Mastra
TypeScript framework for AI agents from the Gatsby team with workflows, RAG, evals and human-in-the-loop primitives.
Delv Safety Grade: B
Score 72/100 · assessed 2026-04-18
Mastra is a TypeScript framework for building AI agents, developed by the team behind Gatsby. The project shows professional development practices with active GitHub presence, comprehensive documentation, and standard npm distribution. The maintainer score reflects a credible team with proven track record, though the project itself is relatively new (launched 2024). Permission scope is moderate: as an agent framework, it enables filesystem access, network calls, and external LLM integration depending on how developers configure their agents. Supply chain is solid via npm with TypeScript typing. Transparency is strong with open source code, detailed docs, and active issue tracking. No security incidents recorded. The framework's flexibility means actual risk depends heavily on how developers implement their agents and what integrations they enable.
Green flags
- Developed by experienced Gatsby team with strong engineering reputation
- Fully open source with comprehensive documentation and examples
- Standard npm distribution with TypeScript support and type safety
- Active GitHub with regular commits and responsive issue management
- Includes evaluation and safety primitives (evals, human-in-the-loop)
Red flags
- Agent framework enables arbitrary code execution based on developer config
- Relatively new project (2024) with limited production track record
- Broad permission surface area when fully configured with integrations
- Human-in-the-loop primitives suggest potential for sensitive data handling
Permissions requested
Pricing
Platforms
Review
Best for TypeScript teams building agents into existing Next.js apps, especially when you need human approval gates. Skip it if you need battle-tested orchestration or prefer Python tooling.
Good at
- Workflows as code with clean TypeScript APIs, no YAML or visual builders
- Human-in-the-loop primitives that actually pause and resume execution
- Built-in evals framework catches regressions when you change prompts
- RAG primitives that do not lock you into a specific vector database
- Next.js integration works out of the box, feels native
Watch out
- Single-threaded orchestration, long workflows block other tasks
- No built-in retry logic for API failures, you implement it yourself
- Cloud offering is underbaked compared to self-hosted
- Steep learning curve if you are not fluent in TypeScript
- Smaller ecosystem than Python alternatives like LangGraph
Use cases
- TypeScript agents
- Next.js integration
- workflows