# Mastra (slim)

> Open-source TypeScript framework from Mastra for building agents and workflows, with memory, RAG, evals, tracing, an MCP client and server, and a local Studio. An optional hosted platform runs deployments and observability.

- Full: https://www.anchorterminal.com/tools/mastra.md (~7,150 tokens) · this version ~1,430 tokens · JSON https://www.anchorterminal.com/tools/mastra.json · canonical https://www.anchorterminal.com/tools/mastra
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07 · pricing https://www.anchorterminal.com/tools/mastra#pricing · reviews https://www.anchorterminal.com/tools/mastra#reviews
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

**BB · 74.2/100 · rank #91 of 1486 · #7 in Agent frameworks & SDKs · agent-ready · confidence medium**


Assessment: A TypeScript framework with agents, workflows with suspend and resume, memory, an MCP client and server, per-server tool approval and built-in guardrail processors including a prompt-injection detector. On 17 June 2026 malicious versions of its npm packages were published, and the CLI, server and Studio send usage analytics by default, with token counts every 15 minutes.

## Facts

- Kind: Agent framework · vendor: Kepler Software, Inc. · category: Agent frameworks & SDKs · legal entity: Kepler Software, Inc. · provenance 71/100
- Packages: npm `@mastra/core`, npm `@mastra/mcp`, npm `mastra`
- Auth: API key · pricing: Free · x402: no · licence: Apache-2.0 for the core. Code under ee/ directories is source-available under the Mastra Enterprise License, free for development and testing
- Vendor status page: no problems reported, All Systems Operational (2026-11-07 18:21 UTC)
- Languages: TypeScript, Node 22.13 or newer
- Models: Model router with `provider/model` strings, or AI SDK providers
- MCP client: @mastra/mcp 2.8.0, stdio and HTTP, OAuth, requireToolApproval, allowedHosts. Also an MCP server
- Multi-agent: Supervisor agents with subagents, A2A and ACP. `.network()` deprecated
- Durable state: Workflow snapshots with suspend and resume, durable agents in-process, evented or on Inngest
- Human approval: Tool approval on agents and MCP servers, workflow suspend and resume
- Guardrails: Processors for prompt injection, PII, moderation, system-prompt scrubbing and cost limits
- Tracing: Built-in observability with OpenTelemetry, Langfuse, PostHog and other exporters
- Telemetry: CLI, server and Studio analytics on by default, with server token-use reports every 15 minutes. `MASTRA_TELEMETRY_DISABLED=1`
- Releases in 90 days: 27 stable releases of @mastra/core to 6 November 2026

- Scores: Reliability 87, Performance pending, Schema & documentation 98, Agent ergonomics 92, Security & auth 67, Payments & pricing 60, Task success pending, Maintenance & community 96, Transparency & trust 72 · negative events -8 · total over the 7 assessed categories
- Why: Reliability, Official npm packages, Node 22.13 or newer (20). · Schema & documentation, Typed TypeScript API with a reference section (25). · Agent ergonomics, An MCP client in about ten lines with listTools() for static or listToolsets() for per-request tools, and ToolSearchProcessor for loading to… · Security & auth, The CLI sends PostHog analytics, server startup sends token counts per model and a count of registered agents, tools and MCP servers, and St… · Payments & pricing, No payment protocol (0). · Maintenance & community, @mastra/core 1.82.0 on 2026-11-04 (30). · Transparency & trust, Apache 2.0 for the core, with ee/ directories source-available under the Mastra Enterprise License (25).
- Sources: 17, open questions: 3, both in the full twin
- Capabilities: agent.framework, agent.durable, agent.mcp-client, agent.multi-agent
- JSON: https://www.anchorterminal.com/api/v1/tools/mastra.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/mastra.svg` or a link to https://www.anchorterminal.com/tools/mastra from a page on mastra.ai or one of its subdomains, or the README at the root of github.com/mastra-ai/mastra, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.
- Support: https://mastra.ai/docs; more in the full twin

## Before you call it

1. Set MASTRA_TELEMETRY_DISABLED=1 in every environment that runs the CLI, the server or Studio
2. Pin exact versions with a lockfile, and make sure no 17 June 2026 release such as @mastra/core 1.42.1 is installed
3. Set requireToolApproval on MCP servers that write, and allowedHosts when server URLs come from configuration
4. Add PromptInjectionDetector as an input processor when tools return web or user content
5. Use supervisor agents through generate() or stream(). `.network()` is deprecated

## Connect

```bash
npm create mastra@latest   # or: npm i @mastra/core @mastra/mcp
```

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| AI SDK | AA | 89.8 | agent.framework, agent.mcp-client, agent.multi-agent, agent.durable | https://www.anchorterminal.com/tools/vercel-ai-sdk.min.md |
| OpenAI Agents SDK | AA | 86.2 | agent.framework, agent.multi-agent, agent.durable, agent.mcp-client | https://www.anchorterminal.com/tools/openai-agents-sdk.min.md |
| Pydantic AI | A | 81.9 | agent.framework, agent.multi-agent, agent.durable, agent.mcp-client | https://www.anchorterminal.com/tools/pydantic-ai.min.md |
| Strands Agents | A | 80 | agent.framework, agent.mcp-client, agent.multi-agent, agent.durable | https://www.anchorterminal.com/tools/strands-agents.min.md |
| Microsoft Agent Framework | A | 79.4 | agent.framework, agent.multi-agent, agent.durable, agent.mcp-client | https://www.anchorterminal.com/tools/microsoft-agent-framework.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)