Mastra

license

Apache-2.0(OSI, everything outside `ee/`)

source

public

core-gated

gated

Open-core in the LangGraph/LlamaIndex shape rather than the n8n one - the framework itself is a real OSI license, not fair-code. LICENSE.md scopes the commercial carve-out narrowly to `ee/` auth directories, so the agent, workflow, memory and eval surfaces a user actually builds on are Apache-2.0. Not 5 because the enterprise auth code is source-available and the managed platform is closed.

• https://github.com/mastra-ai/mastra/blob/main/LICENSE.md recorded 2026-07-30

  LICENSE.md: "All content that resides under any directory named 'ee/' within this repository" - listing packages/core/src/auth/ee/ and packages/server/src/server/auth/ee/ - "is licensed under the license defined in ee/LICENSE", while everything "not mentioned" in those directories or restrictions "is available under the 'Apache License 2.0'". This preamble ahead of the Apache text is why GitHub's classifier reports NOASSERTION for the repo.

• https://registry.npmjs.org/@mastra/core recorded 2026-07-30

  Registry metadata declares `license: Apache-2.0`, latest 1.55.0 (was 1.54.0 on 2026-07-29), confirming the framework ships to consumers under the OSI license rather than only being licensed that way in-repo. Cited previously as the npmjs.com package page, which answers 403 to any non-browser fetch behind a Cloudflare interstitial; the registry endpoint serves the same fact and can actually be re-checked.

• https://mastra.ai/ recorded 2026-07-30

  Site FAQ states "Mastra's core framework is open source under the Apache 2.0 license. Enterprise features are source-available under the Mastra Enterprise License", and describes Mastra Cloud as the hosted commercial tier you can "deploy the same app to" after running it locally - so the published framework is what self-hosts.

@mastra/core at 4,931,561 downloads in the last month, which places it in the 1-10M band. Deliberately NOT summed with the `mastra` package (2,151,411/mo): npm counts increment for transitively fetched dependencies, and `mastra` pulls @mastra/core through @mastra/deployer, so adding them double-counts the same installs. @mastra/core is the package everything resolves to and is the better single proxy. The band is the same either way. Raw download volume includes CI and mirror traffic, so this is install volume rather than a user count.

• https://api.npmjs.org/downloads/point/last-month/@mastra/core recorded 2026-07-29

  npm registry download API returns 4,931,561 downloads for @mastra/core over the trailing month

• https://github.com/mastra-ai/mastra recorded 2026-07-29

  26,669 stars, 2,523 forks and 100 contributors, last pushed 2026-07-29 - corroborating activity, not the adoption basis

Feature coverage comparable to LangChain and Pydantic-AI (both 4) - agents with tools, graph workflows with explicit control flow, memory with semantic recall, model routing across 90+ providers, evals, tracing and human-in-the-loop. Not 5 like LangGraph or LlamaIndex, which have deeper ecosystems and longer track records. Confidence is medium rather than high because no first-party SWE-bench or GAIA result exists for the framework itself, so this is a feature-matrix judgment rather than a measurement.

• https://mastra.ai/ recorded 2026-07-29

  documents agents, graph-based workflows with control flow, memory with semantic recall, model routing across 90+ providers, built-in evals and tracing, and human-in-the-loop