Composio
The best tool-calling layer on the market and the one that got breached: 1,000+ toolkits behind managed auth for $0 up to 100K calls a month, from a vendor that lost 5,001 GitHub tokens and 5,241 API keys in May and had three published incidents in 2026.
PRICING
| Free | $0 | 100K tool calls/mo, 50K trigger events/mo, unlimited connected accounts on your own OAuth app, 3 team members, 1000+ toolkits, OAuth management, triggers, sessions, custom tools and MCP, basic white-labeling, 7-day log retention. Hard-capped — usage pauses at the cap, no card, no surprise bill |
| Pro | $29/mo | Everything in Free plus $29 of usage credit that resets monthly with no rollover, unlimited members, spend caps per meter, advanced white-labeling, read-only dashboard role, 30-day log retention, email support plus Slack above $1K spend. Overage $0.0003/tool call, $0.003/trigger event |
| Enterprise | Quote only | Committed volume with discounts, KMS proxy so Composio never holds your keys in plaintext, SSO, SCIM, MSA/DPA/SLA, higher API rate limits, custom log retention, integration requests on demand, dedicated support, and self-hosted or private-cloud deployment for data residency |
| Add-ons | $500/mo each (DPA, BAA); $0.0001–$0.0003 per call (metered) | DPA and BAA are fixed $500/month each, Pro and above. Metered: zero data retention $0.0001/call plus $0.0005/trigger, IP allowlist $0.0001/call, direct execution outside a session $0.0001/call, proxy execute $0.0002/call, sandbox execution $0.0001/call, shared-connection calls $0.0003/call. Advanced white-labeling $0.30 per connection, one time |
| Premium tools | Provider cost + 5% | Third-party providers passed through with a 5% platform fee and no markup: Browser Use ~$0.70/task, Google Veo video ~$1.20/video, Gemini images ~$0.14/image, Exa and Tavily search ~$0.008/search, SerpAPI ~$0.011/search, Groq ~$0.002/call, Gemini embeddings ~$0.0002 per 1K tokens |
Two things to watch. First, this pricing is one week old: it took effect for signups on or after 15 August 2026, existing customers stay on their old plan through 31 December 2026, and premium tool calls start billing for everyone from 1 September 2026. Third-party review sites still quote the old $229 Serious Business tier, which no longer exists — check composio.dev/pricing, not an aggregator. Second, the sticker price is not the whole price. A tool call that runs in the sandbox, executes outside a session, goes through proxy-execute or uses a shared connection each carries its own small add-on, and the two controls a European buyer is most likely to need — a DPA and zero data retention — are a fixed €460 a month and a per-call meter respectively. Free is genuinely free and genuinely hard-capped, which is rare and worth crediting.
checked 2026-08-22 · vendor pricing page
Element scores
Strengths
On capability Composio is the best thing in its category. Over 1,000 toolkits with typed schemas, managed OAuth with automatic refresh scoped per end user, triggers, retries and rate-limit handling — the whole grinding middle layer between an agent and a real business system, handled. The session model is the genuinely clever part: rather than dumping hundreds of tool definitions into the context window, the agent gets four meta tools and discovers what it needs at runtime, and bulk responses go to a session-scoped sandbox instead of into the prompt. That is a context-engineering answer, not just an integration catalog, and it is why the Cx and Fc scores are where they are. Protocol support is the other standout: every session exposes a hosted MCP endpoint with one flag, the MCP Gateway returns only task-relevant tools with auth and audit layered on routing, and there are first-party paths for Claude, Codex, Cursor, OpenClaw and Hermes. The SDKs are MIT, cover TypeScript and Python, and adapt to fourteen agent frameworks, so the lock-in surface is the hosted service rather than your code. And the new free tier is real: 100K tool calls a month, hard-capped, no card, usage pauses rather than bills. For a European SMB testing whether an agent can actually do work in Gmail and Slack, that is a €0 experiment with a known ceiling.
