Mastra

Recently shipped durable execution for the Agents API, caller-driven experiments, in-process Code Mode via V8 and QuickJS, and richer sandbox deployment tooling.

Durable execution and observability across the stack. Stored agents created via the Agents API now run with durable: true — no redeploy needed, inheriting cache/pubsub for multi-replica durability. TokenCostControl (renamed from CostGuard) adds per-request maxCost functions, warnAtPercent, and user/org/session cost scopes. Agent.listActiveThreadRuns() and the controller equivalent expose in-flight run introspection, while external-parent traces now correctly surface as trace roots in Studio.

Code Mode runs entirely in-process. New transports remove the workspace sandbox requirement: @mastra/isolated-vm executes model-authored programs in a V8 isolate with no filesystem/network/process access (requires isolated-vm native addon and --no-node-snapshot), and @mastra/quickjs uses a QuickJS WASM runtime requiring neither. A first-party webSearchTool resolves to provider-native search when supported.

Dynamic workflows gained persistence and management APIs. Workflows author as data and round-trip through JSON via declarative step types, toStorableGraph(), and rehydrateWorkflow(). Stored workflows are now manageable over HTTP (POST/GET/DELETE /stored/workflows) with a new StoredWorkflow client resource, plus a structural predicate DSL for storage-safe conditionals and loops.

Sandbox deployments and fleets matured. A new @mastra/cloudflare-sandbox provider runs commands via a deployed Sandbox Bridge Worker. Sandboxes advertise checkpoint support and gain networking.getPortUrl, bulk writeFiles(), and clone() for template-based fleets, with read-only working directories on macOS and Linux.

New execution features and safety nets. Dataset experiment APIs enable caller-driven experiment loops with server-side or externally submitted results. Messages sent while an agent is active are automatically marked delivery: 'while-active'. Generated servers gained configurable graceful-shutdown draining. @mastra/mcp adds opt-in stateless 2026-07-28 protocol support. New @mastra/oracledb provides Oracle-backed stores and vectors.

Also this period: processToolResult guardrails for prompt-injection scanning, transient signals for per-turn context, Mongo hybrid retrieval, file-based schedules, chat channels for Slack/Discord/Telegram, stored-agent auto-publish, and a @mastra/deepeval exporter.