LangGraph vs CrewAI vs Mastra: three philosophies for production agents

Pick a philosophy, not a feature list

Three frameworks, one job description, three incompatible theories of how agents should be built. LangGraph says agents are state machines: make every node and transition explicit, and debugging becomes graph inspection. CrewAI says agents are colleagues: describe roles and goals, and let a crew delegate work among itself. Mastra says agents are ordinary TypeScript: ship workflows, memory, evals, and MCP in one package so the agent lives in the same repo as the product.

The theory you buy determines your debugging experience, your licensing exposure, and — the part all three landing pages skip — how much production infrastructure you still owe after the framework has done its job. Every load-bearing claim below links to a primary source. Figures are as of July 5, 2026.

LangGraph: the graph is the contract

LangGraph, from LangChain Inc., is deliberately low-level. You define a graph of nodes and edges over a typed state object, and the framework does not abstract your prompts or your architecture. That explicitness is the product. Control flow that would be implicit prompt-glue elsewhere becomes a visible transition you can inspect, checkpoint, and replay. Durability is checkpointer-based: graph state snapshots persist per thread, enabling resume-after-failure and time travel. The in-memory saver does not survive restarts; production means wiring a Postgres or SQLite checkpointer and pruning checkpoints as they accumulate. Human-in-the-loop rides the same machinery: first-class interrupts let a graph pause for review or approval for days against persistent state, and LangChain 1.0 added HITL middleware alongside summarization and PII-redaction middleware.

The second thing you buy is observability gravity. LangSmith traces LangGraph natively, but also OpenAI SDK, Anthropic SDK, and Vercel AI SDK code, with OpenTelemetry in and out — dashboards for tokens, latency percentiles, and cost, plus LLM-as-judge evals. Plenty of teams adopt LangSmith without LangGraph. Adopting LangGraph without LangSmith is possible, but you are swimming against the current the vendor has built.

Maturity signals are strong. Version 1.0 shipped October 22, 2025 with a commitment to no breaking changes until 2.0; the repo shows 36.5k stars and an active release cadence as of July 2026; and LangChain says LangGraph has been “powering agents at companies like Uber, LinkedIn, and Klarna for more than a year” — the vendor’s claim, but a specific and dated one. Both LangSmith and the deployment platform hold SOC 2 Type II.

Now the part developers keep missing. The framework — the thing on GitHub — is MIT-licensed. The production server that turns your graph into a running service — langgraph-api, the Agent Server handling HTTP, persistence, task queues, and streaming — is Elastic License 2.0, not MIT. Running it self-hosted in production requires a commercial license key, typically tied to an Enterprise plan, and self-hosted installs must allow egress to beacon.langchain.com for license verification and usage reporting. “LangGraph is open source” is true of the library and false of the official serving stack. Teams that want a fully open stack write their own serving layer around the MIT framework — real work: queues, persistence, streaming, an API surface.

Managed pricing has already changed shape once. At platform GA the framing was free up to 100k node executions per month; the July 2026 page bills deployments at $0.005 per run plus uptime charges of $0.0036 per minute for production deployments, with traces at $2.50 per 1,000 (14-day retention) and Plus seats at $39/month. The platform itself was renamed LangSmith Deployment in October 2025. Custom SSO and RBAC are Enterprise-gated — Plus gets Google/GitHub login and organization-level User/Admin roles only. And the abstraction carries a long-running tax: a 1,000-point HN thread argues the LangChain family makes it harder to see what is happening at each step, and even a sympathetic comparison notes that built-in parallelism can complicate debugging considerably. LangGraph is the choice when your control flow genuinely is a graph. For a linear pipeline, it is scaffolding you will resent.

CrewAI: roles first, structure later

CrewAI’s bet is that multi-agent systems should read like org charts. You declare agents with roles, goals, and backstories; group them into Crews that delegate tasks among themselves; and — since the framework matured — wrap that autonomy inside Flows: event-driven workflows wired with decorators (@start, @listen, @router) over typed state. The official guidance now inverts the early marketing: start with a deterministic Flow, and delegate only the genuinely open-ended parts to a Crew. Flows also carry the persistence story — a @persist decorator snapshots state to SQLite by default, and failed runs can be resumed or forked by state UUID.

