Mastra Ships Per-User, Per-Resource Authorization for Agents, Workflows, Tools, Memory and MCP Servers

Mastra changelog·medium signalXBlueskyLinkedInCopy link

Mastra, the Apache 2.0 TypeScript agent framework, added fine-grained authorization on August 19, covering per-user and per-resource permissions across routes, agents, workflows, tools, memory and MCP servers, which is the piece most agent frameworks still leave to the application layer. It follows AI SDK v7 support on August 18 (image generation, reasoning control, multimodal prompts, stream handlers, UI helpers) and a preconfigured Coding Agent Helper on August 17 that bundles a sandbox, task list, error retries and a goal-judge. Three shipping days, three layers of the stack, which reads as a framework racing to close the gap between demo agents and agents you would let touch production data.