Mastra

You will like this if the app is Next.js and you do not want a Python service beside it. The daily trait is the local loop: npm create mastra@latest scaffolds a project, and a Studio at localhost:4111 lets you talk to the agent, run the workflow and inspect the tools in a browser while you edit. Agents and workflows drop into React, Node or a standalone server, and the scaffold asks which of four vendors to start with.

Where it hurts is that everything beyond the framework, observability, hosting, evals at scale, pulls you toward the company's platform. Pick it for a product team in TypeScript. Pick LangGraph for Python.

The risk is the folder named ee. The repository is dual-licensed by directory, and the example the README gives of an enterprise directory is packages/core/src/auth/ee/. Authentication is not an add-on; it is what stands between a demo and a deployment, and the code for it may be used freely for development and testing but needs a licence in production. Teams discover this when they cannot avoid it.

The consequence: read LICENSE.md's mapping before the first commit, and decide whether your auth lives in the framework or beside it. What it does right: the repository runs CodeQL scanning in CI and publishes a security contact, which is unglamorous and rare.

Two execution models are documented, and the distinction is principled. 1. Agents: the model chooses tools and iterates internally until it emits a final answer or an optional stopping condition is met. 2. Workflows: a graph of then, branch and parallel steps with typed control flow, when sequence must be explicit. 3. Suspend and resume: execution state is written to storage so a paused run resumes later. 4. Memory: conversation history plus an Observational Memory layer.

Verification is offered as evals, whose methodology the README does not describe. No benchmark is published. The observation: shipping both a loop and a graph is an admission that neither is enough alone.

The badge says Y Combinator W25, and the pricing page says how money arrives: a Teams tier at $250 a month, a gateway that resells tokens at market rate plus 5.5%, a $100 a month charge per project for a server that does not sleep, and metered memory and storage beneath. That is a platform business wrapped around a free framework, with a course as the top of the funnel.

Moat: TypeScript, where Python frameworks do not compete, and the Vercel AI SDK integration. Pricing power: the 5.5% is the tell; it can rise. Likely acquirer: Vercel, whose front end it sits inside. Position: long, with a Vercel hedge.

The demo is an agent in a Next.js page. As a dependency it costs sixty engineers nothing and runs in whatever CI already runs Node. The platform is where procurement starts reading: the Starter tier keeps 100K observability events for fifteen days, SSO and SOC 2 documentation arrive at the Teams tier with six months of retention, and RBAC, audit logs and uptime SLAs are in Enterprise at custom pricing. Support on that tier is 8 to 5 Pacific, Monday to Friday, poor for a team in Europe.

Onboarding for a TypeScript engineer is a day. Approved with conditions: the framework now, the platform after a retention and residency review.

Apache-2.0 on the core, and the MCP story goes both directions: npm install @mastra/mcp gives me MCPClient to pull tools from any server and MCPServer to expose my agents, tools and workflows to any client that speaks the protocol. The model router covers forty-plus providers through one interface, so swapping vendors is a string. Deploy targets are Node, Next.js or a standalone server, which means my own box.

The grudge I brought does not survive: a local model is a custom provider id and a base URL, so LM Studio on my box sits beside the cloud vendors. A TypeScript monorepo is forkable, though nothing is missing to add.