Nothing in this comparison gets a multi-agent demo running faster, and the adoption numbers reflect it: 54.9k GitHub stars as of July 2026 — the largest of the three — an MIT license covering the entire framework, OSS 1.0 GA since October 20, 2025 with built-in free tracing, and a large training funnel (100,000+ certified developers, by CrewAI’s own count).

Traction is where attribution matters. CrewAI publishes striking figures — “60% of the Fortune 500 running Crews & Flows” and 1.4B+ executions at 1.0 GA, then roughly 2 billion executions in the trailing twelve months as of January 2026, naming customers including PepsiCo, PwC, and the US Department of Defense. These are vendor-published numbers, not independently audited. Independent signal is thin: three verified reviews on G2. Neither fact invalidates the other; hold both.

The commercial platform, CrewAI AMP (relaunched October 2025), deploys crews from GitHub or a no-code Studio behind generated REST endpoints, and adds two-layer RBAC, audit logs, and a webhook-based HITL system with a management platform for responder assignment, SLAs, and escalation on the Enterprise tier. Note the officially documented footgun: webhook configuration is not carried across pause/resume — the resume call must re-send the same webhook URLs used at kickoff. The platform self-hosts on customer Kubernetes via an official Helm chart — a paid enterprise product, not open source — and CrewAI operates a SOC 2 Type 2 certified security program.

Pricing is where CrewAI asks for the most trust. As of July 2026 the public pricing page lists exactly two tiers: a free Basic plan at 50 workflow executions per month, and custom-priced Enterprise. Everything between is behind a sales conversation. Third-party documentation from August 2025 recorded tiers ranging from $99/month to $120,000/year, but those figures are historical and unofficial. If AMP is on your shortlist, get numbers in writing before it enters the roadmap.

The abstraction’s cost is control. Production reports describe the framework turning “rigid and opaque” — no clear view of what prompts actually hit the LLM; that criticism largely predates 1.0’s built-in tracing, but it names the structural risk of role-based autonomy: when the crew misbehaves, the fix is prompt archaeology, not a stack trace. One practitioner post-mortem found the harder problem upstream — real-world tasks resist being scoped precisely enough for crews to succeed. And MCP support, though native across three transports, integrates tools only — not MCP prompts or resources.

Mastra: batteries included, in TypeScript

Mastra — built by the Gatsby.js founders, a Y Combinator W25 company — is the only TypeScript-first entrant here, and the only one shipping the whole kit in one box: code-first workflows with Zod-typed steps, branching, and parallelism; a memory system including observational memory, where background agents compress raw history into a dense observation log; LLM-as-judge scorers for evals; and MCP in both directions — a client consuming MCP tools, resources, prompts, and elicitation, and a server exposing your agents and workflows to Cursor or Claude Desktop. A model router fronts 600+ models across 40+ providers behind a single string, no provider SDKs installed.

Human-in-the-loop is a suspend/resume primitive: a workflow run returns a suspended status with a payload, and its snapshot — completed step outputs, execution path, retry state — persists to storage, surviving deployments and restarts. What the open-source framework does not ship is the surface around that primitive: no approvals inbox, no RBAC, no audit log. The review UI is yours to build. Deeper durability is similarly external: for memoized, retried, long-running background execution, Mastra’s own docs point production users to Inngest and mark the @mastra/temporal package experimental and not ready for production as of July 2026.

The licensing story runs opposite to LangGraph’s. Mastra launched under Elastic License v2 and relicensed to Apache 2.0 in July 2025 after friction with developers at larger organizations — the entire framework is now permissive, with a separate Enterprise license confined to ee/ directories in the repo. Version 1.0 went stable on January 20, 2026 — with genuine breaking changes and a codemod, so pre-1.0 tutorials are widely stale — and the announcement names Replit, PayPal, Sanity, and Marsh McLennan as production users: vendor-named, but concrete companies rather than anonymous percentages. Adoption figures conflict and should be read as a range: 300k+ weekly npm downloads self-reported at the 1.0 launch, versus roughly 918k weekly reported by The Hacker News in June 2026.

The managed Mastra Platform (April 2026) — Studio, Server, and a hosted Memory Gateway — is usage-metered rather than per-run: Starter is $0 with 100K observability events and 24 CPU-hours included; Teams is $250/team/month with SSO and six-month retention; RBAC and audit logs arrive only at custom-priced Enterprise. On compliance, be precise: the Teams tier lists access to “SOC 2 documentation” — Mastra does not advertise a SOC 2 Type II certification the way LangChain and CrewAI do. And the framework’s opinions bite off the happy path: commenters on the 1.0 launch described productivity dropping when their pattern didn’t fit, and clunky branching for non-LLM logic; the co-founder acknowledged users need better ways to eject and adapt.

