Mastra−36 Negative

Operator Insights

What are teams learning from building on Mastra and running it in production?

12 accounts: 3 failures, incidents or rollbacks, 1 left it or turned it down, 1 switched and 7 adopted it

Failures, incidents and rollbacks3

Socket Research TeamSupply-chain security researchersSocket
Mastra's @mastra npm packages, published until then only by the project's CI.
Socket blog, published Jun 17, 2026Read the write-up (opens Socket blog in a new tab)
Observation
A single npm account published malicious versions of 141 @mastra packages on June 17, 2026, and Socket advises treating every host that installed one as compromised.
Takeaway
Pin every @mastra package from a lockfile and review dependency bot updates, because a compromised release reaches CI within minutes.
What happened
A single human npm account published malicious versions of 141 @mastra packages between about 01:15 and 02:36 UTC on Jun 17, 2026 (Socket, Jun 17, 2026). Each added one dependency, easy-day-js, a typosquat of dayjs whose install hook runs an obfuscated payload during npm install.
“If you installed any of the versions above, treat the host or CI runner that ran the install as compromised.”
Socket Research Team
- Public engineering write-up (Socket threat research blog)
- Package counts reported
Deployment details
Mastra's @mastra npm packages, published until then only by the project's CI.
- Public engineering write-up (Socket threat research blog)
- Package counts reported
Team
Every team that installed an affected @mastra version
Duration
About 81 minutes of malicious publishing, Jun 17, 2026 UTC
Workload
npm installs of @mastra packages in development and CI
Product version
Malicious patch releases of @mastra packages
Measurement
141 packages, by Socket's count
In SignalsNot counted. A security vendor's incident analysis, not an account of running Mastra; the team whose dependency bot pulled the versions counts as its own record.

SudolabsOct 27, 2026GitHub (mastra-ai/mastra)At Sudolabs, mastra build on a larger app ran out of memory after the 1.79.0 release.
Tomas VargaDeveloperSudolabs
A larger Mastra app built with the mastra CLI and @mastra/deployer.
GitHub (mastra-ai/mastra), published Oct 27, 2026Read the issue (opens GitHub (mastra-ai/mastra) in a new tab)
Observation
At Sudolabs, mastra build on a larger app ran out of memory after the 1.79.0 release.
Takeaway
Pin the Mastra CLI and deployer versions in CI and watch build memory after each upgrade.
What happened
Since @mastra/deployer 1.79.0, mastra build on the app stalled for about a minute and then failed with a JavaScript heap out-of-memory error (GitHub issue, Oct 27, 2026). Extracting one deployer option took 28 seconds and 2,268 MB of heap on 1.79.0 against 0.6 seconds and 176 MB on 1.78.0, and the same app built with a 768 MB heap on 1.78.0. The report traces the regression to a change that runs Rollup with a TypeScript resolver just to read the deployer options.
“Since @mastra/deployer 1.79.0 (@mastra/core@1.79.0 release, CLI mastra 1.35.0), mastra build on a larger app runs out of memory before "Analyzing dependencies...".”
tomasvarga
Public engineering write-up (the developer's GitHub issue)
Team metric reported
Deployment details
A larger Mastra app built with the mastra CLI and @mastra/deployer.
Public engineering write-up (the developer's GitHub issue)
Team metric reported
Team
Sudolabs
Workload
Builds of a larger Mastra app
Product version
@mastra/deployer 1.79.0 against 1.78.0
Measurement
2,268 MB of heap on 1.79.0 against 176 MB on 1.78.0 for one option
In SignalsCounted once, as the developer's own issue. In the record
PostizJul 9, 2026GitHub, gitroomhq/postiz-appPostiz's MCP service on @mastra/mcp grew about 330 MB an hour until it was killed twice a day, so Postiz moved the server to stateless mode.
Gilad ResisiGitHub commit authorPostiz
Postiz, an open-source social media scheduler sold as Postiz Cloud, which ships @mastra/core, @mastra/memory and @mastra/mcp in its app.
GitHub, gitroomhq/postiz-app, published Jul 9, 2026Read the write-up (opens GitHub, gitroomhq/postiz-app in a new tab)
Observation
Postiz's MCP service on @mastra/mcp grew about 330 MB an hour until it was killed twice a day, so Postiz moved the server to stateless mode.
Takeaway
Load-test a Mastra MCP server with real connectors and restarts before production, and serve it statelessly when tools need no session state.
What happened
In a commit of Jul 9, 2026, Postiz found that @mastra/mcp kept one transport per session and removed it only on an explicit client DELETE, which connectors never send. The MCP service climbed about 330 MB an hour from a 1 GB baseline and was killed at about 5 GB twice a day. After any restart, Mastra answered old session IDs with 400 when it should have returned 404, which broke every later tool call from clients such as Claude Desktop. Postiz switched the server to Mastra's stateless serverless mode and kept Mastra.
Public engineering write-up (GitHub commit message)
Team metrics reported
Deployment details
Postiz, an open-source social media scheduler sold as Postiz Cloud, which ships @mastra/core, @mastra/memory and @mastra/mcp in its app.
Public engineering write-up (GitHub commit message)
Team metrics reported
Team
Postiz engineers
Workload
MCP server exposing Postiz tools to agent connectors
Product version
@mastra/mcp MCPServer in session mode, then stateless
Measurement
About 330 MB an hour of growth, killed at about 5 GB twice a day
In SignalsCounted once, as the engineer's own commit. In the record

