
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
@mastra/core
Advanced tools
Affected versions:
Mastra is a framework for building AI-powered applications and agents with a modern TypeScript stack.
It includes everything you need to go from early prototypes to production-ready applications. Mastra integrates with frontend and backend frameworks like React, Next.js, and Node, or you can deploy it anywhere as a standalone server. It's the easiest way to build, tune, and scale reliable AI products.
@mastra/core is an essential building block for a Mastra application. We recommend following the installation guide to get started with Mastra.
You can install the package like so:
npm install @mastra/core
Mastra (/mastra): Central orchestration class that initializes and coordinates all Mastra components. Provides dependency injection for agents, workflows, tools,
memory, storage, and other services through a unified configuration interface. Learn more about Mastra
Agents (/agent): Autonomous AI entities that understand instructions, use tools, and complete tasks. Encapsulate LLM interactions with conversation history, tool
execution, memory integration, and behavioral guidelines. Learn more about Agents
Workflows (/workflows): Graph-based execution engine for chaining, branching, and parallelizing LLM calls. Orchestrates complex AI tasks with state management,
error recovery, and conditional logic. Learn more about Workflows
Tools (/tools): Functions that agents can invoke to interact with external systems. Each tool has a schema and description enabling AI to understand and use them
effectively. Supports custom tools, toolsets, and runtime context. Learn more about Tools
Memory (/memory): Thread-based conversation persistence with semantic recall and working memory capabilities. Stores conversation history, retrieves contextually
relevant information, and maintains agent state across interactions. Learn more about Memory
MCP (/mcp): Model Context Protocol integration enabling external tool sources. Supports SSE, HTTP, and Hono-based MCP servers with automatic tool conversion and
registration. Learn more about MCP
Observability: Type-safe observability system tracking AI operations through spans. Provides flexible tracing with event-driven exports, configurable sampling, and pluggable processors and exporters for real-time monitoring. Full observability features are available in the @mastra/observability package. Learn more about Observability
Storage (/storage): Pluggable storage layer with standardized interfaces for multiple backends. Supports PostgreSQL, LibSQL, MongoDB, and other databases for
persisting agent data, memory, and workflow state. Learn more about Storage
Vector (/vector): Vector operations and embedding management for semantic search. Provides unified interface for vector stores with filtering capabilities and
similarity search. Learn more about Vector
Server (/server): HTTP server implementation built on Hono with OpenAPI support. Provides custom API routes, middleware, authentication, and runtime context for
deploying Mastra as a standalone service. Learn more about Server
Voice (/voice): Voice interaction capabilities with text-to-speech and speech-to-text integration. Supports multiple voice providers and real-time voice
communication for agents. Learn more about Voice
Browser (/browser): Base classes and utilities for browser automation. Provides the MastraBrowser abstract class, thread management, and screencast streaming
for building browser providers. Use with @mastra/agent-browser or @mastra/stagehand for complete browser automation. Learn more about Browser
This package uses a dual-license model:
ee/ (e.g., @mastra/core/auth/ee) is source-available under the Mastra Enterprise License. These features require a valid enterprise license for production use but can be freely used for development and testing.See LICENSE.md for the full license mapping and ee/LICENSE for the enterprise license terms.
FAQs
Unknown package
The npm package @mastra/core receives a total of 868,633 weekly downloads. As such, @mastra/core popularity was classified as popular.
We found that @mastra/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.