A Mastra agent that works in mastra dev needs five decisions before users reach it. Pin and verify every @mastra package, set step limits and retries on purpose, and test what happens when a run crashes mid-step. Then settle memory, telemetry, and where the agents run.
When you need this
- A Mastra prototype is moving from mastra dev to a service other people's requests reach.
- Agents call tools that send messages, roll back deployments, or change records in other systems.
- The team must decide between Mastra Platform and running Mastra on its own host.
Evaluation criteria
Package pinning and provenance
Which @mastra versions does production install, and were they checked?
Look forPin every @mastra package and install from a lockfile. In June 2026 a single npm account published malicious versions of 141 @mastra packages, by Socket's count, and one team's dependency bot pulled them within minutes; Socket advises treating any host or CI runner that installed one as compromised. Review pinned AI SDK copies in the tree too, since one issue flagged a vulnerable provider-utils pin.
Step limits and retries
What ends a run, and does the caller notice?
Look formaxSteps defaults to 5, and a capped run can return empty text with finishReason tool-calls and no error. Raise the limit on purpose and check finishReason. One builder measured stacked retry layers turning one failing upstream into 18 requests.
Tool idempotency
What happens when a tool runs twice?
Look forGive every tool with side effects an idempotency key. Builders report repetitive tool calls up to the step limit, and an on-call agent whose rollback fired twice after a restart reran an interrupted step.
Crash recovery
What survives a process restart mid-run?
Look forKill a worker during a durable run and confirm it resumes. Issues report EventedAgent recovery crashing after a restart and output processors skipped on the Inngest engine. Mastra labels its Temporal runner experimental.
Memory sizing
What does memory cost per turn?
Look forMemory requires a storage provider. Measure Observational Memory on your own threads: one issue reports 2 to 4 seconds added per step, another a turn blocked about 4 minutes when the observer failed, and another workflow events of about 1.76 MB copied into Redis.
Builds and bundles
Does the build fit the host after each upgrade?
Look forTrack bundle size and build memory in CI. Builders hit Cloudflare Workers startup limits, Vercel's 250 MB function limit, and a build that ran out of memory after @mastra/deployer 1.79.0.
Telemetry and data
What leaves your systems by default?
Look forMastra collects telemetry by default, including a token-usage event per provider and model every 15 minutes; set MASTRA_TELEMETRY_DISABLED=1 if it may not leave. The terms say customer inputs and outputs are not used to train models.
Hosting and governance
Where do agents run, and who can change them?
Look forMastra Platform runs in us or eu, fixed at creation, and meters events and CPU hours beyond monthly allowances. SSO starts on Teams and RBAC and audit logs on Enterprise. Confirm a config change replaces the running instance, since one team saw an old instance serve traffic for 3+ days.
Questions to ask vendors
- Which @mastra versions are pinned, and were they checked against the June 2026 advisory?
- What maxSteps does each agent use, and does the caller check finishReason?
- Which tools have side effects, and does each carry an idempotency key?
- Has a durable run been killed mid-step and resumed in testing?
- Is telemetry set on purpose, and which plan covers SSO and audit logs?
Red flags
- Unpinned @mastra packages installed by a dependency bot without review.
- Agents on the default maxSteps with no check on finishReason.
- Rollback, payment, or email tools with no idempotency key.
- Observational Memory turned on without a latency test.
- A production plan that assumes Starter's allowances without counting events per run.
Products in this piece
Sources
- Official documentation
- 10
- Public source
- 15
- Mastra reference: Agent.generate() (maxSteps default 5)
- Mastra docs: Workflows overview
- Mastra docs: Workflow runners (Inngest, Temporal)
- Mastra docs: Memory overview
- Mastra docs: Deployment overview (Node.js 22.13, Hono server, deployers)
- Mastra reference: CLI, including telemetry and MASTRA_TELEMETRY_DISABLED
- Mastra terms of service (no training on customer data, updated Oct 26, 2026)
- Mastra pricing (Platform Starter, Teams, Enterprise, and Self-Hosted)
- Mastra docs: Mastra Platform regions (us and eu residency zones)
- Mastra docs: Mastra Platform server (idle and Persistent Server)
- Socket Research Team: 140+ Mastra npm Packages Compromised in Coordinated Supply Chain Attack (Jun 17, 2026)
- Mastra issue #18048: @mastra/core 1.42.1 and related versions publish a malicious typosquat (Jun 17, 2026)
- Mastra issue #22592: drop or patch the AI SDK v5 provider-utils pin, CVE-2026-8769 (Aug 29, 2026)
- Aman Kumar on dev.to: Using Mastra agents with a custom OpenAI-compatible API, the silent 5-step limit (Oct 18, 2026)
- Mastra issue #6827: agent makes repetitive tool calls up to the default maxSteps (Aug 19, 2025)
- DevOps Daily on dev.to: We Built an On-Call Agent in Mastra, Where It Won and Where It Would Not (Aug 12, 2026)
- Mastra issue #22636: EventedAgent recover() crashes after a process restart (Aug 30, 2026)
- Mastra issue #23815: durable agents never run output processors on Inngest (Sep 13, 2026)
- Mastra issue #15677: Observational Memory adds 2 to 4 seconds per agent step (Apr 23, 2026)
- Mastra issue #21849: an Observational Memory observer failure blocks a turn for about 4 minutes (Aug 19, 2026)
- Mastra issue #20646: CachingPubSub mirrors multi-MB workflow events into Redis (Aug 3, 2026)
- Mastra issue #3309: bundle size regression blocks Cloudflare Workers deployments (Mar 28, 2025)
- Mastra issue #7348: Vercel function exceeds the 250 MB unzipped limit (Sep 3, 2025)
- Mastra issue #28645: mastra build needs about 13 times more memory since @mastra/deployer 1.79.0 (Oct 27, 2026)
- Mastra issue #22704: a Mastra Platform env-var update left the old instance serving traffic for 3+ days (Aug 31, 2026)