Left it or turned it down1

Sebastien CastielStaff Software DeveloperVasco
Vasco's product agent, rebuilt across four agent frameworks between December 2024 and July 2026.
Vasco Engineering, published Jul 24, 2026Read the write-up (opens Vasco Engineering in a new tab)
Observation
Vasco moved its agent from Google ADK to Mastra, then left Mastra for the Claude Agent SDK six weeks later for better answers.
Takeaway
Keep business logic in your own tools and prompts so a framework change takes weeks, and judge a framework by the answers your agent gives.
What happened
Two developers moved Vasco's agent from Google ADK to Mastra in a week and a half, in about 50 pull requests, and found Mastra good to work with. Six weeks later the team left Mastra and moved the agent to the Claude Agent SDK for better answers (Vasco Engineering, Jul 24, 2026).
- Public engineering write-up (staff developer's post)
- Team metric reported
Deployment details
Vasco's product agent, rebuilt across four agent frameworks between December 2024 and July 2026.
- Public engineering write-up (staff developer's post)
- Team metric reported
Team
Vasco, two developers
Duration
About six weeks on Mastra
Workload
Vasco's product agent
Measurement
About 50 pull requests over a week and a half to move onto Mastra
In SignalsCounted once, as the staff developer's own post. In the record

Switched to or from it1

Workday security teamBuilders of an autonomous triage systemWorkday
An autonomous agentic triage system run by Workday's security team.
Mastra customer story, published Sep 18, 2026Read the write-up (opens Mastra customer story in a new tab)
Observation
Workday's security team replaced Bedrock Agents with Mastra for its agentic triage system, removing 3,000 lines of code, Mastra's customer story says.
Takeaway
Ask for the before and after code and storage bills when a vendor story reports a migration, and test the move on one workflow first.
What happened
Mastra's customer story says Workday's security team moved its triage system from Bedrock Agents to Mastra as the orchestration layer in 31 days, removed 3,000 lines of code, and cut vector-storage costs by an estimated 98%.
“Workday's security team replaced Bedrock Agents with Mastra as its orchestration layer, removing 3,000 lines of code and cutting vector-storage costs by an estimated 98%.”
Mastra customer story, on Workday
- Vendor customer story (Mastra customer page)
- Team metrics reported
Deployment details
An autonomous agentic triage system run by Workday's security team.
- Vendor customer story (Mastra customer page)
- Team metrics reported
Team
Workday security team
Duration
31-day migration
Workload
Agentic security triage
Measurement
3,000 lines removed; vector-storage cost down an estimated 98%
In SignalsNot counted. Mastra published this story, so it counts toward no figure.

