{ "data": { "similar": [ { "grade": "AA", "json": "https://www.anchorterminal.com/tools/vercel-ai-sdk.json", "name": "AI SDK", "score": 89.8, "shared": [ "agent.framework", "agent.mcp-client", "agent.multi-agent", "agent.durable" ], "slug": "vercel-ai-sdk" }, { "grade": "AA", "json": "https://www.anchorterminal.com/tools/openai-agents-sdk.json", "name": "OpenAI Agents SDK", "score": 86.2, "shared": [ "agent.framework", "agent.multi-agent", "agent.durable", "agent.mcp-client" ], "slug": "openai-agents-sdk" }, { "grade": "A", "json": "https://www.anchorterminal.com/tools/pydantic-ai.json", "name": "Pydantic AI", "score": 81.9, "shared": [ "agent.framework", "agent.multi-agent", "agent.durable", "agent.mcp-client" ], "slug": "pydantic-ai" }, { "grade": "A", "json": "https://www.anchorterminal.com/tools/strands-agents.json", "name": "Strands Agents", "score": 80, "shared": [ "agent.framework", "agent.mcp-client", "agent.multi-agent", "agent.durable" ], "slug": "strands-agents" }, { "grade": "A", "json": "https://www.anchorterminal.com/tools/microsoft-agent-framework.json", "name": "Microsoft Agent Framework", "score": 79.4, "shared": [ "agent.framework", "agent.multi-agent", "agent.durable", "agent.mcp-client" ], "slug": "microsoft-agent-framework" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/docker-agent.json", "name": "Docker Agent", "score": 73.6, "shared": [ "agent.framework", "agent.multi-agent", "agent.mcp-client", "agent.durable" ], "slug": "docker-agent" } ], "tool": { "slug": "mastra", "name": "Mastra", "vendor": "Kepler Software, Inc.", "vendorUrl": "https://mastra.ai", "kind": "framework", "category": "frameworks", "summary": "Open-source TypeScript framework from Mastra for building agents and workflows, with memory, RAG, evals, tracing, an MCP client and server, and a local Studio. An optional hosted platform runs deployments and observability.", "url": "https://www.anchorterminal.com/tools/mastra", "markdownUrl": "https://www.anchorterminal.com/tools/mastra.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/mastra.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/mastra.json", "dns": "mastra.grade.anchorterminal.com", "repo": "https://github.com/mastra-ai/mastra", "license": "Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing", "transports": [], "packages": [ { "registry": "npm", "name": "@mastra/core" }, { "registry": "npm", "name": "@mastra/mcp" }, { "registry": "npm", "name": "mastra" } ], "auth": "api-key", "authNotes": "The framework has no account of its own. The model router takes `provider/model` strings and each provider's own key. The hosted Mastra platform needs an account.", "pricing": "free", "pricingNotes": "Free and open source. You pay for model calls. The hosted platform has a $0 Starter plan with 100K observability events and 24 CPU hours, then $10 per 100K events and $0.35 a CPU hour, and Teams at $250 a month (https://mastra.ai/pricing, checked 2026-11-06).", "priceSummary": "Free · OSS", "where": "library", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Mastra docs, the repository or the pricing page (checked 2026-10-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 29383, "npmWeekly": 3116983, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://mastra.ai/docs", "llmsTxt": "https://mastra.ai/llms.txt", "capabilities": [ "agent.framework", "agent.durable", "agent.mcp-client", "agent.multi-agent" ], "tags": [ "framework", "typescript", "open-source", "llms-txt", "mcp", "telemetry-default-on" ], "lastRelease": "2026-11-04", "graded": true, "anchor": { "graded": true, "score": 74.2, "grade": "BB", "agentReady": true, "rank": 91, "ranked": true, "rankOf": 1486, "categoryRank": 7, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 92, "maintenance": 96, "payments": 60, "reliability": 87, "schema": 98, "security": 67, "transparency": 72 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 87, "points": 17.4, "reason": "Official npm packages, Node 22.13 or newer (20). Public CI workflows for unit, store, workspace and e2e tests; on 6 November the newest runs on main (Version Packages, Trigger Cloud Integration Tests) succeeded, while the test workflows themselves run on pull requests (22). 436 open issues and 795 open issues and pull requests on 6 November from GitHub's API, with 2,077 issues opened in the 90 days to 3 November; all 50 newest had a comment and 24 were closed, with issue-triage automation (18). A changesets CHANGELOG per package, a CI gate that needs approval for any major bump and migration guides, but no written versioning policy found, and `.network()` is deprecated without a removal date (12). 1.82.0 (15). 20+22+18+12+15 = 87, up from 74 on 6 October, when GitHub couldn't be read.", "checked": "2026-11-06" }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 98, "points": 15.93, "reason": "Typed TypeScript API with a reference section (25). llms.txt with a when-to-use list and condensed instructions for coding agents (10). The docs say when to use durable agents, and point multi-agent users from `.network()` to supervisor agents (20). Tools take Zod schemas (15). Examples on every page, and MastraError with ids and categories documented, though errors are spread across pages (13). Per-package changelogs and migration guides (15).", "checked": "2026-11-06" }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 92, "points": 14.95, "reason": "An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10).", "checked": "2026-11-06" }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 67, "points": 11.73, "reason": "The CLI sends PostHog analytics, server startup sends token counts per model and a count of registered agents, tools and MCP servers, and Studio sends browser analytics, all on by default and documented, with one opt-out, MASTRA_TELEMETRY_DISABLED=1. Since #26986 (16 October 2026) each server process also reports token use per provider and model every 15 minutes, and the telemetry reference read on 6 November says server events carry a project identifier that is a raw Platform UUID or a hash of the Git origin remote, so they \"aren't anonymous\" (12). requireToolApproval on agents and MCP servers, allowedHosts for MCP HTTP, a curated environment for stdio servers, and sandboxed workspaces (20). PromptInjectionDetector, PII and moderation processors, and docs that call tool results untrusted model input (15). Built-in tracing with OpenTelemetry and other exporters (15). No SECURITY.md, no security.txt and no bug bounty found. A blog post says Mastra is SOC 2 Type II audited, which isn't scored for a framework, and we found no public advisory from Mastra about the June incident (5). Framework reading. 15+20+15+15+5 = 70 on 6 October, 12+20+15+15+5 = 67 on 6 November.", "checked": "2026-11-06" }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 60, "points": 7.5, "reason": "No payment protocol (0). Scored on the hosted platform, whose per-unit prices are public without a login ($10 per 100K observability events and $0.35 a CPU hour on Starter) (20). The Apache 2.0 packages install with no card (20) and no account, and run any model (20).", "checked": "2026-11-06" }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 96, "points": 8.4, "reason": "@mastra/core 1.82.0 on 2026-11-04 (30). 27 stable releases in the 90 days to 6 November, 8 of them since 6 October (20). 436 open issues on 6 November, all 50 newest issues commented and 24 of them closed (22). Client, MCP and store packages are current, and @mastra/mcp 1.x stays supported beside 2.x (15). Renovate and CI configured, with the newest runs on main passing (9). 