Honest dings
Composio holds your users' OAuth grants, which makes its own security posture part of your threat model, and 2026 has not gone well. Three published incidents: February 9, then April 28–30, then May 21. The April incident is instructive on its own — a background cleaner job had been silently failing since around April 6, the table it was meant to prune grew until it degraded the whole platform database, webhook triggers for Slack, Outlook, Notion and HubSpot were down for roughly 36 hours affecting about 700 customers, and events that arrived during the outage were not queued and are not recoverable. The May breach is the serious one. An attacker compromised a Composio employee's Gmail OAuth token, used inbox access to intercept magic-link sign-in emails, reached an internal agentic monitoring tool, escalated through the automated remediation system, registered malicious tool definitions and reached arbitrary code execution in the tool-execution sandbox. Composio's own disclosure puts the leaked connections at 0.3% of the total — but that 0.3% is 5,001 GitHub OAuth grants, alongside 5,241 API keys assessed as likely exposed and revoked. All API keys created before 22 May 2026 were revoked, every customer was told to rotate, and for API-key-type connections Composio could not revoke on the customer's behalf, so end users had to go to each provider themselves. To Composio's credit the disclosure is unusually detailed, including indicators of compromise and an honest account of the remediation, and the April post-mortem admits the communication failure plainly. But the structural lesson stands and outside analysts made it: internal automation held standing authority over customer secrets, and the platform's own trusted workflows carried the breach forward. Beyond security, three gaps. Evaluation is absent — you cannot measure or gate on your own tool reliability. Log retention is 7 days free and 30 days on Pro, which is short for auditing an agent that acts on your behalf. And the controls that make this safe for regulated work sit behind paid add-ons or Enterprise: KMS proxy is Enterprise-only, and a DPA costs a fixed €460 a month on top of a €27 plan.
Sources (14) — every claim traceable
Every audit lists the research it rests on — transparency and traceability are the product. Tools evolve: each audit is a snapshot of its audit date, and re-audits supersede older versions (kept below for reference).
- composio.dev/pricing — Official pricing verified live 22/08/2026 and the source of every figure in this audit: Free $0 with a hard cap at 100K tool calls and 50K triggers, Pro $29 with monthly usage credit, Enterprise quote-only, overage $0.0003 per tool call and $0.003 per trigger event, the full add-on rate card (ZDR, IP allowlist, proxy execute, sandbox, direct execution, DPA and BAA at $500/month each), the premium-tool passthrough table with the stated 5% platform fee, the feature matrix showing 7/30-day/custom log retention and KMS proxy as Enterprise-only, and the footnote that new pricing applies to signups from 15 August 2026 with existing customers grandfathered to 31 December 2026 (accessed 2026-08-22)
- docs.composio.dev/docs/how-composio-works — Official architecture documentation and the primary evidence for the Context score: sessions scope user, tool access, authentication and execution state; meta tools discover, authenticate and execute at runtime so hundreds of tool definitions never enter the window; sessions persist server-side and do not expire; the sandbox is session-scoped and holds bulk responses, files and variables out of context (accessed 2026-08-22)
- github.com/ComposioHQ/composio — Official SDK monorepo: MIT licence, 29.4K stars, 4.7K forks, 4,463 commits, TypeScript SDK tested against Node 22+ and Python SDK supporting 3.10+, the full provider-adapter table (OpenAI, OpenAI Agents, Anthropic, Claude Agent SDK, Vercel, Google GenAI, Google ADK, LangChain, LangGraph, LlamaIndex, Mastra, Cloudflare Workers AI, CrewAI, AutoGen), the CLI, and the one-flag hosted MCP endpoint per session (accessed 2026-08-22)
- docs.composio.dev/docs/skills — Official Skills documentation, the evidence behind the Prompts score: skills are execution playbooks derived from real platform usage, delivered inside the tool-search response with recommended plan steps and known pitfalls. Also the vendor's own statement that skills are read-only, have no listing or reading API, and that there is no opt-out today (accessed 2026-08-22)