Adopted it7

ReplitSep 24, 2025Mastra customer storyThe agents Replit Agent 3 builds are Mastra agents, and durable execution on Inngest raised their workflow success rate from 80% to 96%, Mastra's customer story says.
Replit Agent 3 teamBuilders of Replit's agent-building agentReplit
Replit Agent 3, launched in September 2025, which generates agents and automations for Replit users.
Mastra customer story, published Sep 24, 2025Read the write-up (opens Mastra customer story in a new tab)
Observation
The agents Replit Agent 3 builds are Mastra agents, and durable execution on Inngest raised their workflow success rate from 80% to 96%, Mastra's customer story says.
Takeaway
Put durable execution under agents that run unattended, and measure success rate before and after, as Replit reports doing.
What happened
Mastra's customer story, citing Replit's CTO at Mastra's conference, says the agents Agent 3 generates run on Mastra, with thousands of agent sandboxes started each week. It says Mastra's durable execution with Inngest raised workflow success rates from 80% to 96%, so runs finish when a server fails mid-run.
“Using Mastra's durable execution with Inngest, Replit boosted success rates from 80% to 96%, ensuring workflows complete even if a servers fails mid-execution.”
Mastra customer story, on Replit
Vendor customer story (Mastra customer page)
Team metrics reported
Deployment details
Replit Agent 3, launched in September 2025, which generates agents and automations for Replit users.
Vendor customer story (Mastra customer page)
Team metrics reported
Team
Replit Agent 3
Duration
Since Agent 3's launch in September 2025
Workload
Agents and automations generated for Replit users
Product version
Mastra workflows on the Inngest runner
Measurement
Workflow success rate from 80% to 96%
In SignalsNot counted. Mastra published this story; Replit's own talk is not in GILD's records.
SoftBankAug 20, 2025Mastra customer storySoftBank's Satto Workspace team of 11 engineers built on Mastra and went from requirements to production in 1.5 months, Mastra's customer story says.
Satto Workspace team11 engineers building presentation generationSoftBank
Satto Workspace, SoftBank's platform that generates presentations and documents, in enterprise beta.
Mastra customer story, published Aug 20, 2025Read the write-up (opens Mastra customer story in a new tab)
Observation
SoftBank's Satto Workspace team of 11 engineers built on Mastra and went from requirements to production in 1.5 months, Mastra's customer story says.
Takeaway
Hold a vendor's time-to-production figure against your own first workflow, timed from requirements to a production run.
What happened
Mastra's customer story says an 11-engineer SoftBank team built Satto Workspace's agent workflows on Mastra, reached production 1.5 months after requirements, and cut presentation creation from hours to 1 to 2 minutes.
“Using Mastra, SoftBank's team went from requirements to production deployment in just 1.5 months.”
Mastra customer story, on SoftBank
Vendor customer story (Mastra customer page)
Team metrics reported
Deployment details
Satto Workspace, SoftBank's platform that generates presentations and documents, in enterprise beta.
Vendor customer story (Mastra customer page)
Team metrics reported
Team
SoftBank Satto Workspace, 11 engineers
Duration
1.5 months from requirements to production
Workload
Agent workflows that generate presentations
Measurement
Presentation creation from hours to 1 to 2 minutes
In SignalsNot counted. Mastra published this story, and SoftBank has published no account of its own.
BrexJan 17, 2026Latent SpaceBrex runs about half of its agent-layer applications on Mastra, which replaced the internal framework it built after LangChain fell short.
James ReggioCTOBrex
Brex's agent layer, built in TypeScript with pgvector and Pinecone as data stores.
Latent Space, published Jan 17, 2026Listen to the episode (opens Latent Space in a new tab)
Observation
Brex runs about half of its agent-layer applications on Mastra, which replaced the internal framework it built after LangChain fell short.
Takeaway
Mastra can replace an in-house single-agent and workflow framework; plan separately for multi-agent orchestration, which Brex kept on its own code.
What happened
Brex built its own LLM framework about three years earlier because LangChain lacked support it needed, then wanted to stop maintaining it. Mastra fit the features it was looking for, and about half of the agent-layer applications Brex was building ran on Mastra (Latent Space, Jan 17, 2026). The other half ran on a second internal framework built for networks of agents.
Podcast episode
Team metric reported
Deployment details
Brex's agent layer, built in TypeScript with pgvector and Pinecone as data stores.
Podcast episode
Team metric reported
Team
Brex engineering
Workload
Agent-layer applications at Brex
Measurement
About half of agent-layer applications on Mastra
In SignalsCounted once, as the CTO's own words on the podcast. In the record
FactorialAug 7, 2026Mastra customer storyFactorial runs One, its in-product agent built on Mastra, for all 17,000 customers across about 70 skills and 500 tools, Mastra's customer story says.
FactorialBuilders of the One agentFactorial
One, the agent inside Factorial's HR software, spanning more than 25 products.
