Composio

Composio sits between an agent and the apps it needs to act in. A session-based SDK (Python/TypeScript), a public REST API (v3.1, documented at docs.composio.dev/reference), and MCP endpoints all expose the same catalog: 1,607 toolkits as of 12 October 2026, grouped into categories like CRM, dev tools, and productivity, with a combined 20,000+ individual tools. It handles OAuth connection and token refresh so the calling application never has to store credentials, and execution runs in a sandboxed workbench rather than directly in the caller's process. It's framework-agnostic: native provider packages exist for OpenAI, Anthropic, LangChain, CrewAI, LlamaIndex and others, and any MCP-compatible client (Claude, ChatGPT, Cursor) can connect without one.

Plans as of October 2026: Hobby is $0/month, no card required, with 100,000 tool calls and 50,000 trigger events included and up to 3 team members. Pro is $29/month, keeps the same free allowance, adds unlimited team members and a monthly usage credit, and bills overage at $0.0003 per tool call. Enterprise is custom-priced and adds SSO/SCIM, a BAA, MSA/DPA, and dedicated support. Composio-managed shared OAuth apps (vs. your own API keys) draw against a smaller free allowance — 20,000 of the 100,000 calls — before billing separately at $0.0005/call. A newer "Instant Tools" option (launched 8 October 2026) lets an agent pay per call for 100+ third-party APIs through Composio's own provider accounts, which Composio says it passes through at 0% markup over the provider's own rate — a vendor claim we could not independently verify.

Composio states it is SOC 2 Type II compliant and ISO 27001:2022 certified, with reports available through a Vanta-hosted trust center at trust.composio.dev; credentials are claimed to be encrypted at rest (AES-256-GCM) and in transit. Separately, in May 2026 Composio disclosed that an attacker chained access through an internal agentic monitoring tool into its tool-execution sandbox and obtained code execution, exposing roughly 0.3% of active connections (5,001 GitHub OAuth connections were the bulk of it) and potentially 5,241 API keys via an auxiliary cache. Composio published the incident, the IOCs, and a mandatory key-rotation deadline in real time, and by its August 2026 security whitepaper reported all critical and high findings from an AppSecure assessment of its web app, APIs and both SDKs remediated and re-verified, plus a separate AWS/GitHub review by Latacora and incident response by IntrusionOps. Since then, the API no longer returns raw connected-account tokens, credential encryption moved to an independently-rotated envelope scheme, and internal services moved off static secrets to OIDC. This is a real, serious incident with a genuinely thorough public response — both things a buyer handling OAuth scopes through Composio should weigh.

The core platform (github.com/ComposioHQ/composio) is MIT-licensed and actively maintained, with commits and releases landing day to day and no archive notice. Self-hosting is a real, documented option via a Helm chart for Kubernetes (covered in Composio's own knowledge base), positioned for enterprise customers who want the credential proxy and data in their own infrastructure rather than Composio's cloud.

Composio raised a $25M Series A, announced 22 July 2025; the same post's headline cites $29M in total funding, implying an earlier, undisclosed round on top of the Series A. No later funding announcement has been published on the company blog as of this check.