GILD verdict
Choose Mastra when a TypeScript team wants agents, workflows, memory, and evals in one framework on models from several providers, with an optional hosted platform.
- The workflow
- A TypeScript product team building agents and multi-step workflows into its own Node.js app, deployed to its own host or Mastra Platform.1314
- The decisive evidence
- DocumentedAgents with tools and memory, workflows built with createWorkflow that suspend and resume, subagents, built-in and custom scorers, MCP client and server, and a local Studio at localhost:4111 ship in one framework.2458910
- DocumentedThe model router names 8,187 models from 221 providers as provider/model strings, with no default model; Mastra reads each provider's API key from the environment, and each customer of a multi-tenant app can bring their own API keys.1112
- DocumentedMastra Platform meters events, CPU hours, egress, and memory tokens against monthly allowances: Starter is free, Teams is US$250 a month, and gateway tokens bill at market rate plus 5.5%.16
- DocumentedTelemetry is on by default, sent to PostHog with GeoIP lookup on, and MASTRA_TELEMETRY_DISABLED=1 opts out. On June 17, 2026 a single npm account published malicious versions of 141 @mastra packages, by Socket's count.118
- GILD analysisNamed teams run Mastra in production at Brex, Sanity and Postiz, and Mastra's own stories add Replit, Factorial, SoftBank and Workday. Public accounts center their concerns on memory, recovery, and loop defects, then upgrades and supply chain. No independent source measures a production rollout end to end, so recovery behavior under your own load is unresolved until you test it.
Mastra
Agent Framework by Mastra
−36 NegativeFit and limits
Who it fits
- The team builds in TypeScript on Node.js 22.13 or later and wants agents, workflows, and memory in one framework.
- Agents should run on models from several providers through one provider/model string, with the team's own keys.
- Workflows need typed steps that suspend for human input and resume, on the built-in engine or Inngest.
- The organization wants an optional hosted platform with us or eu data residency, or a self-hosted Enterprise license that keeps traces in its VPC.
- Unattended runs must finish when a server fails: Mastra's customer story says durable execution on Inngest raised Replit Agent 3's workflow success rate from 80% to 96%, and a team on Reddit saw a paused document-analysis run survive a deploy in August 2026.
Where it falls short
- Python teams: Mastra is a TypeScript framework.
- Long agent loops left on defaults: maxSteps is 5, and builders report runs that end at the fifth step without an error.
- Production use of enterprise features without a contract: code under ee/ needs a written agreement and a license key.
- Budgets that need one fixed price at high volume: Platform usage beyond the included amounts bills per event, CPU hour, and gigabyte.
- Long-lived MCP servers left in session mode: Postiz's grew about 330 MB an hour and was killed at about 5 GB twice a day until it moved to stateless serving in July 2026.
- Teams that cannot vet every upgrade: a single npm account published malicious versions of 141 @mastra packages on Jun 17, 2026, by Socket's count, and Sudolabs' build ran out of memory after @mastra/deployer 1.79.0 on Oct 27, 2026.
Implementation reality
Pin packages and check provenance
Pin every @mastra package to one tested release and install with lockfiles. Check the versions against Socket's list for the June 17, 2026 compromise, since a single npm account published malicious versions of 141 @mastra packages in that window, and keep @mastra/core and its deployer on the same release line.
Choose models and keys
Name each agent's model as a provider/model string and set each provider's API key in the environment; Mastra raises a runtime error naming the missing variable. Configure fallbacks for a 500 error, rate limit, or timeout, and give multi-tenant customers their own keys.
Set step limits and memory
Raise maxSteps from its default of 5 when agents chain tools, and check finishReason so a capped run does not pass as success. Memory requires a storage provider; test Observational Memory's latency on your own threads before turning it on.
Decide telemetry and hosting
Set MASTRA_TELEMETRY_DISABLED=1 if usage events may not leave your systems. Mastra Platform runs in us or eu, fixed at creation; self-hosting puts servers, storage, and recovery on your team.
What to measure in your pilot
- How many observability events a typical agent run produces on Mastra Platform, which the pricing page does not state.
- The SOC 2 report type and date behind the Teams plan's SOC 2 docs.
- Whether the build-memory regression filed against @mastra/deployer 1.79.0 on October 27, 2026 closes in the next releases.
Sources
- Public source
- 1
- Official documentation
- 21
- Socket Research Team: 140+ Mastra npm Packages Compromised in Coordinated Supply Chain Attack (Jun 17, 2026)
- Mastra docs: Agents overview
- Mastra reference: Agent.generate() (maxSteps default 5)
- Mastra docs: Subagents
- Mastra docs: Workflows overview
- Mastra docs: Workflow runners (Inngest, Temporal)
- Mastra docs: Memory overview
- Mastra docs: Evals overview (scorers)
- Mastra docs: MCP (MCPClient and MCPServer)
- Mastra docs: Studio overview
- Mastra model router (8,187 models from 221 providers)
- Mastra docs: Installation (provider API keys)
- Mastra docs: Deployment overview (Node.js 22.13, Hono server, deployers)
- Mastra docs: Mastra Platform overview
- Mastra integrations: AI SDK UI (useChat, useCompletion, useObject)
- Mastra pricing (Platform Starter, Teams, Enterprise, and Self-Hosted)
- Mastra docs: Mastra Platform regions (us and eu residency zones)
- Mastra reference: CLI, including telemetry and MASTRA_TELEMETRY_DISABLED
- Mastra Enterprise Edition License 2.0 on GitHub (effective Sep 22, 2026)
- Mastra LICENSE.md on GitHub (Apache 2.0 outside ee/)
- Mastra terms of service (no training on customer data, updated Oct 26, 2026)
- Mastra releases on GitHub (@mastra/core 1.80.0, Oct 28, 2026)