Composio gives AI agents authenticated access to roughly 1,500 third-party apps, handling OAuth, per-user credentials and execution, plus a Python sandbox for bulk work.
Used this tool? Rate it
Used this tool? Rate it
Composio is a hosted integration layer that gives AI agents authenticated access to third-party software, plus a sandbox in which those tool calls can be composed as code. It sits between the agent you run and the apps it must act on — Gmail, Slack, GitHub, Notion and roughly fifteen hundred others — taking over OAuth, token refresh, per-user credentials, schemas and execution.
The company behind it is Sampark Inc., which independent reporting placed at a $25 million Series A led by Lightspeed in July 2025, taking outside funding to about $29 million.
The size of that catalog needs settling first, because several numbers circulate. The toolkit catalog publishes a precise 1467 toolkits, the marketing homepage rounds to 1,500+ and the documentation entry page to 1,400+. That same July 2025 reporting described more than 3,000 connectable applications, a number no current vendor page repeats. Only the catalog listing can be counted directly, so treat it as the working figure.
What it deliberately omits is equally defining. Composio never proxies your model or runs the agent for you; it can call a model only inside the sandbox, and only when your own code asks. The model, prompt, orchestration loop and inference bill stay yours.
A session holds everything together: it binds one of your end users to a set of reachable toolkits, their authenticated accounts, and the execution state that survives between calls. You create one with a user identifier from your own database, so every tool runs against that user's connections, not a shared service account.
Sessions do not expire on their own, so a multi-turn assistant should keep the identifier and resume it instead of opening a fresh one per message. The sandbox filesystem, intermediate variables and connection state all live on the session, so discarding it discards the agent's working memory.
Rather than loading hundreds of tool schemas into the model context, a session hands the agent a small fixed set of meta tools that search, authenticate and execute at runtime. The agent asks for tools matching an intent, gets back the handful that fit, connects a missing account and executes — without carrying a catalog in every request.
Every toolkit is discoverable by default; narrowing takes an explicit enable list of toolkit slugs, or a disable list keeping broad access minus specific services.
Composio holds the OAuth applications for managed toolkits, so a user connects through a generated link and that connected account persists for later sessions without re-authentication. Bring-your-own OAuth is supported when you need your own branding, scopes or consent screen. Choosing direct execution means pinning a toolkit version yourself, a responsibility sessions absorb automatically.
The sandbox is a persistent Python environment where the agent writes and runs code with access to every Composio tool. Pandas, numpy, matplotlib, Pillow, PyTorch and reportlab are already present, and packages outside that set are installed on demand. Helper functions cover executing a Composio tool, calling an LLM, uploading a generated file, proxying a raw API request, web search and text extraction from PDFs or images.
The default sandbox is deliberately small at one vCPU and one gigabyte of memory, with medium, large and xlarge tiers reaching eight vCPU and eight gigabytes when a session is created.
Toolkits can subscribe to events in the connected application and push them to your agent, turning a request-response tool layer into something an event can wake up. Trigger deliveries are signed, and you are expected to verify that signature rather than trust the payload.
The shortest path to a working tool call is five lines: instantiate the client, create a session for a user, read its tools, hand the list to your agent framework. The agent loop is unchanged; the tools arrive pre-authenticated.
Two integration modes suit different products. Native tools go through a framework-matched provider package, giving typed objects in your own process. MCP needs no package: a session exposes an endpoint URL and headers any MCP-compatible client — Claude Desktop, Cursor, an agent runtime — points at. The first suits an application you build, the second a client you extend.
A third path predates sessions and stays supported. Direct execution has your code name the tool instead of letting the agent discover it, fitting deterministic scripts and scheduled jobs where runtime discovery is overhead rather than a feature.
Individual tool calls handle simple work. The sandbox earns its place on bulk operations, data transformation or multi-step logic — pulling fifty issues, classifying them with a model call and writing tickets back is one round trip, not a hundred through the model context. Large responses land in a browsable filesystem, not the prompt.
