
Security News
Feross on TBPN: How North Korea Hijacked Axios
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.
mastracode
Advanced tools
A terminal-based coding agent TUI built with [Mastra](https://mastra.ai) and [pi-tui](https://github.com/badlogic/pi-mono).
A terminal-based coding agent TUI built with Mastra and pi-tui.
Install mastracode globally with your package manager of choice.
npm install -g mastracode
If you prefer not to install packages globally, you can use npx:
npx mastracode
On first launch, an interactive onboarding wizard guides you through:
You can re-run setup anytime with /setup.
fd for file autocompleteThe @ file autocomplete feature uses fd, a fast file finder that respects .gitignore. Without it, @ autocomplete silently does nothing.
Install with your package manager:
# macOS
brew install fd
# Ubuntu/Debian
sudo apt install fd-find
# Arch
sudo pacman -S fd
On Ubuntu/Debian the binary is called fdfind — mastracode detects both fd and fdfind automatically.
Type your message and press Enter. If the agent is already working, Enter queues your next message and sends it after the current run finishes.
@ file referencesType @ followed by a partial filename to fuzzy-search project files and reference them in your message. This requires fd to be installed (see Prerequisites).
@setup — fuzzy-matches files like setup.ts, setup.py, etc.@src/tui — scoped search within a directory@"path with spaces" — quoted form for paths containing spacesSelect a suggestion with arrow keys and press Tab to insert it.
| Command | Description |
|---|---|
/new | Start a new conversation thread |
/threads | List and switch between threads with freshness-checked cached lazy previews |
/models | Switch/manage model packs (built-in/custom) |
/custom-providers | Manage custom OpenAI-compatible providers/models |
/mode | Switch agent mode |
/subagents | Configure subagent model defaults |
/om | Configure Observational Memory models |
/think | Set thinking level (Anthropic) |
/skills | List available skills |
/diff | Show modified files or git diff |
/name | Rename current thread |
/cost | Show token usage and estimated costs |
/review | Review a GitHub pull request |
/hooks | Show/reload configured hooks |
/mcp | Show/reload MCP server connections |
/sandbox | Manage allowed paths (add/remove dirs) |
/permissions | View/manage tool approval permissions |
/settings | General settings (notifications, YOLO, etc.) |
/yolo | Toggle YOLO mode (auto-approve all tools) |
/resource | Show/switch resource ID (tag for sharing) |
/thread:tag-dir | Tag current thread with this directory |
/login | Authenticate with OAuth providers |
/logout | Log out from a provider |
/setup | Re-run the interactive setup wizard |
/help | Show available commands |
/exit | Exit the TUI |
| Shortcut | Action |
|---|---|
Ctrl+C | Interrupt current operation or clear input |
Ctrl+C ×2 | Exit (double-tap) |
Ctrl+D | Exit (when editor is empty) |
Ctrl+Z | Suspend process (fg to resume) |
Alt+Z | Undo last clear |
Ctrl+T | Toggle thinking blocks visibility |
Ctrl+E | Expand/collapse all tool outputs |
Enter | Send a message, or queue a follow-up while the agent is running |
Ctrl+Y | Toggle YOLO mode |
Threads are automatically scoped to your project based on:
This means conversations are shared across clones, worktrees, and SSH/HTTPS URLs of the same repository.
The SQLite database is stored in your system's application data directory:
~/Library/Application Support/mastracode/~/.local/share/mastracode/%APPDATA%/mastracode/For Anthropic models, mastracode supports two authentication methods:
/login to authenticate with a Claude Pro/Max subscription.ANTHROPIC_API_KEY environment variable for direct API access. This is used when not logged in via OAuth.When both are available, Claude Max OAuth takes priority.
For other providers (OpenAI, Google, etc.), set the corresponding environment variable (e.g., OPENAI_API_KEY, GOOGLE_GENERATIVE_AI_API_KEY) or use OAuth where supported.
Credentials are stored alongside the database in auth.json.
Use /custom-providers to manage OpenAI-compatible providers with:
nameurlapiKeyOnce saved, provider models appear in existing selectors like /models and /subagents and can be selected like built-in models.
Custom providers are stored in settings.json in the same app data directory. If you save an API key, it is stored locally in plaintext, so use a machine/user profile you trust.
On macOS, Mastra Code starts the built-in caffeinate utility while the agent is actively running, then stops it as soon as the run completes, errors, aborts, or the TUI exits. Idle sessions do not keep your machine awake.
To disable this behavior, set MASTRACODE_DISABLE_CAFFEINATE=1 before launching Mastra Code:
export MASTRACODE_DISABLE_CAFFEINATE=1
When you approve a plan (via submit_plan), it is saved as a markdown file in the app data directory:
~/Library/Application Support/mastracode/plans/<resourceId>/~/.local/share/mastracode/plans/<resourceId>/%APPDATA%/mastracode/plans/<resourceId>/Files are named <timestamp>-<slugified-title>.md and contain the plan title, approval timestamp, and full plan body.
To save plans to a project-local directory instead, set the MASTRA_PLANS_DIR environment variable:
export MASTRA_PLANS_DIR=.mastracode/plans
┌─────────────────────────────────────────────────────────────┐
│ TUI │
│ (pi-tui components: Editor, Markdown, Loader, etc.) │
└─────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────┐
│ Harness │
│ - Mode management (plan, build, review) │
│ - Thread/message persistence │
│ - Event system for TUI updates │
│ - State management with Zod schemas │
└─────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────┐
│ Mastra Agent │
│ - Dynamic model selection │
│ - Tool execution (view, edit, bash) │
│ - Memory integration │
└─────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────┐
│ LibSQL Storage │
│ - Thread persistence │
│ - Message history │
│ - Token usage tracking │
└─────────────────────────────────────────────────────────────┘
# Run in development mode (with watch)
pnpm dev
# Type check
pnpm typecheck
# Build
pnpm build
Apache-2.0
FAQs
A terminal-based coding agent TUI built with [Mastra](https://mastra.ai) and [pi-tui](https://github.com/badlogic/pi-mono).
We found that mastracode demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.

Security News
OpenSSF has issued a high-severity advisory warning open source developers of an active Slack-based campaign using impersonation to deliver malware.

Research
/Security News
Malicious packages published to npm, PyPI, Go Modules, crates.io, and Packagist impersonate developer tooling to fetch staged malware, steal credentials and wallets, and enable remote access.