Composio

What it is

Composio is the authentication and tool-calling layer that sits underneath an agent, not the agent itself. You point it at more than 1,000 integrations — Gmail, Slack, GitHub, Notion, HubSpot, Salesforce, Linear — and it handles the OAuth dance, token storage, token refresh, and sandboxed execution so your agent code never touches a credential. It ships Python and TypeScript SDKs with framework packages for Anthropic, OpenAI, the Vercel AI SDK and the OpenAI Agents SDK, a REST API at v3.1, and a hosted MCP endpoint through Sessions that Claude Desktop and Cursor connect to directly.

The company raised a $25M Series A led by Lightspeed, $29M total including a $4M seed, and ran 71 employees as of 31 May 2026. It carries SOC 2 and ISO 27001:2022, and publishes Glean, Zoom, AWS, Google, Wix and ClickFunnels among its customer logos.

The problem it actually removes

Building agent tool access yourself means registering an OAuth client per vendor, storing refresh tokens, handling per-provider expiry semantics, and writing a tool schema the model can call — then repeating that for every app. Provider auth changes on the provider’s schedule, not yours, so it stays a maintenance line forever.

Composio collapses that to a connect call. Sessions authenticate the end user at runtime instead of requiring pre-configured auth configs, and tools are selected by intent rather than wired up one at a time. For a team shipping an internal agent that writes to five or more SaaS systems, this is the fastest path to a working tool call in the segment: Arcade.dev, the nearest architectural competitor, carries roughly 80 first-party MCP servers against Composio’s catalogue of about 1,000.

Pricing reality

New pricing applies to signups on or after 15 August 2026:

• Free — 100K tool calls/mo, 50K trigger events/mo, unlimited connected accounts, 3 team members, 7-day log retention. It hard-caps: usage pauses at the ceiling and you are never charged.
• Pro — $29/mo including a monthly usage credit, then $0.0003 per tool call and $0.003 per trigger event. Unlimited team members, 30-day log retention, read-only dashboard role. Add-ons: IP allowlist, BAA at $0.0003/call, zero data retention at $0.0001/call.
• Enterprise — custom, on committed volume. This is the tier that carries the KMS proxy, SSO/SCIM, higher API rate limits and an MSA/DPA/SLA.

The real band: prototyping is free, a production agent at 500K calls/mo lands near $150/mo, and 2M calls/mo near $600/mo. Per call that is $0.0003 against Arcade.dev’s $0.01 after its 2,000 included executions — a 33x gap — and against Zapier MCP’s plan-included rate of roughly $0.069, since each Zapier MCP call burns 2 tasks and the $69/mo Team plan carries 2,000. Composio is the cheapest per authenticated tool call in this segment by two orders of magnitude, and that is the strongest reason to buy it.

Trigger events are the cost trap, not tool calls. They meter at 10x the tool-call rate, and a polling trigger on a busy inbox bills whether or not your agent acts on the event.

Best for

The AI-platform engineer or ops-engineering lead building an internal agent that needs authenticated write access across five or more SaaS apps, on a timeline where an OAuth service per vendor is not fundable. The scoped case where it wins outright: a RevOps or Customer Success team shipping an agent that reads Slack and Linear and writes to HubSpot or Salesforce at high call volume.

Not for

Anything where the answer to “who holds the refresh token” has to be “we do,” on a Free or Pro budget — credential custody through the KMS proxy sits on Enterprise. If a legal-ops team is connecting a contract repository, or a recruiting team an ATS holding candidate PII, and the security review requires customer-managed keys, the self-serve tiers do not answer that question. Buy Enterprise or self-host something else. It is also the wrong layer for a non-engineer: this is an SDK and an API, not a canvas.

Versus the alternatives

• Zapier MCP — the largest install base in the category by a wide margin, at 9,000+ apps, included on every Zapier plan including Free. Pick it when your organization already pays for Zapier, the agent’s volume stays under about 1,000 tool calls a month, and the person wiring it up is an ops generalist rather than an engineer. It stops making sense the moment volume scales, because task-based billing is roughly 230x Composio’s per-call rate.
• Arcade.dev — the fastest-growing entrant in the segment and the structural answer to Composio’s central weakness. Its model is per-user OAuth at call time with per-action permission intersection, so the token in play belongs to the end user making the request rather than to one platform key. Pick it when the audit requirement is “prove which human authorized this write,” or when a single compromised platform credential is an unacceptable blast radius. You pay for that in catalogue breadth and in price.
• n8n — pick it when data residency or a security review forbids a third party holding your tokens at all. Self-hosting moves credential custody back to your own infrastructure; you take on the auth maintenance Composio was bought to remove.

If none fit, the honest fallback is writing direct API clients for the three apps that actually matter and skipping the layer entirely. Below roughly five integrations, a gateway is overhead.

Watch-outs

• Composio holds your OAuth tokens, and that store has been breached. On 21 May 2026 the company disclosed an incident in which attackers exfiltrated approximately 5,241 API keys and 5,001 GitHub OAuth tokens, along with smaller counts of Jira, Slack, HubSpot, Linear, Notion, Google Calendar and 12 Gmail tokens. The initial vector was a compromised Gmail OAuth token belonging to a Composio employee, which gave the attacker inbox access, and from there the ability to intercept magic-link sign-in emails and reach production systems holding customer secrets. GitHub tokens were revoked as a precaution. Guard: register your own OAuth client per provider rather than using Composio’s shared developer app, so revocation is yours to execute and not a support ticket; scope every connection to the narrowest permission the agent needs and keep write scopes on GitHub, Salesforce and any contract or PII repository off the Free and Pro tiers entirely; put write-capable connections behind the Enterprise KMS proxy; and write the rotation runbook before launch, not after the next disclosure.
• Log retention is shorter than the window you need to investigate one. 7 days on Free, 30 days on Pro. A credential incident is routinely found weeks after the fact — this one reached production through an employee inbox before anyone noticed. Guard: export Composio logs to your own SIEM or object storage on a daily job from day one, and treat the in-product log view as a debugging convenience, not an audit record.
• The Free tier pauses at the cap instead of billing you. The right default for a credit card, the wrong one for a production agent, which stops mid-run at 100K tool calls with no overage to absorb a spike. Guard: never run production on Free — move to Pro and set an explicit spend cap, so the failure mode is a bounded bill rather than a silent outage.
• Existing customers are on borrowed pricing. Accounts predating 15 August 2026 stay on their prior plan through 31 December 2026. Guard: re-model your bill against the current per-call and per-trigger rates now and budget the delta into next year, rather than meeting it in January.