Mastra

license

Apache-2.0(OSI, everything outside `ee/`)

source

public

core-gated

gated

Open-core in the LangGraph/LlamaIndex shape rather than the n8n one - the framework itself is a real OSI license, not fair-code. LICENSE.md scopes the commercial carve-out narrowly to `ee/` auth directories, so the agent, workflow, memory and eval surfaces a user actually builds on are Apache-2.0. Not 5 because the enterprise auth code is source-available and the managed platform is closed.

• https://github.com/mastra-ai/mastra/blob/main/LICENSE.md recorded 2026-07-30

  LICENSE.md: "All content that resides under any directory named 'ee/' within this repository" - listing packages/core/src/auth/ee/ and packages/server/src/server/auth/ee/ - "is licensed under the license defined in ee/LICENSE", while everything "not mentioned" in those directories or restrictions "is available under the 'Apache License 2.0'". This preamble ahead of the Apache text is why GitHub's classifier reports NOASSERTION for the repo.

• https://registry.npmjs.org/@mastra/core recorded 2026-07-30

  Registry metadata declares `license: Apache-2.0`, latest 1.55.0 (was 1.54.0 on 2026-07-29), confirming the framework ships to consumers under the OSI license rather than only being licensed that way in-repo. Cited previously as the npmjs.com package page, which answers 403 to any non-browser fetch behind a Cloudflare interstitial; the registry endpoint serves the same fact and can actually be re-checked.

• https://mastra.ai/ recorded 2026-07-30

  Site FAQ states "Mastra's core framework is open source under the Apache 2.0 license. Enterprise features are source-available under the Mastra Enterprise License", and describes Mastra Cloud as the hosted commercial tier you can "deploy the same app to" after running it locally - so the published framework is what self-hosts.