Your agent can decide to send the follow-up email, open the bug, or update the CRM. What it can't do — not without a week of your time per integration — is actually reach into Gmail, GitHub, or Salesforce and do it. Each of those means registering an OAuth app, storing and refreshing a token per user, mapping the API's shape onto a tool schema, and owning the whole thing when the provider rotates a scope. Do that across a dozen apps and you've built an integrations company by accident. Composio is the layer that hands your agent those actions already built and already authenticated, behind one SDK.

If your agent only reads data you already hold, you don't need this. The moment it should act — send, post, create, update — across apps you don't own, you need managed tool-calling with managed auth. That's the whole product.

What it is: pre-built toolkits, per-user auth#

Composio exposes 1,000+ toolkits across 500+ apps — Gmail, Slack, GitHub, Notion, and the long tail — as tools your agent calls directly (GitHub). The core repo carries roughly 29k stars, which is a reasonable proxy for "this is load-bearing in a lot of stacks, not a weekend demo." It's framework-agnostic: it ships providers for the OpenAI Agents SDK, the Vercel AI SDK, and LangChain, so the tools slot into whatever loop you already run (LangChain docs).

The design idea that makes it usable in a real product is the per-user session. You don't authorize "Composio" once for your whole app; you create a session scoped to one of your users, and that user authorizes their own connections. Composio holds each user's OAuth token and its refresh — your code never stores a raw credential. That's the part hand-wiring gets wrong most expensively: multi-tenant token storage and refresh is exactly the boring, security-sensitive plumbing you don't want to own.

How to start#

The Python path is three moves — install, key, session:

from composio import Composio
from composio_openai_agents import OpenAIAgentsProvider
from agents import Agent, Runner

composio = Composio(provider=OpenAIAgentsProvider())

# Each session is scoped to one of YOUR users; they authorize their own connections
session = composio.create(user_id="user_123")
tools = session.tools()

agent = Agent(
    name="Personal Assistant",
    instructions="You are a helpful assistant. Use Composio tools to take action.",
    tools=tools,
)

result = Runner.run_sync(starting_agent=agent, input="Summarize my emails from today")
print(result.final_output)

Install is pip install composio composio-openai-agents openai-agents (TypeScript: npm install @composio/core @composio/openai-agents @openai/agents), and you grab an API key from the dashboard first (GitHub quickstart). Authorizing a toolkit returns an OAuth link your end-user clicks once; after that, the agent acts inside that grant.

The no-code on-ramp: Rube#

Not everything needs an SDK. Composio also ships Rube, a hosted MCP server, so any MCP client — Claude Desktop or Claude Code, Cursor, VS Code — can act on hundreds of apps by natural language, authenticate-once, no code. That's the fastest way to feel the product: point your existing agent client at it and ask it to do something in an app you use. The SDK is the path when you're shipping a product where each of your users needs their own scoped connections; Rube is the path when the human at the keyboard is the one driving. If you're weighing whether an action even belongs behind MCP, we walked through tracing MCP tool calls without sessions and how to give an agent thousands of tools — the discovery problem Composio's tool search is built to answer.

Pricing#

Usage is metered on tool calls, and the free tier is generous enough to validate a real agent before you pay (pricing):

Composio raised a $29M round led by Lightspeed and Elevation Capital, so the managed-auth backend is funded to keep the token-refresh treadmill running — which, for a bootstrapped team, is the entire reason to rent this instead of building it (Series A).

Where it sits versus the alternatives#

The honest framing is buy-vs-build with a fork. Against hand-wiring, Composio wins the moment you cross a few integrations, because per-user OAuth and refresh is a recurring tax you'd otherwise pay forever. Against Arcade, the difference is emphasis: Composio leads with breadth (1,000+ ready actions plus managed auth); Arcade leads with authorization — logging in as the user so the model itself never sees the token, the security posture we broke down alongside it in Composio vs Arcade vs Toolhouse and the Arcade authorization-runtime highlight. Pick breadth-with-managed-auth when the job is "act in many apps"; pick the token-hiding posture when the security review is the gating constraint. Either way, the tool most agent stacks now reach for first is one you don't have to write — Composio has earned its place on the repositories every AI agent should star.