Composio

Composio is a service that lets an AI agent use other software, such as Gmail, Slack or GitHub, on behalf of a user. Each user connects their accounts once through a login link. Composio stores and refreshes those logins, so the agent can send an email or open a ticket without ever handling a password or access token. Developers add it with a few lines of code.

What does Composio do?

An AI agent that acts in other apps needs two things: tool definitions the model can call, and a valid login for every user and every app. Composio packages both. In March 2026 its homepage promised tool calls, delegated authentication and sandboxed execution across more than 1,000 apps (snapshot of 25 March 2026); in September 2026 its documentation speaks of more than 1,500 toolkits. The company's SDKs for Python and TypeScript are on GitHub under the MIT licence (since February 2024, about 30,000 stars in September 2026). The service behind them is hosted by Composio and needs an API key; in September 2026 it had a free plan for 100,000 tool calls a month and paid plans from $29 a month (pricing).

How does it work?

The core concepts are few:

• A toolkit is the set of tools for one service. The github toolkit contains tools to create issues or manage pull requests.
• A tool is one action with an input and output schema, named like GITHUB_CREATE_ISSUE.
• A user is an ID from your own app. Every tool call runs under that user's connected accounts, so one user's agent never touches another user's data.
• Authentication: when a tool needs an account, Composio creates a Connect Link. The user signs in there, and Composio handles the OAuth redirects, the token exchange and the refresh. By default it uses its own OAuth apps; you bring your own app for your own branding or scopes (authentication).

The way you hand tools to the model changed during 2026. In the README of March 2026, composio.tools.get(user_id=…, toolkits=[…]) returned a toolkit's tools in the format of your agent framework, with adapters for the OpenAI Agents SDK, Anthropic, LangChain, LangGraph, LlamaIndex, CrewAI and others. In September 2026 the documentation starts from a session instead. A session gives the agent a small fixed set of meta tools to search, authorise and run tools at runtime, so the context window does not fill up with hundreds of tool definitions. Sessions can also be reached over MCP.

What should you watch out for?

• Composio holds your users' tokens, and every tool call runs through its servers. That is a vendor you have to trust with account access.
• The user ID matters. The docs warn against IDs that can change, such as email addresses, and against the ID default in production, because it exposes other users' data.
• The API moves quickly: the quick start changed between March and September 2026, and the REST API v3.0 is labelled legacy in favour of v3.1.

Example

Suppose a web agency lets an agent turn client emails about bugs into work items. The project manager connects Gmail, GitHub and Slack once through Connect Links. When a bug report arrives, the agent reads the email, files it with GITHUB_CREATE_ISSUE in the right repository and posts a note in the team's Slack channel. Each call runs under the project manager's own accounts, and her passwords never reach the agent.