More than 1,000 toolkits replace hand-built app connectors
Composio's catalog lists more than 1,000 app toolkits. Its TypeScript and Python SDKs create a session for one user, hand tools to an agent framework, and let that session discover or execute an action. The repository also contains a CLI and adapters for OpenAI, Anthropic, Google, LangChain, LlamaIndex, and other frameworks. This is useful when maintaining OAuth callbacks and vendor-specific request schemas has become its own product.
The catalog does not have to enter the model context in one lump. Sessions begin with meta tools that discover, authenticate, and execute app tools when needed. The README says you can restrict a session by toolkit, authentication configuration, and connected account. You must still map your application's user to the correct session and retain its identifier across turns. Composio handles the connection layer; it cannot decide which outside action your agent should be allowed to take.
The quickstart depends on Composio's hosted control plane
All 1,000-plus toolkits sit behind a quickstart that asks for a COMPOSIO_API_KEY from the hosted dashboard. App calls then depend on connected user accounts, plus whichever model-provider credential your agent needs. A session can return native tools for a supported framework or a hosted MCP endpoint for Claude, Cursor, and other clients. The CLI adds search, account linking, execution, and TypeScript scripting from a terminal.
That design is convenient for a product willing to buy managed authentication. It is a poor fit for a company that requires the complete action layer to stay on its own machines. The 3,483-file checkout has no Dockerfile, and the README presents hosted sessions rather than a self-hosted control plane. A test environment also needs low-risk accounts for every consequential integration. A successful tool response is not enough evidence that an email, event, or record landed correctly.
What happened when we ran it
Our sandbox installed 830 pnpm packages in 74 seconds, consuming 1,931 MB on disk. The build completed successfully in 62 seconds. We ran commit c7e7da1 in an unprivileged Debian container with 3 CPUs, 8 GB of RAM, Node 22.23.2, and no secrets. We measured repository setup and compilation, not the hosted service or any third-party action.
The full test command failed after 14 seconds. Its log warned that one project requires Node 24.17.0 or newer but below 25, while the container had Node 22.23.2. The next visible command was bun run test/mise-bun-pin.test.ts, and the shell returned bun: not found. Pnpm then exited with code 1. The log does not show a failed assertion, so calling this a product logic defect would go beyond the evidence.
Node 22 built the code, but the complete test command wanted more
The top-level README says the TypeScript SDK is tested against Node 22 or newer. Our Node 22.23.2 build did pass. The test path exposed a narrower requirement from inside the monorepo, Node 24.17 through 24.x, and required Bun for the first visible toolchain check. Contributors should follow the documented mise install route instead of treating the broad Node statement as the whole development environment.
This is a large source tree even before the 1,931 MB dependency install: 3,483 files, about 331,874 source lines, and a 129.7 MB checkout. It has 38 CI workflow files, a tests directory, and multiple workspaces. That is credible infrastructure for a project spanning two language ecosystems and many providers. It also means a small patch can cross package boundaries, generated docs, release checks, and provider contracts.
Python and TypeScript providers do not always expose the same options
Issues 4719 and 4720 document two Python provider gaps. The OpenAI Agents adapter lacks the strict-schema switch found in TypeScript, while the Anthropic adapter lacks TypeScript's tool-caching option. Both were opened on October 1 with specific file references, and pull requests were already active around them. Treat these as current compatibility details to verify, not proof that the entire Python SDK is neglected.
Toolkit behavior deserves the same scrutiny. Issue 4138 documents a LinkedIn connection that could post through a personal identity but lacked the organization scopes needed for company-page publishing. Issue 4649 asks for static OAuth support for custom MCP servers that do not implement dynamic client registration. If either path is central to your product, reproduce it with the exact auth mode before committing to the integration.
An October 2 push and 99 open items show active maintenance
GitHub showed 30,395 stars and 99 combined issues and pull requests on October 2, 2026. The API returned 38 issues and 61 pull requests, so 99 should not be read as a bug count. The repository was pushed that day. Its latest release, @composio/openai@0.13.0, shipped September 29 with support for executing through a supplied Tool Router session.
Composio earns a trial when connector upkeep is slowing an agent product and a hosted action layer is acceptable. Start with a narrow toolkit list, connect test accounts, and read back important writes. For contributors, the measured lesson is simpler: budget 1,931 MB, use the pinned Node and Bun toolchain, and do not call the checkout healthy until the full command runs in that environment.