- composio.dev/enterprise — Official enterprise page: SOC 2 Type 2 and ISO 27001:2022 stated as independently audited, end-to-end encryption, zero-day log retention by default, third-party penetration testing, granular tool scoping with every scope restriction logged, human-in-the-loop review policies, automatic retries and failovers, and self-hosted or own-cloud deployment. AWS, Glean and Zoom named as customers (accessed 2026-08-22)
- composio.ghost.io/composio-may-2026-security-incide… — Composio's own May 2026 incident disclosure and the primary source for the breach findings: the per-connector leak table showing 5,001 GitHub tokens plus small counts across Gmail, Jira, HubSpot, Linear, Notion, Slack and Google Calendar (the majority of the tail being internal accounts), the vendor's framing of the total as 0.3% of active connections, the remediation list including rolled encryption keys and obfuscated internal routes, and the published indicators of compromise (accessed 2026-08-22)
- composio.dev/blog/incident-report-april-28 — Official April 2026 post-mortem, independent of the May breach: about 53 minutes of cumulative platform API degradation across 28–30 April, webhook triggers for Slack, Outlook, Notion and HubSpot unavailable for roughly 36 hours affecting about 700 customers with events arriving during the window unrecoverable, root cause a background cleaner job silently failing since about 6 April, a second 45-minute outage caused by the remediation itself, and the vendor's own admission that incident communication fell short (accessed 2026-08-22)
- material.security/resources/the-composio-breach-one… — Independent security analysis (Material Security) corroborating and quantifying the May breach: approximately 5,241 API keys and 5,001 GitHub OAuth tokens exfiltrated, initial vector a compromised Gmail OAuth token belonging to a Composio employee used to intercept magic-link sign-in emails, escalation to mandatory rotation for all customers within two days, and the constraint that Composio could not revoke API-key-type connections on customers' behalf (accessed 2026-08-22)
- p0.dev/blog/the-composio-breach-lets-stop-blaming-t… — Independent architectural analysis (P0 Security, 27/05/2026) of the escalation chain: foothold in an internal agentic monitoring tool, escalation through automated connector-remediation systems, malicious tool definitions registered in the platform sandbox, ending in arbitrary code execution. Names the structural cause as internal automation holding standing authority, and credits Composio's disclosure as commendably transparent (accessed 2026-08-22)
- scalekit.com/blog/migrate-composio-scalekit — Independent competitor migration guide (29/05/2026), used here for the switching-cost reality rather than the sales pitch: OAuth refresh tokens are bound to the issuing OAuth client so every end user must re-authorise on any migration away, Composio's session model versus a stateless alternative, and the author's own advice that teams mid-incident should stabilise before migrating (accessed 2026-08-22)
- lsvp.com/stories/investing-in-composio-building-the… — Lead investor's announcement of the $25M Series A (22/07/2025) and the source of the 100,000+ developer figure, plus confirmation of SOC 2 Type II at the time of investment (accessed 2026-08-22)
- m.economictimes.com/tech/funding/agentic-ai-startup… — Independent reporting of the funding position quoted directly to the CEO: $25M Series A led by Lightspeed with Elevation Capital and Together Fund participating, on top of a $4M seed, for $29M total. Used to discount third-party profiles quoting a higher unverified figure (accessed 2026-08-22)
- pipedream.com/community/t/is-composio-unreliable-an… — Independent user report on a competitor's community forum evidencing that the reliability complaints predate the 2026 incidents, including a reported multi-hour outage and the user's account of the Composio Discord at the time (accessed 2026-08-22)
- forum.cursor.com/t/composio-mcp-oauth-issue/161560 — Independent downstream evidence (Cursor community forum, May 2026) of the breach's practical effect on users: MCP OAuth flows failing mid-incident, and the requirement to set the API key manually in headers in mcp.json for Cursor connections (accessed 2026-08-22)