Anything the agent leaves in the sandbox is temporary: mounted files disappear after a day, and variables and runtime state may clear after roughly twelve hours of inactivity, so treat it as scratch space, not storage. The file-transfer methods also sit under an experimental namespace whose surface Composio warns may change.
Rate limiting applies to the organisation as a whole over a fixed one-minute window, and every authenticated endpoint draws from that single shared budget. Responses carry remaining-quota headers, and a breach returns 429 with a Retry-After value worth honouring rather than retrying blindly. Caching tool definitions client-side keeps static data off that budget.
Composio fits teams that already know what their agent should do and are blocked by integration work. If your product must act inside a customer's Gmail, Slack or CRM on that customer's behalf, the per-user OAuth problem is genuinely hard, and this is a reasonable place to stop solving it yourself.
It fits less well in two cases. If your agent touches two or three APIs you already hold credentials for, a managed layer adds a dependency, a bill and a rate ceiling for work you have mostly done. And if you wanted a hosted agent, this is not one.
Composio executes the toolkits and connections you configure and treats the choice of what an agent may touch as your responsibility, not a guardrail it supplies. An over-scoped grant to a promptable agent is a real exposure: the platform executes whatever the agent decides.
The documentation is blunt that using default as a user identifier in production exposes other users' data — worth checking in review before a first deployment.
No business software review platform seen for Composio published a reproducible sample size, so no aggregate score is quoted here. Independent coverage from established technology publications is funding reporting, not product testing.
There is no desktop or mobile application to install; Composio reaches your agent either as a library in your runtime or as an MCP endpoint your client connects to. A browser dashboard covers project settings, connected accounts and logs, but that is administration, not the product surface.
Provider packages exist for Anthropic, OpenAI, Google, the Vercel AI SDK, LangChain, CrewAI, LlamaIndex, Mastra, AutoGen and Pi. Python and TypeScript are both covered, though not every provider ships for both; writing your own is documented.
For direct HTTP the current REST version is v3.1; the preceding v3 stays supported with pinned tool-version defaults, so existing integrations need not migrate. A CLI and an installable agent plugin cover terminal work.
| Access route | What it needs | Best suited to |
|---|---|---|
| Provider package (Python / TypeScript) | Framework-matched package, API key | Agents you build and host yourself |
| MCP endpoint | An MCP-compatible client | Extending Claude Desktop, Cursor or similar |
| REST API v3.1 | HTTP client, API key | Languages without an official SDK |
| CLI | Terminal install | Local exploration and code generation |
Two self-serve plans sit alongside a quoted enterprise tier, and the model is an included monthly allowance followed by per-call metering, not a fixed bundle.
| Plan | Monthly price | Tool calls | Trigger events | Support |
|---|---|---|---|---|
| Free | $0 | 100K | 50K | Portal |
| Pro | $29 | 100K + $29 usage credit | 50K | Portal, email, Slack above $1K |
| Enterprise | Custom quote | Committed volume | Committed volume | Dedicated |
| Metered beyond allowance | — | $0.0003 each | $0.003 each | — |
Free adds 3 team members, unlimited connected accounts on your own OAuth application, and a hard cap: usage pauses at the limit with no charge until the next month or an upgrade, while Pro runs on overage with spend caps you set. The 1M monthly LLM tokens Composio runs for you meter at $3.75 per million.
One allowance repays a careful read: the 20K attached to Composio-managed shared apps is a sub-quota carved out of the 100K free tool calls, not an extra grant, and your own OAuth application releases the whole amount. Meta tools such as tool search are never billed, so only your own tool runs count.
This structure applies to signups from 15 August 2026; earlier customers stay on their previous plan through 31 December 2026, and a separate legacy page still publishes those older tiers. Premium tool calls become billable for everyone, earlier signups included, from 10 September 2026.
Premium tools are the line item to model first: they run on paid third-party providers, and Composio passes the provider's price through with a 5% platform fee and no further markup. A browser-automation task or a generated video costs orders of magnitude more than a $0.0003 tool call, so a research or media agent's bill follows that mix, not the call count. Add-ons layer on the base rate — sandbox execution, direct execution outside a session, proxy execution — each a fraction of a cent, most gated to Pro after a free allowance.