30+20+22+15+9 = 96.", "checked": "2026-11-06" }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 72, "points": 6.3, "note": "editorial 72, provenance 71", "reason": "Apache 2.0 for the core, with ee/ directories source-available under the Mastra Enterprise License (25). The privacy policy (last published 25 April 2025) covers the website, the Teams plan states six months' retention, and the subprocessor list sits in a trust centre our reader couldn't render (15). Migration guides and deprecation warnings, without dated removal windows (12). Every telemetry stream is documented with links to its source and one opt-out, and the reference now spells out what the project identifiers can be correlated with (20).", "checked": "2026-11-06" } ], "assessment": { "date": "2026-11-06", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10).", "maintenance": "@mastra/core 1.82.0 on 2026-11-04 (30). 27 stable releases in the 90 days to 6 November, 8 of them since 6 October (20). 436 open issues on 6 November, all 50 newest issues commented and 24 of them closed (22). Client, MCP and store packages are current, and @mastra/mcp 1.x stays supported beside 2.x (15). Renovate and CI configured, with the newest runs on main passing (9). 30+20+22+15+9 = 96.", "payments": "No payment protocol (0). Scored on the hosted platform, whose per-unit prices are public without a login ($10 per 100K observability events and $0.35 a CPU hour on Starter) (20). The Apache 2.0 packages install with no card (20) and no account, and run any model (20).", "reliability": "Official npm packages, Node 22.13 or newer (20). Public CI workflows for unit, store, workspace and e2e tests; on 6 November the newest runs on main (Version Packages, Trigger Cloud Integration Tests) succeeded, while the test workflows themselves run on pull requests (22). 436 open issues and 795 open issues and pull requests on 6 November from GitHub's API, with 2,077 issues opened in the 90 days to 3 November; all 50 newest had a comment and 24 were closed, with issue-triage automation (18). A changesets CHANGELOG per package, a CI gate that needs approval for any major bump and migration guides, but no written versioning policy found, and `.network()` is deprecated without a removal date (12). 1.82.0 (15). 20+22+18+12+15 = 87, up from 74 on 6 October, when GitHub couldn't be read.", "schema": "Typed TypeScript API with a reference section (25). llms.txt with a when-to-use list and condensed instructions for coding agents (10). The docs say when to use durable agents, and point multi-agent users from `.network()` to supervisor agents (20). Tools take Zod schemas (15). Examples on every page, and MastraError with ids and categories documented, though errors are spread across pages (13). Per-package changelogs and migration guides (15).", "security": "The CLI sends PostHog analytics, server startup sends token counts per model and a count of registered agents, tools and MCP servers, and Studio sends browser analytics, all on by default and documented, with one opt-out, MASTRA_TELEMETRY_DISABLED=1. Since #26986 (16 October 2026) each server process also reports token use per provider and model every 15 minutes, and the telemetry reference read on 6 November says server events carry a project identifier that is a raw Platform UUID or a hash of the Git origin remote, so they \"aren't anonymous\" (12). requireToolApproval on agents and MCP servers, allowedHosts for MCP HTTP, a curated environment for stdio servers, and sandboxed workspaces (20). PromptInjectionDetector, PII and moderation processors, and docs that call tool results untrusted model input (15). Built-in tracing with OpenTelemetry and other exporters (15). No SECURITY.md, no security.txt and no bug bounty found. A blog post says Mastra is SOC 2 Type II audited, which isn't scored for a framework, and we found no public advisory from Mastra about the June incident (5). Framework reading. 15+20+15+15+5 = 70 on 6 October, 12+20+15+15+5 = 67 on 6 November.", "transparency": "Apache 2.0 for the core, with ee/ directories source-available under the Mastra Enterprise License (25). The privacy policy (last published 25 April 2025) covers the website, the Teams plan states six months' retention, and the subprocessor list sits in a trust centre our reader couldn't render (15). Migration guides and deprecation warnings, without dated removal windows (12). Every telemetry stream is documented with links to its source and one opt-out, and the reference now spells out what the project identifiers can be correlated with (20)." }, "sources": [ { "what": "npm registry document for @mastra/core (versions and dates)", "url": "https://registry.npmjs.org/@mastra/core", "seen": "2026-11-06" }, { "what": "npm weekly downloads", "url": "https://api.npmjs.org/downloads/point/last-week/@mastra/core", "seen": "2026-11-06" }, { "what": "repository clone (docs source, CI workflows, LICENSE.md, CHANGELOGs)", "url": "https://github.com/mastra-ai/mastra", "seen": "2026-10-06" }, { "what": "OSV malware advisory for @mastra/core 1.42.1", "url": "https://osv.dev/vulnerability/MAL-2026-6011", "seen": "2026-11-06" }, { "what": "core changelog with the 17 June remediation", "url": "https://github.com/mastra-ai/mastra/blob/main/packages/core/CHANGELOG.md", "seen": "2026-10-06" }, { "what": "CLI reference, telemetry", "url": "https://mastra.ai/reference/cli/mastra", "seen": "2026-11-06" }, { "what": "MCP", "url": "https://mastra.ai/docs/connections/mcp", "seen": "2026-10-06" }, { "what": "guardrails", "url": "https://mastra.ai/docs/agents/guardrails", "seen": "2026-10-06" }, { "what": "licence", "url": "https://mastra.ai/docs/license", "seen": "2026-11-06" }, { "what": "llms.txt", "url": "https://mastra.ai/llms.txt", "seen": "2026-10-06" }, { "what": "pricing", "url": "https://mastra.ai/pricing", "seen": "2026-11-06" }, { "what": "privacy policy", "url": "https://mastra.ai/privacy-policy", "seen": "2026-10-06" }, { "what": "security.txt (404)", "url": "https://mastra.ai/.well-known/security.txt", "seen": "2026-11-06" }, { "what": "regulated enterprise post (SOC 2 claim)", "url": "https://mastra.ai/blog/secure-governed-agents-regulated-enterprise", "seen": "2026-10-06" }, { "what": "telemetry source history (model usage telemetry, #26986)", "url": "https://github.com/mastra-ai/mastra/blob/main/packages/core/src/telemetry/model-usage-telemetry.ts", "seen": "2026-11-06" }, { "what": "OSV advisories for @mastra/core and @mastra/mcp", "url": "https://osv.dev/list?q=%40mastra%2Fcore\u0026ecosystem=npm", "seen": "2026-11-06" }, { "what": "GitHub API, repository, issues and Actions runs on main", "url": "https://api.github.com/repos/mastra-ai/mastra", "seen": "2026-11-06" } ], "openQuestions": [ "Changed since 6 October 2026 (rechecked 6 November). @mastra/core went from 1.74.0 to 1.82.0 (4 November) and @mastra/mcp to 2.8.0; no new advisory on OSV for @mastra/core or @mastra/mcp beyond the June malware entries; server telemetry now also reports token use every 15 minutes (#26986, 16 October) and the reference describes correlatable project identifiers (security 70 to 67); GitHub's API answered this time, so CI on main and issue activity were read first-hand (reliability 74 to 87, maintenance 87 to 96); licence, pricing and the missing security.txt unchanged", "How long the malicious versions stayed on npm, how they were published and whether 1.43.0 (17 June, 08:23 UTC) was clean. We found no write-up from Mastra", "unchecked: the trust centre at trust.mastra.ai, which needs JavaScript, so the subprocessor list and SOC 2 report weren't read" ] }, "negative": -8, "negativeNotes": [ "2026-06-17. Malicious versions of Mastra's npm packages were published, among them @mastra/core 