Mastra customer story, published Aug 7, 2026Read the write-up (opens Mastra customer story in a new tab)
Observation
Factorial runs One, its in-product agent built on Mastra, for all 17,000 customers across about 70 skills and 500 tools, Mastra's customer story says.
Takeaway
A Mastra agent can carry hundreds of tools in production; ask how tool selection is tested at that count before you plan a similar catalog.
What happened
Mastra's customer story says One moved out of pilot and serves all 17,000 Factorial customers, running thousands of iterations a day across roughly 70 skills and 500 tools.
Vendor customer story (Mastra customer page)
Team metrics reported
Deployment details
One, the agent inside Factorial's HR software, spanning more than 25 products.
Vendor customer story (Mastra customer page)
Team metrics reported
Team
Factorial AI product team
Workload
In-product HR agent across more than 25 products
Measurement
17,000 customers; about 70 skills and 500 tools
In SignalsNot counted. Mastra published this story, and Factorial has published no account of its own.
BrainforgeSep 18, 2026Brainforge blogBrainforge runs its agents on Mastra and had to upgrade every Mastra package to move their traces to Langfuse v4.
Uttam KumaranFounder and CEOBrainforge
Brainforge's Mastra agents, traced in Langfuse through OpenTelemetry.
Brainforge blog, published Sep 18, 2026Read the write-up (opens Brainforge blog in a new tab)
Observation
Brainforge runs its agents on Mastra and had to upgrade every Mastra package to move their traces to Langfuse v4.
Takeaway
Budget a full Mastra upgrade when your tracing backend changes, since the exporters move with the core version.
What happened
To move its Mastra agent traces to Langfuse v4 before the cutover, Brainforge had to upgrade every @mastra package from core 1.8.0 to the 1.61 line, along with aligned OpenTelemetry packages. It finished the migration in August 2026 (Brainforge blog, Sep 18, 2026).
“Coexisting OTEL providers is the real fight. We run HyperDX and Langfuse in one process, and the two pull against each other on the global tracer provider and conflicting OpenTelemetry version lines.”
Brainforge
Public organization write-up (founder's post)
No team metrics reported
Deployment details
Brainforge's Mastra agents, traced in Langfuse through OpenTelemetry.
Public organization write-up (founder's post)
No team metrics reported
Team
Brainforge
Workload
Brainforge's Mastra agents with Langfuse tracing
Product version
@mastra/core 1.8.0 upgraded to the 1.61 line
In SignalsCounted once, as the founder's own post. In the record
SanityOct 20, 2026Sanity EngineeringSanity runs its Content Agent on Mastra and built its own harness for company-wide agents, because it wanted agents defined as Sanity documents and turns that outlive their process.
Even WestvangCo-author with Rostislav Melkumyan and Knut Melvaer, Sanity EngineeringSanity
Sanity's Content Agent, and @s, the company agent its staff call from Slack.
Sanity Engineering, published Oct 20, 2026Read the write-up (opens Sanity Engineering in a new tab)
Observation
Sanity runs its Content Agent on Mastra and built its own harness for company-wide agents, because it wanted agents defined as Sanity documents and turns that outlive their process.
Takeaway
Mastra fits an agent the product team ships in code; agents that non-engineers define as content, with turns that outlive a process, may need a harness of their own.
What happened
Sanity uses Mastra for its Content Agent (Sanity Engineering, Oct 20, 2026). For @s, its company-wide agent harness, it built its own: it wanted agents defined as Sanity documents with no git access, agent turns that outlive the process running them, and runs that stay durable while the codebase changes fast.
Public engineering write-up
No team metrics reported
Deployment details
Sanity's Content Agent, and @s, the company agent its staff call from Slack.
Public engineering write-up
No team metrics reported
Team
Sanity engineering
Workload
Sanity's Content Agent on Mastra; company agents on a custom harness
In SignalsCounted once, as Sanity's own engineering post. In the record
Neo4jOct 13, 2026GitHub, neo4j-graphacademyNeo4j GraphAcademy built its agent-memory workshop on Mastra, with Neo4j holding the context traces.
Neo4j GraphAcademyDeveloper education teamNeo4j
A three-hour GraphAcademy workshop on agent memory in TypeScript.
GitHub, neo4j-graphacademy, published Oct 13, 2026Read the write-up (opens GitHub, neo4j-graphacademy in a new tab)
Observation
Neo4j GraphAcademy built its agent-memory workshop on Mastra, with Neo4j holding the context traces.
Takeaway
Teams that keep agent memory in a graph can start from Neo4j's Mastra workshop to set up memory storage.
What happened
The workshop repository, created Oct 13, 2026, uses TypeScript on Node 22 or later with @mastra/core, @mastra/memory and libsql, and Neo4j in Docker or Aura for context traces. Learners build agents and memory on Mastra during the session.
Public organization write-up (workshop repository)
No team metrics reported
Deployment details
A three-hour GraphAcademy workshop on agent memory in TypeScript.
Public organization write-up (workshop repository)
No team metrics reported
Team
Neo4j GraphAcademy
Duration
A three-hour workshop
Workload
Teaching agent memory with Mastra and Neo4j
Product version
@mastra/core and @mastra/memory with libsql