The supply-chain interlude

On June 17, 2026, 145 npm packages in the @mastra/* namespace were compromised during an 88-minute window. Attackers hijacked a former contributor’s account — publish access that had never been revoked — and injected a trojanized dayjs clone that installed a crypto-stealing RAT via a postinstall script. Microsoft attributed the operation to North Korea’s Sapphire Sleet. Mastra unpublished the malicious versions and removed the token-based permissions that had bypassed MFA.

State that plainly, then generalize, because the lesson is not Mastra-specific. LangChain disclosed three CVEs in March 2026 — including a CVSS 9.3 deserialization flaw that leaked API keys and a SQL injection in LangGraph’s SQLite checkpointer — all patched. Agent frameworks occupy the most privileged position in your stack: they hold model keys, execute tools, and touch production data, and they ship as fast-moving package trees with long tails of maintainers. Whichever one you pick: pin exact versions, audit postinstall scripts, and subscribe to the advisories. Mastra’s exposure window was 88 minutes. The next incident, in any of these ecosystems, may run longer.

Side by side

Facts in this table are as of July 5, 2026 and link to primary sources; pricing in this category has already changed shape at least once per vendor, so re-verify before contracting.

What all three hand back to you

Notice what the table lacks: rows for deployment and governance, because in all three columns the answer is “yours.” Pick LangGraph and decline the Enterprise contract, and you are writing the serving layer — queues, persistence, streaming — yourself. Pick CrewAI’s open-source framework, and the approvals platform, RBAC, and audit logs live behind the unlisted-price tier. Pick Mastra, and you own the approvals UI, the auth model, and the durability runner. In every case, secrets handling for tool-calling agents, egress control, spend ceilings, and an audit trail a compliance team would accept are your backlog, not the framework’s. That is not a criticism — they are frameworks; this is the deal. But it belongs in the estimate, and it rarely appears there.

Where Brahmalabs fits

Full disclosure: that gap is the premise of our product, so read this paragraph as the vendor talking. Brahmalabs is a managed platform rather than a framework. Runs execute as Temporal workflows, so a workflow that started yesterday can finish today and approval waits burn no compute; human approval is a node type with multi-party consensus, SLA timeouts, and escalation chains, landing in a reviewer inbox while the run parks durably; each agent step executes in an isolated container behind a domain allowlist enforced by a DNS-and-firewall sidecar, with the domains actually contacted shown on the run page; credentials stay in a vault and agents receive short-lived scoped references, never raw keys; and an append-only audit log spans eight event categories. The candor owed in return: it is a young product in early access — no public case studies, SOC 2 Type II in progress rather than certified, and no self-hosted option. If you want a framework you own and operate, the three above are the right list. If you want the operations layer to be someone else’s problem, that is the trade we sell.

Pick by team shape

• Python team with genuinely graph-shaped control flow, or an existing LangChain investment. LangGraph. You get the most explicit state model and the deepest observability ecosystem of the three. Go in clear-eyed about the Elastic-licensed serving layer, and budget LangSmith trace volume as a real line item.
• Team still validating whether multi-agent decomposition helps at all. CrewAI. Nothing produces a role-based prototype faster, and MIT means the experiment costs only time. Before AMP enters the roadmap, get paid pricing in writing — the public page will not tell you.
• TypeScript product team embedding agents in an existing app. Mastra. One language, one repo, workflows, memory, and evals included, Apache-2.0. Pin your versions, and plan for Inngest — or a runner of your own — the day a workflow must survive more than a redeploy.
• Organization where self-hosting everything under a permissive license is non-negotiable. CrewAI’s framework or Mastra. LangGraph’s framework qualifies too; its official serving stack does not.
• Team whose real bottleneck is operating and governing agents, not building them. Compare the managed arms — LangSmith Deployment, CrewAI AMP, Mastra Platform — on which governance surfaces (approvals, egress, audit, spend) each actually ships rather than documents.

If that last bullet describes you, Brahmalabs is in early access, and running one real workflow through it is the quickest way to learn whether the trade suits your team.