1.42.1 at 01:15 UTC, and GitHub malware advisories that day (GHSA-pp62-grrw-hvfp and others) say any machine that installed one should be treated as fully compromised. All 21 Mastra packages we checked on OSV carry one. Mastra published clean versions the same day and the changelogs name an \"easy-day-js\" supply-chain incident, but we found no advisory or post-mortem from Mastra. Fixed and under four months old, so 8 points. https://osv.dev/vulnerability/MAL-2026-6011" ], "verdict": "A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes.", "bestFor": "TypeScript teams that want agents, workflows, memory, evals and a local Studio in one framework.", "strengths": [ "MCP client with requireToolApproval per server or per tool, allowedHosts and a curated environment for stdio servers", "Guardrail processors for prompt injection, PII, moderation and cost limits, run on input and output", "Workflows with snapshots, suspend and resume, and durable agents on Inngest or an evented engine", "Apache 2.0 core, 1.0 since 20 January 2026, with 27 releases of @mastra/core in 90 days to 6 November", "llms.txt with a when-to-use section and condensed instructions for coding agents" ], "weaknesses": [ "Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026", "CLI, server and Studio send usage analytics by default, including token counts every 15 minutes, off with MASTRA_TELEMETRY_DISABLED=1", "No SECURITY.md, no security.txt and no bug bounty found", "Code under ee/ is source-available under the Mastra Enterprise License, not Apache 2.0", "TypeScript only, Node 22.13 or newer" ], "agentNotes": [ "Set MASTRA_TELEMETRY_DISABLED=1 in every environment that runs the CLI, the server or Studio", "Pin exact versions with a lockfile, and make sure no 17 June 2026 release such as @mastra/core 1.42.1 is installed", "Set requireToolApproval on MCP servers that write, and allowedHosts when server URLs come from configuration", "Add PromptInjectionDetector as an input processor when tools return web or user content", "Use supervisor agents through generate() or stream(). `.network()` is deprecated" ], "metrics": { "kind": "library", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 74.2 } ], "editorialScores": { "ergonomics": 92, "maintenance": 96, "payments": 60, "reliability": 87, "schema": 98, "security": 67, "transparency": 72 }, "provenanceScore": 71, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 }, "scoreHistory": [ { "date": "2026-11-06", "grade": "BB", "kind": "listed", "method": "0.7", "score": 74.2 } ] }, "connect": { "install": "npm create mastra@latest # or: npm i @mastra/core @mastra/mcp" }, "letme": { "capability": "https://letme.dev/agent.framework", "tool": "https://letme.dev/mastra" }, "notable": [ "@mastra/core 1.82.0 on 2026-11-04, with 27 stable releases in the 90 days to 6 November 2026 (8 since 6 October), and 1.0.0 on 2026-01-20 (https://registry.npmjs.org/@mastra/core)", "GitHub malware advisories, published 17 June 2026, cover versions of Mastra packages such as @mastra/core 1.42.1, @mastra/mcp, @mastra/server and create-mastra, and advise treating any machine that installed one as compromised (https://osv.dev/vulnerability/MAL-2026-6011)", "The package changelogs record a 17 June 2026 remediation for the \"easy-day-js\" supply-chain incident, publishing clean versions that superseded those declaring the malicious dependency (https://github.com/mastra-ai/mastra/blob/main/packages/core/CHANGELOG.md)", "The CLI, server and Studio send usage analytics by default; since 16 October 2026 servers also report token use per model every 15 minutes, with a project identifier from a Platform UUID or a hashed Git remote, and MASTRA_TELEMETRY_DISABLED=1 turns all of it off (https://mastra.ai/reference/cli/mastra)", "@mastra/mcp 2.x serves only MCP 2026-07-28, while its client still connects to older servers and 1.x stays supported (https://mastra.ai/reference/migrations/mcp-v2)" ], "area": "frameworks", "details": [ { "label": "Languages", "value": "TypeScript, Node 22.13 or newer" }, { "label": "Models", "value": "Model router with `provider/model` strings, or AI SDK providers" }, { "label": "MCP client", "value": "@mastra/mcp 2.8.0, stdio and HTTP, OAuth, requireToolApproval, allowedHosts. Also an MCP server" }, { "label": "Multi-agent", "value": "Supervisor agents with subagents, A2A and ACP. `.network()` deprecated" }, { "label": "Durable state", "value": "Workflow snapshots with suspend and resume, durable agents in-process, evented or on Inngest" }, { "label": "Human approval", "value": "Tool approval on agents and MCP servers, workflow suspend and resume" }, { "label": "Guardrails", "value": "Processors for prompt injection, PII, moderation, system-prompt scrubbing and cost limits" }, { "label": "Tracing", "value": "Built-in observability with OpenTelemetry, Langfuse, PostHog and other exporters" }, { "label": "Telemetry", "value": "CLI, server and Studio analytics on by default, with server token-use reports every 15 minutes. `MASTRA_TELEMETRY_DISABLED=1`" }, { "label": "Releases in 90 days", "value": "27 stable releases of @mastra/core to 6 November 2026" } ], "provenance": { "legalEntity": "Kepler Software, Inc.", "domain": "mastra.ai", "domainRegistered": "2024-10-01", "endpointOnVendorDomain": null, "terms": "https://mastra.ai/terms-of-service", "privacy": "https://mastra.ai/privacy-policy", "statusPage": "https://statuspage.incident.io/mastra-platform", "changelog": "https://github.com/mastra-ai/mastra/blob/main/packages/core/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The privacy policy names Kepler Software Inc as operator of mastra.ai and shows a last-published date of 25 April 2025.", "The licence file is copyright Kepler Software, Inc.", "mastra.ai/.well-known/security.txt returns 404 (rechecked 6 November 2026), and the repository has no SECURITY.md.", "RDAP gives mastra.ai a registration date of 2024-10-01.", "The status page covers the hosted platform, not the framework." ], "score": 71, "checks": [ { "check": "Legal entity named", "value": "Kepler Software, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "mastra.ai, registered 2024-10-01 (2 years)", "points": 7, "max": 15, "state": "part" }, { "check": "Endpoint on the vendor's domain", "value": "no hosted endpoint", "points": 0, "max": 0, "state": "na" }, { "check": "Terms of service", "value": "read, states 6 of the 7 things a reader expects, and has 3 clauses that cost points", "points": 3.1, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 3 of the 8 things a reader expects", "points": 6.3, "max": 10, "state": "part" }, { "check": "Status page", "value": "statuspage.incident.io/mastra-platform", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "People named", "value": "3 named with their role, 3 with a public profile", "points": 10, "max": 10, "state": "ok" }, { "check": "Support route", "value": "help pages, a community", "points": 5, "max": 5, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://mastra.ai/terms-of-service", "state": "read", "readAt": "2026-11-06", "statedDate": "2026-10-26", "words": 16717, "points": 3.1, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: Oct 26, 2026", "says": "Last updated 2026-10-26" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "This Agreement and any action related thereto will be governed by and interpreted under the laws of the State of Delaware, without giving effect to any conflict-of-laws principles.", "says": "The law of the State of Delaware" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "Mastra's total aggregate liability for Beta Services is limited to $100.", "says": "Capped at $100" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "Upon cancellation, (i) your access to paid features will terminate at the end of the then-current billing period or, for a Subscription purchased under an Order Form, at the end of the then-current Subscription Term;" }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": false }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "IF YOU DO NOT AGREE TO BE BOUND BY THIS AGREEMENT, YOU MAY NOT ACCESS OR USE THE SERVICES." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": true, "quote": "The Basic and Teams Plans are provided without an uptime SLA and without service credits." } ], "toKnow": [ { "key": "training", "label": "Says it may use customer content to train or improve models, and no opt-out was found", "found": true, "quote": "(o) use the Services to train, fine-tune, or otherwise develop a product or service that competes with the Services, including by extracting Model outputs in bulk for the purpose of training a competing foundation model;", "costsPoints": true }, { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "(d) use any manual or automated software, devices, or other processes (including spiders, robots, scrapers, crawlers, avatars, or data-mining tools) to scrape, harvest, or download data from the Services, except that Mastra grants the operators of public search engines revocable permission to use spiders to copy mater…", "costsPoints": true }, { "key": "terms.nonotice", "label": "Says the terms or the service can change without notice", "found": true, "quote": "Mastra makes no representations that Beta Services will ever be made generally available and reserves the right to discontinue or modify Beta Services at any time without notice.", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "Mastra may terminate or reduce Customer's access under any trial (whether free or paid) at any time in its discretion, including where Customer exceeds the usage limits, feature scope, or duration set forth in the applicable Order Form." }, { "key": "terms.arbitration", "label": "Requires arbitration or waives class actions", "found": true, "quote": "EACH PARTY HEREBY KNOWINGLY, VOLUNTARILY, AND INTENTIONALLY WAIVES ITS RIGHT TO A TRIAL BY JURY IN ANY PROCEEDING ARISING OUT OF OR RELATING TO THIS AGREEMENT." } ] }, { "kind": "privacy", "url": "https://mastra.ai/privacy-policy", "state": "read", "readAt": "2026-11-06", "words": 905, "points": 6.3, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": false }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "The Personal Information that we collect are used for providing and improving the Service." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": false }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "We do not sell or share SMS opt-in data or consent, including mobile phone numbers collected for text messaging, with third parties or affiliates for their own marketing or promotional purposes." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": false }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": false }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have any questions or suggestions about our Privacy Policy, do not hesitate to contact us." }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": false } ] } ] }, "humans": { "slug": "mastra", "checked": "2026-11-06", "company": "Kepler Software, Inc. (Mastra)", "people": [ { "name": "Sam Bhagwat", "role": "Founder and CEO", "founder": true, "linkedin": "https://www.linkedin.com/in/sambhagwat", "x": "https://x.com/calcsam", "page": "/people/sam-bhagwat/" }, { "name": "Abhi Aiyer", "role": "Founder and CTO", "founder": true, "linkedin": "https://www.linkedin.com/in/abhi-aiyer-aa41bb42/", "x": "https://x.com/abhiaiyer", "page": "/people/abhi-aiyer/" }, { "name": "Shane Thomas", "role": "Founder", "founder": true, "linkedin": "https://www.linkedin.com/in/smthomas3", "x": "https://x.com/smthomas3", "page": "/people/shane-thomas/" } ], "peopleNote": "Founders, roles and their LinkedIn and X links from Mastra's Y Combinator page (Winter 2025, read 6 November 2026). The legal entity is Kepler Software, Inc., per the privacy policy and licence file. Investors from Mastra's own seed post (8 October 2025, $13m from more than 100 investors, no lead named) and Series A post (9 April 2026, $22M led by Spark Capital, $35M raised in total). The seed post names many more angels and funds than are listed here; only the institutional investors this site already knows and a few of the named founders are recorded. No valuation was found on 6 November 2026: neither Mastra's seed post nor its Series A post states one, and one search found only database and aggregator pages, which this run doesn't use, so none is recorded.", "companySocial": { "linkedin": "https://www.linkedin.com/company/mastra-ai/", "x": "https://x.com/mastra_ai", "github": "https://github.com/mastra-ai" }, "support": { "urls": [ "https://mastra.ai/docs" ], "community": [ { "label": "GitHub", "url": "https://github.com/mastra-ai/mastra", "kind": "github" } ] }, "sources": [ "https://www.ycombinator.com/companies/mastra", "https://mastra.ai/blog/seed-round", "https://mastra.ai/blog/series-a", "https://mastra.ai/privacy-policy" ], "ownership": { "status": "private", "totalRaised": { "amount": "$35M", "asOf": "2026-04", "source": "https://mastra.ai/blog/series-a" }, "checked": "2026-11-06", "sources": [ "https://mastra.ai/blog/series-a", "https://mastra.ai/blog/seed-round", "https://www.ycombinator.com/companies/mastra" ] }, "investors": [ { "name": "Y Combinator", "kind": "accelerator", "rounds": [ "Winter 2025 batch" ], "url": "https://www.ycombinator.com", "source": "https://www.ycombinator.com/companies/mastra", "quote": "Batch: Winter 2025", "page": "/investors/y-combinator/" }, { "name": "Spark Capital", "kind": "vc", "rounds": [ "Series A, April 2026" ], "lead": true, "url": "https://www.sparkcapital.com", "source": "https://mastra.ai/blog/series-a", "quote": "a $22M Series A led by Spark Capital", "page": "/investors/spark-capital/" }, { "name": "Gradient Ventures", "kind": "vc", "rounds": [ "Seed, October 2025" ], "url": "https://www.gradient.com", "source": "https://mastra.ai/blog/seed-round", "quote": "Institutionals: ... Gradient Ventures", "page": "/investors/gradient-ventures/" }, { "name": "Base Case", "firm": "Basecase Capital", "kind": "vc", "rounds": [ "Seed, October 2025" ], "url": "https://basecase.vc", "source": "https://mastra.ai/blog/seed-round", "quote": "Institutionals: ... basecase capital", "page": "/investors/basecase-capital/" }, { "name": "SV Angel", "kind": "vc", "rounds": [ "Seed, October 2025" ], "url": "https://svangel.com", "source": "https://mastra.ai/blog/seed-round", "quote": "Institutionals: ... SVAngel", "page": "/investors/sv-angel/" }, { "name": "Orange Collective", "kind": "vc", "rounds": [ "Seed, October 2025" ], "url": "https://www.orangecollective.vc", "source": "https://mastra.ai/blog/seed-round", "quote": "Institutionals: ... Orange Collective", "page": "/investors/orange-collective/" }, { "name": "Runa Capital", "kind": "vc", "rounds": [ "Seed, October 2025" ], "url": "https://runacap.com", "source": "https://mastra.ai/blog/seed-round", "quote": "Institutionals: ... Runa Capital", "page": "/investors/runa-capital/" }, { "name": "Pioneer Fund", "kind": "vc", "rounds": [ "Seed, October 2025" ], "url": "https://pioneerfund.vc", "source": "https://mastra.ai/blog/seed-round", "quote": "Institutionals: ... Pioneer Fund", "page": "/investors/pioneer-fund/" }, { "name": "Liquid 2", "firm": "Liquid 2 Ventures", "kind": "vc", "rounds": [ "Seed, October 2025" ], "url": "https://www.liquid2.vc", "source": "https://mastra.ai/blog/seed-round", "quote": "Institutionals: ... Liquid2", "page": "/investors/liquid-2-ventures/" }, { "name": "Moonfire", "firm": "Moonfire Ventures", "kind": "vc", "rounds": [ "Seed, October 2025" ], "url": "https://www.moonfire.com", "source": "https://mastra.ai/blog/seed-round", "quote": "Institutionals: ... Moonfire", "page": "/investors/moonfire-ventures/" }, { "name": "Paul Graham", "kind": "angel", "rounds": [ "Seed, October 2025" ], "source": "https://mastra.ai/blog/seed-round", "quote": "GOAT: Paul Graham (YC)", "page": "/investors/paul-graham/" }, { "name": "Guillermo Rauch", "kind": "angel", "rounds": [ "Seed, October 2025" ], "source": "https://mastra.ai/blog/seed-round", "quote": "Unicorn+ founders: ... Guillermo Rauch (Vercel)", "page": "/investors/guillermo-rauch/" }, { "name": "Amjad Masad", "kind": "angel", "rounds": [ "Seed, October 2025" ], "source": "https://mastra.ai/blog/seed-round", "quote": "Unicorn+ founders: ... Amjad Masad (Replit)", "page": "/investors/amjad-masad/" }, { "name": "Arash Ferdowsi", "kind": "angel", "rounds": [ "Seed, October 2025" ], "source": "https://mastra.ai/blog/seed-round", "quote": "Unicorn+ founders: Arash Ferdowsi (Dropbox)", "page": "/investors/arash-ferdowsi/" }, { "name": "Shay Banon", "kind": "angel", "rounds": [ "Seed, October 2025" ], "source": "https://mastra.ai/blog/seed-round", "quote": "Unicorn+ founders: ... Shay Banon (Elastic)", "page": "/investors/shay-banon/" }, { "name": "David Cramer", "kind": "angel", "rounds": [ "Seed, October 2025" ], "source": "https://mastra.ai/blog/seed-round", "quote": "Unicorn+ founders: ... David Cramer (Sentry)", "page": "/investors/david-cramer/" } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/mastra.json", "live": { "slug": "mastra", "vendorStatus": { "page": "https://statuspage.incident.io/mastra-platform", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:21:22.180687494Z" }, "versions": [ { "registry": "github", "name": "mastra-ai/mastra", "version": "@mastra/core@1.82.0", "released": "2026-11-04", "seenAt": "2026-11-06T23:43:05.299046627Z" }, { "registry": "npm", "name": "@mastra/core", "version": "1.82.0", "seenAt": "2026-11-06T23:43:01.102546802Z" }, { "registry": "npm", "name": "@mastra/mcp", "version": "2.8.0", "seenAt": "2026-11-06T23:43:01.962943277Z" }, { "registry": "npm", "name": "mastra", "version": "1.38.0", "seenAt": "2026-11-06T23:43:03.330470883Z" } ], "githubStars": 29384, "npmWeekly": 3116983, "securityTxt": { "url": "https://mastra.ai/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:45.130857018Z" }, "llmsTxt": { "url": "https://mastra.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:57.501317652Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/mastra-ai/mastra/main/packages/core/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:21:37.959722321Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "0bdb3498f7aa" }, { "url": "https://mastra.ai/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:13:54.312763229Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "0204673a21a8" }, { "url": "https://mastra.ai/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:13:56.829832485Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1621ce3063d8" }, { "url": "https://mastra.ai/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:13:58.580048861Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "edbcf520f26c" } ], "updatedAt": "2026-11-07T18:21:22.180687494Z" } }, "verify": { "accepts": "a page on mastra.ai or one of its subdomains, or the README at the root of github.com/mastra-ai/mastra", "badgeUrl": "https://www.anchorterminal.com/badges/mastra.svg", "body": { "slug": "mastra", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/mastra", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/mastra\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/mastra.svg\" alt=\"Mastra on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Mastra on Anchor Terminal](https://www.anchorterminal.com/badges/mastra.svg)](https://www.anchorterminal.com/tools/mastra)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/mastra\"\u003eMastra on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/mastra", "json": "https://www.anchorterminal.com/tools/mastra.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/mastra.md", "mcp": "https://www.anchorterminal.com/mcp", "pricing": "https://www.anchorterminal.com/tools/mastra#pricing", "reviews": "https://www.anchorterminal.com/tools/mastra#reviews", "slim": "https://www.anchorterminal.com/tools/mastra.min.md" }, "markdown": "## Overview\n\n**Grade BB · 74.2/100 · rank #91 of 1486 · #7 in Agent frameworks \u0026 SDKs · agent-ready · confidence medium**\n\n\n## Assessment\n\nA TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | Kepler Software, Inc. (https://mastra.ai) |\n| Kind | Agent framework |\n| Category | Agent frameworks \u0026 SDKs (https://www.anchorterminal.com/categories/frameworks) |\n| Auth | API key · The framework has no account of its own. The model router takes `provider/model` strings and each provider's own key. The hosted Mastra platform needs an account. |\n| Pricing | Free (Free · OSS) · Free and open source. You pay for model calls. The hosted platform has a $0 Starter plan with 100K observability events and 24 CPU hours, then $10 per 100K events and $0.35 a CPU hour, and Teams at $250 a month (https://mastra.ai/pricing, checked 2026-11-06). |\n| x402 | No · No x402, MPP or L402 in the Mastra docs, the repository or the pricing page (checked 2026-10-06). |\n| Licence | Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing |\n| Packages | npm: `@mastra/core`; npm: `@mastra/mcp`; npm: `mastra` |\n| Source | https://github.com/mastra-ai/mastra |\n| Docs | https://mastra.ai/docs |\n| llms.txt | https://mastra.ai/llms.txt |\n| Last release | 2026-11-04 |\n| GitHub stars | 29,383 (as of 2026-11-06) |\n| npm downloads / week | 3,116,983 |\n| Languages | TypeScript, Node 22.13 or newer |\n| Models | Model router with `provider/model` strings, or AI SDK providers |\n| MCP client | @mastra/mcp 2.8.0, stdio and HTTP, OAuth, requireToolApproval, allowedHosts. Also an MCP server |\n| Multi-agent | Supervisor agents with subagents, A2A and ACP. `.network()` deprecated |\n| Durable state | Workflow snapshots with suspend and resume, durable agents in-process, evented or on Inngest |\n| Human approval | Tool approval on agents and MCP servers, workflow suspend and resume |\n| Guardrails | Processors for prompt injection, PII, moderation, system-prompt scrubbing and cost limits |\n| Tracing | Built-in observability with OpenTelemetry, Langfuse, PostHog and other exporters |\n| Telemetry | CLI, server and Studio analytics on by default, with server token-use reports every 15 minutes. `MASTRA_TELEMETRY_DISABLED=1` |\n| Releases in 90 days | 27 stable releases of @mastra/core to 6 November 2026 |\n| Capabilities | agent.framework, agent.durable, agent.mcp-client, agent.multi-agent |\n| Tags | framework, typescript, open-source, llms-txt, mcp, telemetry-default-on |\n| JSON | https://www.anchorterminal.com/api/v1/tools/mastra.json |\n\n## Score breakdown (methodology v0.7, October 2026 research run)\n\nAssessed 2026-11-06 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 87 | 17.4 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 98 | 15.9 |\n| Agent ergonomics | 13% | 16.2 | 92 | 14.9 |\n| Security \u0026 auth | 14% | 17.5 | 67 | 11.7 |\n| Payments \u0026 pricing | 10% | 12.5 | 60 | 7.5 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 96 | 8.4 |\n| Transparency \u0026 trust (editorial 72, provenance 71) | 7% | 8.8 | 72 | 6.3 |\n| Negative events | up to −15 | up to −15 | 2026-06-17. Malicious versions of Mastra's npm packages were published, among them @mastra/core 1.42.1 at 01:15 UTC, and GitHub malware advisories that day (GHSA-pp62-grrw-hvfp and others) say any machine that installed one should be treated as fully compromised. All 21 Mastra packages we checked on OSV carry one. Mastra published clean versions the same day and the changelogs name an \"easy-day-js\" supply-chain incident, but we found no advisory or post-mortem from Mastra. Fixed and under four months old, so 8 points. https://osv.dev/vulnerability/MAL-2026-6011 | -8 |\n| **Total** | | | | **74.2 → BB** |\n\n### Why each score\n\n- Reliability 87 (checked 2026-11-06): Official npm packages, Node 22.13 or newer (20). Public CI workflows for unit, store, workspace and e2e tests; on 6 November the newest runs on main (Version Packages, Trigger Cloud Integration Tests) succeeded, while the test workflows themselves run on pull requests (22). 