Failures, incidents and rollbacks3

A single npm account published malicious versions of 141 @mastra packages on June 17, 2026, and Socket advises treating every host that installed one as compromised.

At Sudolabs, mastra build on a larger app ran out of memory after the 1.79.0 release.

Postiz's MCP service on @mastra/mcp grew about 330 MB an hour until it was killed twice a day, so Postiz moved the server to stateless mode.

Left it or turned it down1

Vasco moved its agent from Google ADK to Mastra, then left Mastra for the Claude Agent SDK six weeks later for better answers.

Switched to or from it1

Workday's security team replaced Bedrock Agents with Mastra for its agentic triage system, removing 3,000 lines of code, Mastra's customer story says.

Adopted it7

The agents Replit Agent 3 builds are Mastra agents, and durable execution on Inngest raised their workflow success rate from 80% to 96%, Mastra's customer story says.

SoftBank's Satto Workspace team of 11 engineers built on Mastra and went from requirements to production in 1.5 months, Mastra's customer story says.

Brex runs about half of its agent-layer applications on Mastra, which replaced the internal framework it built after LangChain fell short.

Factorial runs One, its in-product agent built on Mastra, for all 17,000 customers across about 70 skills and 500 tools, Mastra's customer story says.

Brainforge runs its agents on Mastra and had to upgrade every Mastra package to move their traces to Langfuse v4.

Sanity runs its Content Agent on Mastra and built its own harness for company-wide agents, because it wanted agents defined as Sanity documents and turns that outlive their process.

Neo4j GraphAcademy built its agent-memory workshop on Mastra, with Neo4j holding the context traces.