
Security News
OpenCode User Hit with Hostile Backlash After Reporting Free AI Loophole
An OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.
@mastra/core
Advanced tools
Affected versions:
Mastra is a framework for building AI-powered applications and agents with a modern TypeScript stack.
It includes everything you need to go from early prototypes to production-ready applications. Mastra integrates with frontend and backend frameworks like React, Next.js, and Node, or you can deploy it anywhere as a standalone server. It's the easiest way to build, tune, and scale reliable AI products.
@mastra/core is an essential building block for a Mastra application. We recommend following the installation guide to get started with Mastra.
You can install the package like so:
npm install @mastra/core
Mastra (/mastra): Central orchestration class that initializes and coordinates all Mastra components. Provides dependency injection for agents, workflows, tools,
memory, storage, and other services through a unified configuration interface. Learn more about Mastra
Agents (/agent): Autonomous AI entities that understand instructions, use tools, and complete tasks. Encapsulate LLM interactions with conversation history, tool
execution, memory integration, and behavioral guidelines. Learn more about Agents
Workflows (/workflows): Graph-based execution engine for chaining, branching, and parallelizing LLM calls. Orchestrates complex AI tasks with state management,
error recovery, and conditional logic. Learn more about Workflows
Tools (/tools): Functions that agents can invoke to interact with external systems. Each tool has a schema and description enabling AI to understand and use them
effectively. Supports custom tools, toolsets, and runtime context. Learn more about Tools
Memory (/memory): Thread-based conversation persistence with semantic recall and working memory capabilities. Stores conversation history, retrieves contextually
relevant information, and maintains agent state across interactions. Learn more about Memory
MCP (/mcp): Model Context Protocol integration enabling external tool sources. Supports SSE, HTTP, and Hono-based MCP servers with automatic tool conversion and
registration. Learn more about MCP
Observability: Type-safe observability system tracking AI operations through spans. Provides flexible tracing with event-driven exports, configurable sampling, and pluggable processors and exporters for real-time monitoring. Full observability features are available in the @mastra/observability package. Learn more about Observability
Storage (/storage): Pluggable storage layer with standardized interfaces for multiple backends. Supports PostgreSQL, LibSQL, MongoDB, and other databases for
persisting agent data, memory, and workflow state. Learn more about Storage
Vector (/vector): Vector operations and embedding management for semantic search. Provides unified interface for vector stores with filtering capabilities and
similarity search. Learn more about Vector
Server (/server): HTTP server implementation built on Hono with OpenAPI support. Provides custom API routes, middleware, authentication, and runtime context for
deploying Mastra as a standalone service. Learn more about Server
Voice (/voice): Voice interaction capabilities with text-to-speech and speech-to-text integration. Supports multiple voice providers and real-time voice
communication for agents. Learn more about Voice
Browser (/browser): Base classes and utilities for browser automation. Provides the MastraBrowser abstract class, thread management, and screencast streaming
for building browser providers. Use with @mastra/agent-browser or @mastra/stagehand for complete browser automation. Learn more about Browser
This package uses a dual-license model:
ee/ (e.g., @mastra/core/auth/ee) is source-available under the Mastra Enterprise License. These features require a valid enterprise license for production use but can be freely used for development and testing.See LICENSE.md for the full license mapping and ee/LICENSE for the enterprise license terms.
A framework for building applications with language models, tools, retrieval, and chains. It has a broad integration ecosystem and similar agent-building capabilities; Mastra emphasizes a TypeScript-native application framework with agents and workflows as core building blocks.
The TypeScript package for LlamaIndex, focused especially on data ingestion, indexing, retrieval, and RAG, as well as agents. It overlaps with Mastra on agent and retrieval use cases, while its central strength is building applications around data.
Vercel's AI SDK provides TypeScript APIs for working with language models, streaming, and tool calling. It is a lower-level model integration toolkit compared with Mastra's broader agent and workflow framework.
FAQs
Unknown package
The npm package @mastra/core receives a total of 2,478,802 weekly downloads. As such, @mastra/core popularity was classified as popular.
We found that @mastra/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.

Security News
An OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.

Threat Research
/Security News
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.

Threat Research
Malicious Firefox extensions mimic Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys, with one fetching its payload remotely.