01
Overview
Mastra Factory can run locally for development and can be deployed either through Mastra Platform or on infrastructure you control. The open-source template makes it possible to inspect and own the application instead of relying only on a closed hosted coding-agent product.
02
1. Start from the official Factory template
Mastra's official quick start uses npm create factory. The generated project contains the Factory UI and API in one application. The public template also documents a normal package-install and development flow.
Before connecting production repositories, start locally. This lets you inspect the generated application, confirm the model configuration, and understand what permissions each integration will receive.
03
2. Install dependencies and run locally
The official template documents a standard Node/npm workflow. After creating or cloning the Factory project, install its dependencies and start the local development server. The template currently serves the Factory UI and API from the same local server.
The template can run in an auth-less local mode with local storage and agents before external integrations are configured. That is useful for exploration, but it should not be confused with a production security model.
04
3. Configure a model provider
Factory's agents require access to a supported model provider. Mastra's template says model-provider keys can be added in the Factory Settings interface. Treat those keys like production secrets: do not commit them to a public repository, and scope them to the minimum environment that needs them.
Model costs are separate from Mastra Platform pricing. The amount you spend depends on the model, task complexity, context size, retries and how aggressively stages are automated.
05
4. Connect GitHub and optional Linear
For real software work, connect the repository that Factory should inspect and modify. Mastra documents GitHub as the primary code source and Linear as an optional work-intake source. Start with a test repository or a low-risk project rather than granting broad access to every repository in an organization.
Use the narrowest practical permissions. A coding agent that can read code, write branches and open pull requests does not automatically need permission to change organization settings, billing or unrelated repositories.
06
5. Define the workflow stages
Factory is designed around configurable lifecycle stages. Mastra's own workflow uses Intake, Triage, Planning, Build, Review and Done. You can keep those stages or adapt them to your process.
For an initial deployment, leave important transitions under human control. A conservative configuration is: automatic intake, agent-assisted triage, human plan approval, agent build in a sandbox, automated checks, and human merge review.
07
6. Test with a bounded issue
Use a small, verifiable issue first: update a dependency, add a test, fix a contained bug or change a documented UI behavior. A good first task has a clear acceptance condition and a test suite that can tell you whether the agent's change works.
Inspect the agent session, generated plan, changed files, test output and pull request. The point of the pilot is not just to see whether Factory can produce code, but whether its staged workflow is understandable and controllable by your team.
08
7. Choose hosted or self-hosted deployment
Mastra Platform provides the simplest hosted path. Mastra currently lists a free Starter tier and paid Teams/Enterprise tiers with different observability, CPU-hour and retention allowances.
Mastra also says Factory can be hosted on your own infrastructure. Self-hosting is useful when you need more control over network boundaries, data residency, internal services or deployment architecture. It also makes you responsible for authentication, secrets, database/storage, patching, monitoring and access controls.
09
8. Secure production access
Before using Factory on important repositories, review four boundaries: repository permissions, model-provider credentials, sandbox capabilities and deployment secrets. Do not assume 'sandboxed' means harmless. Agents can still cause damage if the sandbox has powerful credentials or unrestricted production access.
Keep merges human-reviewed until you have strong tests and enough operational evidence to justify more automation. Log important actions and retain enough observability to reconstruct what an agent changed and why.
10
Common setup mistakes
The biggest mistake is connecting a high-value repository before validating the workflow. Another is treating the free platform tier as a guarantee of zero operating cost; external model usage can still create charges. A third is granting broad organization-level credentials when repository-scoped access would be sufficient.
11
Can Mastra Factory run entirely locally?
The template supports local development and an auth-less local mode. A fully production-ready self-hosted deployment still requires you to configure the surrounding infrastructure and security appropriate to your environment.
12
Is self-hosting officially supported?
Mastra's Factory product page states that you can host Factory on your own infrastructure. The exact production architecture is up to the operator.
13
What should you automate first?
Start with bounded, well-tested engineering tasks. Increase autonomy only after the team has observed how Factory behaves on its own codebase and has reliable review and rollback paths.
Mastra Factory's open-source architecture is attractive precisely because you can inspect and adapt it. The tradeoff is that owning the deployment also means owning its security and operating model.
Sources
Primary and supporting sources
Facts were rechecked against the linked sources immediately before publication. Pricing, product availability and rollout status can change.