Automation & agent frameworks Mastra
Is Mastra safe?
Short answer: No issues found. StackGrade's weekly scan of mastra-ai/mastra found no issues: no critical-severity dependency advisories, no downloading install hooks, no remote-code patterns and no agent instruction file that changes the label. It does list 6 high-severity advisories in runtime dependencies, which don't change the label. 3 phrases in agent instruction files were flagged for human review (unclear). Automated scan of commit e1e64f0 on 2 Nov 2026, not a manual audit.
Updated : the last week its score, rank or safety result changed.
TypeScript framework for AI applications and agents.
- 29,265 stars
- pushed 2 Nov
- Apache-2.0 (ee/ excluded)
- TypeScript
#33of 52 overall#7in Automation & agent frameworks▲ 1 vs Week 44
- Maintenance 30%83
- Adoption 30%15
- Docs 20%29
- Community 20%–
Score over the last 4 weeks: 43, 44, 43, 44.
All checks clean in the scan of 2 Nov 2026.
How this score works
Each part is a percentile among all 52 tracked tools, so 50 is average for this list. Community is not measured yet; the score uses the other 80%.
- Maintenance: Last push 2 Nov 2026. Last 10 GitHub releases within 1 day (about 270 per 30 days), latest release 30 Oct 2026. Issue close time: fewer than 5 closed issues, so not used.
- Adoption: 29,265 stars (70%), 3,066 forks (30%).
- Docs: README 7,195 characters, 9 headings, 2 code blocks, install section: yes.
#7 of 14 in Automation & agent frameworks
Ranked by score. The yellow row is this tool.
Show the other 7
- 8LangGraph#34 overall44No issues found
- 9Agent Development Kit (ADK, Python)#36 overall43Caution
- 10OpenBot#39 overall41Caution
- 11AutoGen#41 overall40Caution
- 12OpenAI Agents SDK (Python)#42 overall39Caution
- 13smolagents#47 overall30No dependencies scanned
- 14artemis#50 overall25Caution
Safety scan, 2 Nov 2026
Automated scan of commit e1e64f0, 20,743 files. Not a manual audit.
No issues found
- 0Critical dependency advisories6 high, 6 medium, 1 low. OSV, runtime dependencies only.
- 1Install hooksnpm scripts that run on install; none downloads remote content.
- 0Remote-code patternsFor example eval(fetch(…)).
- 1142Agent files checked3 phrases flagged for review.
- 0curl | sh installersIn docs or program code. Information only.
Why this label?
No issues found by the automated scan.
Known vulnerabilities in runtime dependencies (OSV): 0 critical, 6 high, 6 medium, 1 low
Also found (informational, does not change the label):
- 3 injection-related phrases in instruction files, flagged for human review (often defensive guidance), e.g. .mastracode/commands/gh-triage.md
- 6 high-severity known vulnerabilities in runtime dependencies (OSV)
- 1 npm install hook, none downloading remote content
- Skill scripts contact: localhost, my-project.server.staging.mastra.cloud, my-project.server.mastra.cloud, platform.mastra.ai, projects.mastra.ai, gateway-api.staging.mastra.ai, gateway-api.mastra.ai, studio.staging.mastra.ai
Notes:
- 15 affected packages only in dev/test/docs manifests, not counted
- Telemetry/analytics references in code: telemetry, posthog
Automated scan of commit e1e64f0 on 2 Nov 2026, not a manual audit. 20,743 files checked. What we check
Repo activity
From the GitHub API, fetched 2 Nov 2026.
- 10+Releases, 90 daysLatest @mastra/vercel@1.6.3, 30 Oct
- –Median issue closeFewer than 5 closed issues
- 29.3kStars+189 since 26 Oct
- 3.1kForks703 open issues
- 2024Repo created6 Aug 2024
10 releases in the last 30 days (GitHub releases feed, last 10 entries):
Questions about Mastra
Answers use this week's StackGrade data.
Is Mastra safe to use?
No issues found. StackGrade's weekly scan of mastra-ai/mastra found no issues: no critical-severity dependency advisories, no downloading install hooks, no remote-code patterns and no agent instruction file that changes the label. It does list 6 high-severity advisories in runtime dependencies, which don't change the label. 3 phrases in agent instruction files were flagged for human review (unclear). Automated scan of commit e1e64f0 on 2 Nov 2026, not a manual audit.
How does StackGrade score Mastra?
Mastra scores 44 out of 100 in Week 45: #33 of 52 tracked tools overall and #7 in Automation & agent frameworks. The score combines maintenance (83), adoption (15) and docs (29) as percentiles among all 52 tracked tools; community (20% weight) is not measured yet, so the score uses the other 80%. It is not a hands-on test and it is separate from the safety label.
What are the alternatives to Mastra?
What licence does Mastra use?
The licence listed for mastra-ai/mastra is Apache-2.0 (ee/ excluded). Read the licence text before commercial use.
Compare and use it
Side by side
Used in 1 AI use case
All facts and sources
- Type
- Agent framework
- License
- Apache-2.0 (ee/ excluded)
- Language
- TypeScript
- Created
- 6 Aug 2024
- Owner
- mastra-ai (Organization)
- Forks
- 3,066
- Homepage
- mastra.ai
GitHub description: “Mastra is the modern TypeScript framework for AI-powered applications and agents.”
Sources: github.com/mastra-ai/mastra, api.github.com/repos/mastra-ai/mastra, raw.githubusercontent.com/mastra-ai/mastra/main/README.md. Fetched 2 Nov 2026.
Know when Mastra changes label
One email a week: the new top 10, the biggest score changes and every safety label that changed.
Free. Double opt-in: you confirm by email first, unsubscribe in one click.