436 open issues and 795 open issues and pull requests on 6 November from GitHub's API, with 2,077 issues opened in the 90 days to 3 November; all 50 newest had a comment and 24 were closed, with issue-triage automation (18). A changesets CHANGELOG per package, a CI gate that needs approval for any major bump and migration guides, but no written versioning policy found, and `.network()` is deprecated without a removal date (12). 1.82.0 (15). 20+22+18+12+15 = 87, up from 74 on 6 October, when GitHub couldn't be read.\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 98 (checked 2026-11-06): Typed TypeScript API with a reference section (25). llms.txt with a when-to-use list and condensed instructions for coding agents (10). The docs say when to use durable agents, and point multi-agent users from `.network()` to supervisor agents (20). Tools take Zod schemas (15). Examples on every page, and MastraError with ids and categories documented, though errors are spread across pages (13). Per-package changelogs and migration guides (15).\n- Agent ergonomics 92 (checked 2026-11-06): An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading tools on demand (25). Step limits, memory windows and processors such as a token limiter control what reaches the model (20). MastraError with ids and categories, and processors can abort with a reason the caller can read (17). Workflow step retries, snapshots and durable agents for resuming (20). create-mastra scaffolds a project and the model router takes a plain string, but it's TypeScript only (10).\n- Security \u0026 auth 67 (checked 2026-11-06): The CLI sends PostHog analytics, server startup sends token counts per model and a count of registered agents, tools and MCP servers, and Studio sends browser analytics, all on by default and documented, with one opt-out, MASTRA_TELEMETRY_DISABLED=1. Since #26986 (16 October 2026) each server process also reports token use per provider and model every 15 minutes, and the telemetry reference read on 6 November says server events carry a project identifier that is a raw Platform UUID or a hash of the Git origin remote, so they \"aren't anonymous\" (12). requireToolApproval on agents and MCP servers, allowedHosts for MCP HTTP, a curated environment for stdio servers, and sandboxed workspaces (20). PromptInjectionDetector, PII and moderation processors, and docs that call tool results untrusted model input (15). Built-in tracing with OpenTelemetry and other exporters (15). No SECURITY.md, no security.txt and no bug bounty found. A blog post says Mastra is SOC 2 Type II audited, which isn't scored for a framework, and we found no public advisory from Mastra about the June incident (5). Framework reading. 15+20+15+15+5 = 70 on 6 October, 12+20+15+15+5 = 67 on 6 November.\n- Payments \u0026 pricing 60 (checked 2026-11-06): No payment protocol (0). Scored on the hosted platform, whose per-unit prices are public without a login ($10 per 100K observability events and $0.35 a CPU hour on Starter) (20). The Apache 2.0 packages install with no card (20) and no account, and run any model (20).\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 96 (checked 2026-11-06): @mastra/core 1.82.0 on 2026-11-04 (30). 27 stable releases in the 90 days to 6 November, 8 of them since 6 October (20). 436 open issues on 6 November, all 50 newest issues commented and 24 of them closed (22). Client, MCP and store packages are current, and @mastra/mcp 1.x stays supported beside 2.x (15). Renovate and CI configured, with the newest runs on main passing (9). 30+20+22+15+9 = 96.\n- Transparency \u0026 trust 72 (checked 2026-11-06): Apache 2.0 for the core, with ee/ directories source-available under the Mastra Enterprise License (25). The privacy policy (last published 25 April 2025) covers the website, the Teams plan states six months' retention, and the subprocessor list sits in a trust centre our reader couldn't render (15). Migration guides and deprecation warnings, without dated removal windows (12). Every telemetry stream is documented with links to its source and one opt-out, and the reference now spells out what the project identifiers can be correlated with (20).\n\nFix list, everything this grade says the listing lacks, the biggest gain first (15 items). What it covers is at https://www.anchorterminal.com/fixes/mastra.md (JSON https://www.anchorterminal.com/fixes/mastra.json). The whole list for a coding agent comes from `POST https://www.anchorterminal.com/api/v1/fix-list` with `{\"listing\": \"mastra\", \"plan\": \"read\"}`, free while the beta runs\n\n### What we couldn't check\n\n- Changed since 6 October 2026 (rechecked 6 November). @mastra/core went from 1.74.0 to 1.82.0 (4 November) and @mastra/mcp to 2.8.0; no new advisory on OSV for @mastra/core or @mastra/mcp beyond the June malware entries; server telemetry now also reports token use every 15 minutes (#26986, 16 October) and the reference describes correlatable project identifiers (security 70 to 67); GitHub's API answered this time, so CI on main and issue activity were read first-hand (reliability 74 to 87, maintenance 87 to 96); licence, pricing and the missing security.txt unchanged\n- How long the malicious versions stayed on npm, how they were published and whether 1.43.0 (17 June, 08:23 UTC) was clean. We found no write-up from Mastra\n- unchecked: the trust centre at trust.mastra.ai, which needs JavaScript, so the subprocessor list and SOC 2 report weren't read\n\n### Sources\n\n- npm registry document for @mastra/core (versions and dates): \u003chttps://registry.npmjs.org/@mastra/core\u003e (seen 2026-11-06)\n- npm weekly downloads: \u003chttps://api.npmjs.org/downloads/point/last-week/@mastra/core\u003e (seen 2026-11-06)\n- repository clone (docs source, CI workflows, LICENSE.md, CHANGELOGs): \u003chttps://github.com/mastra-ai/mastra\u003e (seen 2026-10-06)\n- OSV malware advisory for @mastra/core 1.42.1: \u003chttps://osv.dev/vulnerability/MAL-2026-6011\u003e (seen 2026-11-06)\n- core changelog with the 17 June remediation: \u003chttps://github.com/mastra-ai/mastra/blob/main/packages/core/CHANGELOG.md\u003e (seen 2026-10-06)\n- CLI reference, telemetry: \u003chttps://mastra.ai/reference/cli/mastra\u003e (seen 2026-11-06)\n- MCP: \u003chttps://mastra.ai/docs/connections/mcp\u003e (seen 2026-10-06)\n- guardrails: \u003chttps://mastra.ai/docs/agents/guardrails\u003e (seen 2026-10-06)\n- licence: \u003chttps://mastra.ai/docs/license\u003e (seen 2026-11-06)\n- llms.txt: \u003chttps://mastra.ai/llms.txt\u003e (seen 2026-10-06)\n- pricing: \u003chttps://mastra.ai/pricing\u003e (seen 2026-11-06)\n- privacy policy: \u003chttps://mastra.ai/privacy-policy\u003e (seen 2026-10-06)\n- security.txt (404): \u003chttps://mastra.ai/.well-known/security.txt\u003e (seen 2026-11-06)\n- regulated enterprise post (SOC 2 claim): \u003chttps://mastra.ai/blog/secure-governed-agents-regulated-enterprise\u003e (seen 2026-10-06)\n- telemetry source history (model usage telemetry, #26986): \u003chttps://github.com/mastra-ai/mastra/blob/main/packages/core/src/telemetry/model-usage-telemetry.ts\u003e (seen 2026-11-06)\n- OSV advisories for @mastra/core and @mastra/mcp: \u003chttps://osv.dev/list?q=%40mastra%2Fcore\u0026ecosystem=npm\u003e (seen 2026-11-06)\n- GitHub API, repository, issues and Actions runs on main: \u003chttps://api.github.com/repos/mastra-ai/mastra\u003e (seen 2026-11-06)\n\n## Score history\n\nEvery move of a score since the listing was graded, newest first, with its cause. A score can't move without an entry here. JSON: https://www.anchorterminal.com/api/v1/tools/mastra/history.json\n\n- 2026-11-06: graded 74.2 BB (methodology 0.7)\n\n## Who's behind it (provenance 71/100, checked 2026-11-06)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | Kepler Software, Inc. | 20/20 |\n| Domain age | mastra.ai, registered 2024-10-01 (2 years) | 7/15 |\n| Endpoint on the vendor's domain | no hosted endpoint | n/a |\n| Terms of service | read, states 6 of the 7 things a reader expects, and has 3 clauses that cost points | 3.1/10 |\n| Privacy policy | read, states 3 of the 8 things a reader expects | 6.3/10 |\n| Status page | statuspage.incident.io/mastra-platform | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | not found | 0/10 |\n| People named | 3 named with their role, 3 with a public profile | 10/10 |\n| Support route | help pages, a community | 5/5 |\n\nThe privacy policy names Kepler Software Inc as operator of mastra.ai and shows a last-published date of 25 April 2025.\n\nThe licence file is copyright Kepler Software, Inc.\n\nmastra.ai/.well-known/security.txt returns 404 (rechecked 6 November 2026), and the repository has no SECURITY.md.\n\nRDAP gives mastra.ai a registration date of 2024-10-01.\n\nThe status page covers the hosted platform, not the framework.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://mastra.ai/terms-of-service), read 2026-11-06, dated 2026-10-26, states 6 of the 7 things a reader expects.\n\n- To know. Says it may use customer content to train or improve models, and no opt-out was found (costs points). \"(o) use the Services to train, fine-tune, or otherwise develop a product or service that competes with the Services, including by extracting Model outputs in bulk for the purpose of training a competing foundation model;\"\n- To know. Restricts automated access (costs points). \"(d) use any manual or automated software, devices, or other processes (including spiders, robots, scrapers, crawlers, avatars, or data-mining tools) to scrape, harvest, or download data from the Services, except that Mastra grants the operators of public search engines revocable permission to use spiders to copy mater…\"\n- To know. Says the terms or the service can change without notice (costs points). \"Mastra makes no representations that Beta Services will ever be made generally available and reserves the right to discontinue or modify Beta Services at any time without notice.\"\n- To know. Says access can be ended without notice or for any reason. \"Mastra may terminate or reduce Customer's access under any trial (whether free or paid) at any time in its discretion, including where Customer exceeds the usage limits, feature scope, or duration set forth in the applicable Order Form.\"\n- To know. Requires arbitration or waives class actions. \"EACH PARTY HEREBY KNOWINGLY, VOLUNTARILY, AND INTENTIONALLY WAIVES ITS RIGHT TO A TRIAL BY JURY IN ANY PROCEEDING ARISING OUT OF OR RELATING TO THIS AGREEMENT.\"\n- Gives the date it was last updated. Last updated 2026-10-26.\n- Names the governing law or courts. The law of the State of Delaware.\n- States a limit on its liability. Capped at $100.\n- Not found in the text. Says how changes to the terms are announced.\n\n**Privacy policy** (https://mastra.ai/privacy-policy), read 2026-11-06, gives no date, states 3 of the 8 things a reader expects.\n\n- Not found in the text. Gives the date it was last updated.\n- Not found in the text. Says how long data is kept.\n- Not found in the text. Says whether personal data is sold or shared for advertising.\n- Not found in the text. Says what rights people have over their data.\n- Not found in the text. Says where data is transferred or stored.\n\n## Humans behind the project (researched 2026-11-06 from public pages, not part of the grade)\n\n### Key people\n\n- Sam Bhagwat, Founder and CEO. LinkedIn: https://www.linkedin.com/in/sambhagwat. X: https://x.com/calcsam\n- Abhi Aiyer, Founder and CTO. LinkedIn: https://www.linkedin.com/in/abhi-aiyer-aa41bb42/. X: https://x.com/abhiaiyer\n- Shane Thomas, Founder. LinkedIn: https://www.linkedin.com/in/smthomas3. X: https://x.com/smthomas3\n- Note: Founders, roles and their LinkedIn and X links from Mastra's Y Combinator page (Winter 2025, read 6 November 2026). The legal entity is Kepler Software, Inc., per the privacy policy and licence file. Investors from Mastra's own seed post (8 October 2025, $13m from more than 100 investors, no lead named) and Series A post (9 April 2026, $22M led by Spark Capital, $35M raised in total). The seed post names many more angels and funds than are listed here; only the institutional investors this site already knows and a few of the named founders are recorded. No valuation was found on 6 November 2026: neither Mastra's seed post nor its Series A post states one, and one search found only database and aggregator pages, which this run doesn't use, so none is recorded.\n- Kepler Software, Inc. (Mastra): LinkedIn https://www.linkedin.com/company/mastra-ai/ X https://x.com/mastra_ai GitHub https://github.com/mastra-ai\n\n### Ownership and investors\n\n- Raised: $35M in total, as of April 2026 (source https://mastra.ai/blog/series-a)\n- Backed by: Y Combinator, Spark Capital, Gradient Ventures, Basecase Capital, SV Angel, Orange Collective, Runa Capital, Pioneer Fund, Liquid 2 Ventures, Moonfire Ventures, Paul Graham, Guillermo Rauch, Amjad Masad, Arash Ferdowsi, Shay Banon, David Cramer\n\n### Getting support\n\n- Help: https://mastra.ai/docs\n- Community (GitHub): https://github.com/mastra-ai/mastra\n- Sources: https://www.ycombinator.com/companies/mastra, https://mastra.ai/blog/seed-round, https://mastra.ai/blog/series-a, https://mastra.ai/privacy-policy\n\n## Live (updated 2026-11-07 18:21 UTC)\n\n- Vendor status page: no problems reported, All Systems Operational\n- github `mastra-ai/mastra` @mastra/core@1.82.0, released 2026-11-04\n- npm `@mastra/core` 1.82.0\n- npm `@mastra/mcp` 2.8.0\n- npm `mastra` 1.38.0\n- security.txt: none\n- Watching changelog \u003chttps://raw.githubusercontent.com/mastra-ai/mastra/main/packages/core/CHANGELOG.md\u003e\n- Watching pricing \u003chttps://mastra.ai/pricing\u003e\n- Watching privacy \u003chttps://mastra.ai/privacy-policy\u003e\n- Watching terms \u003chttps://mastra.ai/terms-of-service\u003e\n- Always current: https://www.anchorterminal.com/api/v1/live/mastra.json\n\n## Probe metrics\n\nA library has no endpoint to probe. Reliability is assessed from its tests, release history and issue tracker; performance waits for the task suite run through it. See https://www.anchorterminal.com/benchmark/#kinds\n\n## Strengths\n\n- MCP client with requireToolApproval per server or per tool, allowedHosts and a curated environment for stdio servers\n- Guardrail processors for prompt injection, PII, moderation and cost limits, run on input and output\n- Workflows with