Governance is where the tiers diverge. Higher API rate limits, a KMS proxy and custom log retention sit on Enterprise only; an IP allowlist, a BAA and zero data retention are add-ons from Pro upward; log retention runs 7 days on Free against 30 on Pro. A hard data-residency or key-custody requirement pushes you into a quoted arrangement, whereas some competing integration layers publish self-hosted deployment as a standard tier.
Premium tools are the cost class that breaks naive budgeting: search APIs, code sandboxes, web scraping, hosted model inference, document OCR and compute-intensive transforms — much of what a research agent does all day. They carry their own lower ceilings too, separate from the organization-wide API budget: 1,000 premium calls an hour on Hobby against 10,000 on Pro. The general API limit is 2,000 requests a minute on Hobby and 10,000 on Pro, per organization, so a search-heavy agent meets the premium ceiling first.
Two official pages disagree on sandbox billing. The pricing page lists sandbox execution as a paid add-on at an extra $0.0001 per tool call after 10,000 free calls, while the sandbox documentation still states that sandboxes are not billed today and that metering by tier and runtime is planned. Treat heavy code execution as unsettled in cost until the pages agree.
A Fair Usage Policy sits above the published numbers, and excessive or abusive automated use can lead to suspension regardless of tier. The licence also rules out resale, derivative use of platform contents, and scraping the platform with automated extraction tools.
Payload storage is opt-out, not opt-in: request arguments and response data for every tool execution are recorded unless a project turns that off. Switching it off affects new calls only — stored payloads remain until they age out, and those never stored cannot be recovered.
Execution and trigger logs are held up to a year before automatic deletion, while the plan table caps log retention at 7 days on Free and 30 on Pro. Files passing through a tool call are staged behind a presigned link valid for one hour by default, extendable per project to twenty-four; the staged object is removed after a day.
Composio publishes a SOC 2 Type II attestation through its trust centre. Credentials, auth configurations and API keys are encrypted at rest with AES-256-GCM, connected-account tokens are redacted from API responses by default, and administrators can enforce multi-factor sign-in. You keep ownership of what you submit while granting a worldwide, sublicensable and transferable licence for Composio to use it in connection with the platform and its business. The terms also commit customers to co-marketing, including use of their name and logo.
Google user data is excluded from advertising, resale, and training or improving machine learning models. YouTube integration data carries a hard thirty-day ceiling, after which it is refreshed or permanently deleted. The policy lists rights to access your data, request corrections, request deletion, withdraw consent and receive a copy, but each is exercised by writing to the published support address rather than a dashboard control.
No. It handles tool discovery, authentication and execution while your model and orchestration loop stay in your runtime. The one exception is the optional sandbox helper that calls a model when your code asks it to.
The catalog page lists a countable 1467 toolkits. Other official pages round to 1,400+ or 1,500+, and a 2025 news report cited over 3,000, so trust the catalog listing.
100,000 tool calls, 50,000 trigger events and 3 team members a month, portal support, and unlimited connected accounts on your own OAuth application. It is hard-capped: at the limit usage pauses rather than billing you.
Search APIs, code execution sandboxes, web scraping, model inference, document OCR and compute-heavy transforms. They bill at the provider's rate plus a 5% platform fee instead of the flat per-call price, so a research agent's bill turns on this mix.
Yes, through a per-project log storage setting. It applies to new calls only: stored payloads remain until the retention window expires, and payloads skipped while it was off cannot be recovered.
Nothing on the current plan comparison offers one; the Enterprise tier publishes a KMS proxy for holding your own keys, but the service itself is cloud-only.
Sessions do not expire and should be reused across turns. Sandbox contents differ: mounted files are deleted after 24 hours and other runtime state may clear after about 12 hours of inactivity.
The API returns 429 Too Many Requests with a Retry-After header giving seconds until the window resets. Limits apply per organisation over a one-minute window across all authenticated endpoints, so tool execution and account management share a budget.
