the 50 newest had a comment and 32 were closed (18). A written versioning page with breaking changes only in majors, experimental_ prefixes for unstable APIs and a migration guide per major (15). 7.0.163 (15). 20+25+18+15+15 = 93, up from 73 on 6 October, when GitHub couldn't be read.)