Mastra: review, pricing, security and alternatives

What Mastra does

Mastra belongs to the frameworks family: libraries for building your own agents in code: loop, tools, memory, orchestration. On our grid it ranks #13 of the 28 projects of this family listed in the directory.

Unlike a ready-made agent, a framework provides the parts to build one: tool calling, step sequencing, memory, coordination of several agents. It is aimed at teams that want a custom agent.

You use it from: developer SDK, terminal (CLI), web app, and API. Usable models: any OpenAI-compatible model. It can run on your own machine or server.

Who is Mastra for?

It is for developers building their own agent or adding agentic AI to a product. Typical tasks people give it:

• build a business agent wired to your APIs
• orchestrate tool and model calls
• add memory and error recovery to an agent

It is a good candidate if you are comfortable in a terminal and your data must stay on your machines.

Access and human control

A framework has no access of its own: the tools you plug in define what the agent can do. Start with read-only tools.

We could not establish whether it asks for human approval before sensitive actions: test it first on an unimportant account or folder.

Mastra pricing

The code is public but the repository declares no licence: reuse is not formally allowed. The real cost comes from model calls: each loop step sends the whole context back to the model, and a task of several dozen steps can cost far more than a single question. The LLM price calculator estimates it for the chosen model.

Getting started with Mastra

1. Install it: the project ships as a Node.js package (install with npm, or run directly with npx). The exact command is in the repository README.
2. Create an API key with the model provider and put it in an environment variable, never in a shared or versioned file.
3. Start with the minimal example from the docs, then add one tool at a time and check what the agent does with it.
4. Give it a short, checkable task, review the result and its action log, then raise the difficulty step by step.

Security: risk level

A framework does not protect you by default: approval, minimal rights and sandboxing are up to you.

Points found for Mastra:

• No licence: legally shaky for company use.

Three habits: least privilege (minimal rights, dedicated keys), human approval for irreversible actions, a sandbox for code execution. The AI agent security check reviews your setup in a few minutes.

Project activity and releases

Created on August 6, 2024, the mastra-ai/mastra repository has 29,049 stars, 3,038 forks and 338 open issues, with 22,030 commits in total. It received changes this month.

Over the last 52 weeks: 15,258 commits, an average of 293.4 per week.

130 releases in total; 30 in the last twelve months. Latest release: @mastra/core@1.79.0, on October 21, 2026.

Mastra vs other frameworks

GitHub stars of the best-rated open-source projects in the frameworks family. Stars measure attention, not quality: a heavily promoted project collects them fast, a specialised tool will have few.

Mastra and other frameworks at a glance

The 7 best-ranked agents in the same family, 7 of them open source. The score out of 100 only applies to open-source projects; for proprietary services we show the published entry price. A dash marks information the documentation does not state.

How we rated it

Score: 75/100, computed only from public, verifiable data, with no subjective testing or partnership:

• Adoption 30/40: 29,049 stars on a log scale (40 points from about 200,000).
• Activity 30/30: last commit less than a month ago, 30 releases in six months, 15,258 commits in a year.
• Framework 15/30: licence, default human approval, self-hosting, model choice and documentation site.

The score does not say whether the agent will succeed at your tasks: it measures how solid the project is. The full grid is on the method page.