Mastra

license

Apache-2.0(OSI, everything outside `ee/`)

source

public

core-gated

gated(RBAC, SSO and FGA live in ee/-scoped directories under the Mastra Enterprise License and are switched on at runtime by MASTRA_LICENSE_KEY, validated against the Mastra license server)

Open core, but in the LangGraph and LlamaIndex shape rather than the n8n one: the framework itself carries a real OSI license, not fair-code. LICENSE.md scopes the commercial carve-out narrowly to the ee/ auth directories, so the agent, workflow, memory and eval surfaces a user actually builds on are Apache-2.0. The gate is a named mechanism: ee/LICENSE is a separate Enterprise Edition license forbidding production use without a written agreement with Kepler Software, and packages/_internals/auth/src/ee/license.ts disables the EE features unless MASTRA_LICENSE_KEY validates against the Mastra license server, which returns entitlements for RBAC, SSO and FGA. So functionality is withheld from the published source by a license key rather than merely sold beside it, which is why this is not full open source. The managed Mastra Cloud is separate and is not what decides it.

• https://github.com/mastra-ai/mastra/blob/main/LICENSE.md recorded 2026-07-30

  LICENSE.md: "All content that resides under any directory named 'ee/' within this repository" - listing packages/core/src/auth/ee/ and packages/server/src/server/auth/ee/ - "is licensed under the license defined in ee/LICENSE", while everything "not mentioned" in those directories or restrictions "is available under the 'Apache License 2.0'". This preamble ahead of the Apache text is why GitHub's classifier reports NOASSERTION for the repo.

• https://registry.npmjs.org/@mastra/core recorded 2026-08-12

  Registry metadata declares `license: Apache-2.0`, latest 1.57.0, confirming the framework still ships to consumers under the OSI license rather than only being licensed that way in-repo. The npmjs.com package page answers 403 to any non-browser fetch behind a Cloudflare interstitial; this registry endpoint serves the same fact and stays fetchable.

• https://mastra.ai/ recorded 2026-07-30

  Site FAQ states "Mastra's core framework is open source under the Apache 2.0 license. Enterprise features are source-available under the Mastra Enterprise License", and describes Mastra Cloud as the hosted commercial tier you can "deploy the same app to" after running it locally - so the published framework is what self-hosts.

• https://api.github.com/repos/mastra-ai/mastra/git/trees/main?recursive=1 recorded 2026-08-12

  Full untruncated recursive tree, 16,790 entries. A top-level ee/LICENSE sits beside the root LICENSE.md, and the ee/-named source lives at packages/_internals/auth/src/ee/ (capabilities.ts, fga-check.ts, license.ts, defaults/rbac/) re-exported through packages/core/src/auth/ee/ and packages/editor/src/ee/.

• https://raw.githubusercontent.com/mastra-ai/mastra/main/ee/LICENSE recorded 2026-08-12

  "Mastra Enterprise Edition (EE) License". The Software "may only be used in production if you (and any entity that you represent) have entered into, and remain in compliance with, a written agreement with Kepler Software, Inc. explicitly permitting the use of the Software in production", and it is otherwise "forbidden to copy, merge, publish, distribute, sublicense, and/or sell the Software".

• https://raw.githubusercontent.com/mastra-ai/mastra/main/packages/_internals/auth/src/ee/license.ts recorded 2026-08-12

  "License validation for EE features." Validation is a POST to {MASTRA_LICENSE_URL}/validate; "No license key configured -> EE features disabled"; "Server says invalid/revoked/expired -> EE features disabled". The success payload carries "Feature entitlements granted by the license (e.g. rbac, sso, fga)" and a planTier of teams or enterprise. MASTRA_LICENSE_KEY is the primary env var, MASTRA_EE_LICENSE a legacy alias.

The npm download API returns 5,264,387 downloads for @mastra/core over the trailing month, which places it in the 1-10M band. Deliberately not summed with the mastra package (2,151,411 a month): npm counts increment for transitively fetched dependencies, and mastra pulls @mastra/core through @mastra/deployer, so adding them would double-count the same installs. @mastra/core is the package everything resolves to and is the better single proxy, and the band is the same either way. Raw download volume includes CI and mirror traffic, so this is install volume rather than a user count.

• https://api.npmjs.org/downloads/point/last-month/@mastra/core recorded 2026-08-13

  npm registry download API returns 5,264,387 downloads for @mastra/core over the trailing month, 2026-07-11 to 2026-08-09

• https://github.com/mastra-ai/mastra recorded 2026-08-13

  27.2k stars and 2.6k forks - corroborating activity, not the adoption basis

Feature coverage comparable to LangChain and Pydantic-AI (both 4) - agents with tools, graph workflows with explicit control flow, memory with semantic recall, model routing across 90+ providers, evals, tracing and human-in-the-loop. Not 5 like LangGraph or LlamaIndex, which have deeper ecosystems and longer track records. Confidence is medium rather than high because no first-party SWE-bench or GAIA result exists for the framework itself, so this is a feature-matrix judgment rather than a measurement.

• https://mastra.ai/ recorded 2026-08-13

  agents and workflows in the open source framework, with Observability, Studio and Agent Builder listed as separate platform products; memory, model routing, evals and tracing; no benchmark figure