snapshots, suspend and resume, and durable agents on Inngest or an evented engine\n- Apache 2.0 core, 1.0 since 20 January 2026, with 27 releases of @mastra/core in 90 days to 6 November\n- llms.txt with a when-to-use section and condensed instructions for coding agents\n\n## Weaknesses\n\n- Malicious versions of Mastra npm packages, including @mastra/core 1.42.1, were published on 17 June 2026\n- CLI, server and Studio send usage analytics by default, including token counts every 15 minutes, off with MASTRA_TELEMETRY_DISABLED=1\n- No SECURITY.md, no security.txt and no bug bounty found\n- Code under ee/ is source-available under the Mastra Enterprise License, not Apache 2.0\n- TypeScript only, Node 22.13 or newer\n\n\n\n## Before you call it (notes for agents)\n\n1. Set MASTRA_TELEMETRY_DISABLED=1 in every environment that runs the CLI, the server or Studio\n2. Pin exact versions with a lockfile, and make sure no 17 June 2026 release such as @mastra/core 1.42.1 is installed\n3. Set requireToolApproval on MCP servers that write, and allowedHosts when server URLs come from configuration\n4. Add PromptInjectionDetector as an input processor when tools return web or user content\n5. Use supervisor agents through generate() or stream(). `.network()` is deprecated\n\n## Get started\n\nInstall:\n\n```bash\nnpm create mastra@latest # or: npm i @mastra/core @mastra/mcp\n```\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| AI SDK | AA | 89.8 | 1 | agent.framework, agent.mcp-client, agent.multi-agent, agent.durable | no | https://www.anchorterminal.com/tools/vercel-ai-sdk.md |\n| OpenAI Agents SDK | AA | 86.2 | 3 | agent.framework, agent.multi-agent, agent.durable, agent.mcp-client | no | https://www.anchorterminal.com/tools/openai-agents-sdk.md |\n| Pydantic AI | A | 81.9 | 7 | agent.framework, agent.multi-agent, agent.durable, agent.mcp-client | no | https://www.anchorterminal.com/tools/pydantic-ai.md |\n| Strands Agents | A | 80 | 15 | agent.framework, agent.mcp-client, agent.multi-agent, agent.durable | no | https://www.anchorterminal.com/tools/strands-agents.md |\n| Microsoft Agent Framework | A | 79.4 | 18 | agent.framework, agent.multi-agent, agent.durable, agent.mcp-client | no | https://www.anchorterminal.com/tools/microsoft-agent-framework.md |\n| Docker Agent | BB | 73.6 | 101 | agent.framework, agent.multi-agent, agent.mcp-client, agent.durable | no | https://www.anchorterminal.com/tools/docker-agent.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- @mastra/core 1.82.0 on 2026-11-04, with 27 stable releases in the 90 days to 6 November 2026 (8 since 6 October), and 1.0.0 on 2026-01-20 (source: \u003chttps://registry.npmjs.org/@mastra/core\u003e)\n- GitHub malware advisories, published 17 June 2026, cover versions of Mastra packages such as @mastra/core 1.42.1, @mastra/mcp, @mastra/server and create-mastra, and advise treating any machine that installed one as compromised (source: \u003chttps://osv.dev/vulnerability/MAL-2026-6011\u003e)\n- The package changelogs record a 17 June 2026 remediation for the \"easy-day-js\" supply-chain incident, publishing clean versions that superseded those declaring the malicious dependency (source: \u003chttps://github.com/mastra-ai/mastra/blob/main/packages/core/CHANGELOG.md\u003e)\n- The CLI, server and Studio send usage analytics by default; since 16 October 2026 servers also report token use per model every 15 minutes, with a project identifier from a Platform UUID or a hashed Git remote, and MASTRA_TELEMETRY_DISABLED=1 turns all of it off (source: \u003chttps://mastra.ai/reference/cli/mastra\u003e)\n- @mastra/mcp 2.x serves only MCP 2026-07-28, while its client still connects to older servers and 1.x stays supported (source: \u003chttps://mastra.ai/reference/migrations/mcp-v2\u003e)\n\n- #7 of 20 in Best agent frameworks and SDKs: https://www.anchorterminal.com/best/frameworks/index.md\n- All 171 frameworks comparisons: https://www.anchorterminal.com/compare/frameworks/index.md\n\n## Compare\n\n- [AgentOS vs Mastra](https://www.anchorterminal.com/compare/agentos-vs-mastra.md): BB 75.8 vs BB 74.2\n- [Agno vs Mastra](https://www.anchorterminal.com/compare/agno-vs-mastra.md): BB 70.9 vs BB 74.2\n- [BoxLang AI vs Mastra](https://www.anchorterminal.com/compare/boxlang-ai-vs-mastra.md): B 65.8 vs BB 74.2\n- [Claude Agent SDK vs Mastra](https://www.anchorterminal.com/compare/claude-agent-sdk-vs-mastra.md): BB 70.3 vs BB 74.2\n- [CrewAI vs Mastra](https://www.anchorterminal.com/compare/crewai-vs-mastra.md): C 59 vs BB 74.2\n- [Cursor Agent SDK vs Mastra](https://www.anchorterminal.com/compare/cursor-agent-sdk-vs-mastra.md): B 63.7 vs BB 74.2\n- [Docker Agent vs Mastra](https://www.anchorterminal.com/compare/docker-agent-vs-mastra.md): BB 73.6 vs BB 74.2\n- [Agent Development Kit (ADK) vs Mastra](https://www.anchorterminal.com/compare/google-adk-vs-mastra.md): B 68.7 vs BB 74.2\n- [guilds.run vs Mastra](https://www.anchorterminal.com/compare/guilds-run-vs-mastra.md): D 53.4 vs BB 74.2\n- [LangGraph vs Mastra](https://www.anchorterminal.com/compare/langgraph-vs-mastra.md): B 69.8 vs BB 74.2\n- [LlamaIndex Framework vs Mastra](https://www.anchorterminal.com/compare/llamaindex-vs-mastra.md): BB 70 vs BB 74.2\n- [Mastra vs Microsoft Agent Framework](https://www.anchorterminal.com/compare/mastra-vs-microsoft-agent-framework.md): BB 74.2 vs A 79.4\n- [Mastra vs OpenAI Agents SDK](https://www.anchorterminal.com/compare/mastra-vs-openai-agents-sdk.md): BB 74.2 vs AA 86.2\n- [Mastra vs Pydantic AI](https://www.anchorterminal.com/compare/mastra-vs-pydantic-ai.md): BB 74.2 vs A 81.9\n- [Mastra vs smolagents](https://www.anchorterminal.com/compare/mastra-vs-smolagents.md): BB 74.2 vs C 58.7\n- [Mastra vs Strands Agents](https://www.anchorterminal.com/compare/mastra-vs-strands-agents.md): BB 74.2 vs A 80\n- [Mastra vs TradingAgents](https://www.anchorterminal.com/compare/mastra-vs-tradingagents.md): BB 74.2 vs C 61.4\n- [Mastra vs AI SDK](https://www.anchorterminal.com/compare/mastra-vs-vercel-ai-sdk.md): BB 74.2 vs AA 89.8\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on mastra.ai or one of its subdomains, or the README at the root of github.com/mastra-ai/mastra. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"mastra\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/mastra\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/mastra.svg\" alt=\"Mastra on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Mastra on Anchor Terminal](https://www.anchorterminal.com/badges/mastra.svg)](https://www.anchorterminal.com/tools/mastra)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/mastra\"\u003eMastra on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Mastra is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/mastra-dark.png\n- Light: https://www.anchorterminal.com/assets/share/mastra-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Agent frameworks \u0026 SDKs", "url": "https://www.anchorterminal.com/categories/frameworks" }, { "name": "Mastra", "url": "" } ], "description": "Open-source TypeScript framework from Mastra for building agents and workflows, with memory, RAG, evals, tracing, an MCP client and server, and a local Studio. An optional hosted platform runs deployments and observability.", "facts": [ "rank #91 of 1486", "API key auth", "0 desk reviews" ], "h1": "Mastra", "image": "https://www.anchorterminal.com/assets/og/tools-mastra.png", "path": "/tools/mastra", "published": "2026-10-01", "section": "tools", "title": "Mastra review (2026): pricing, alternatives and grade BB", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/tools/mastra" }, "tokens": { "markdown": 7150, "slim": 1430 }, "version": 1 }