A thousand toolkits is the catalog. Seven meta-tools is how that catalog stays out of the context window.
A thousand toolkits is a catalog number. Seven meta-tools is the reason that catalog can sit behind an agent without eating the prompt.
Yesterday I said MCP is the connector, and that the value is going to pile up in the catalogs and the credential brokers, not in another framework. Composio is the catalog that already shipped. The ComposioHQ repo sits at 29,835 stars this morning, MIT licensed, TypeScript-first, last push yesterday. The Python package on PyPI is composio 0.20.0, uploaded August 18. The TypeScript package is @composio/core 0.17.0, same day, with @composio/slim 0.17.0 if you do not want the inspectable TypeScript source they ship for coding agents. The older composio-core package is deprecated. If your lockfile still points at it, that is the first fix.
I wrote about this project in May, when the repo was around 28,500 stars and the pitch was a hosted catalog with OAuth handled for you. That piece still holds on the own-versus-rent question. The star count barely moved. The product did. Composio stopped treating the offer as “here are a thousand function definitions” and started shipping it as a session scoped to one of your users.
A session is the runtime context for one agentic run. You create it with a stable user_id from your own database. It ties together that user, the toolkits they may see, the connected accounts they have already authorized, and the execution state for the task. By default it does not dump the catalog into the model. It hands the agent a fixed set of meta-tools and lets the model search, authorize, and execute at runtime.
Those seven tools are the actual product:
COMPOSIO_SEARCH_TOOLS searches the catalog and returns a short plan
COMPOSIO_GET_TOOL_SCHEMAS fetches full input schemas for the slugs you actually need
COMPOSIO_MULTI_EXECUTE_TOOL runs up to fifty discovered tools in parallel
COMPOSIO_MANAGE_CONNECTIONS creates, lists, or tears down OAuth connections
COMPOSIO_WAIT_FOR_CONNECTIONS blocks until a human finishes the browser flow
COMPOSIO_REMOTE_WORKBENCH runs Python in their sandbox for bulk work
COMPOSIO_REMOTE_BASH_TOOL does the same with a shell
That list is why the npm analogy is both useful and wrong. npm made packages discoverable, and Composio wants the same for agent actions. npm then installs code into your tree. You can read it, pin it, patch it, vendor it. Composio discovers a remote action and executes it through their session. That is closer to a hosted API gateway with a catalog than it is to a package manager. Discoverability is real. Ownership is not.
The MCP story is the reason this post belongs in this week’s arc instead of being a May rerun. Pass mcp=True when you create the session and you get a hosted endpoint on session.mcp.url. Point Claude, Cursor, or any MCP client at it. Composio Connect sits at https://connect.composio.dev/mcp if you already have a client and do not want to stand up an SDK session at all. The same toolkit filters, auth configs, and connected accounts apply on both paths. One session, two transports.
from composio import Composio
composio = Composio()
session = composio.sessions.create(user_id="user_123", mcp=True)
tools = session.tools()
print(session.mcp.url)Store session.session_id and restore it with composio.use() on the next turn. A new session every message throws away the connected-account context you already paid for. The TypeScript SDK is ESM-only and wants Node 22.22.3 or newer. That is a real constraint if your agent still lives on an 18 or 20 runtime.
The default session is the right shape for a broad assistant. If you already know the two Gmail actions the agent is allowed to touch, flip the direct-tools preset and preload those slugs. Their own changelog says keep a preloaded set under twenty. Above that you are back to the context problem MCP was supposed to solve. Restrict toolkits at session create if this agent has no business seeing Stripe or the workbench. The filter is the governance. The catalog is only the inventory.
Provider packages exist for OpenAI, Anthropic, the Claude Agent SDK, Vercel AI SDK, LangChain, and CrewAI. They format the same session tools for the framework you already run. They do not make Composio a runtime. The session still dies with the process unless something else owns the loop.
Version 0.20.0 closed a hole that would have burned anyone who followed the happy-path docs. session.tools() gave you session meta-tools, then the OpenAI and Anthropic provider helpers executed those calls through the global direct path and dropped the Tool Router session on the floor. Search failed. session.execute() kept the session and skipped the provider’s argument normalization. The August 18 release lets those helpers take an explicit session target. Existing user-id calls still go direct. If you wrote a custom provider and overrode handle_tool_calls or execute_tool_call, the signature changed and you need to look at it. They also started validating URLs that arrive inside API responses, not only the ones you typed, which is the SSRF case everyone forgets until a tool result names a link-local address.
The CLI is still shipping like a product with customers on the phone. @composio/cli@0.3.4-beta.360 landed August 21, with a 0.4.0-beta line moving the same week. Search, execute, link, and a TypeScript run surface for coding agents. Cadence is not the question. The question is what you are willing to put on the other side of that CLI.
Here is where I would use it. The long tail of SaaS no team is going to staff: Notion, Linear, HubSpot, the HR tool the customer already pays for. Per-user OAuth across many tenants, where writing the refresh and revocation path yourself is a quarter of work. An MCP client that should not own a Gmail wrapper. An internal assistant whose job is “find the right action, then do it,” and whose blast radius you can bound with a toolkit allow-list.
Here is where I would not. The integration is the product. A refund against Stripe that writes back to your billing record is not a catalog lookup. A prior-authorization packet that has to hit eligibility before clinical is not a search result. Anything that needs beforeExecute or afterExecute to log, reshape, or refuse a call cannot go over the MCP URL, because that path talks to Composio’s server directly and skips the SDK hooks. Custom in-process tools you bind onto a session do not appear on the hosted endpoint either. If the gate is the point, stay on session.execute().
The failure mode has not changed since May. When the Gmail toolkit returns a 429 the SDK does not surface cleanly, the model retries until the quota is gone. When a Salesforce field gets renamed in the customer’s org and the wrapper has not caught up, you get a serialization error that does not name the field. The fix lives in a queue you do not control. The registry is the right answer for the connections that would otherwise sit in the backlog. It is the wrong answer the moment the integration is load-bearing and you cannot afford a silent week.
The live claim is 1,000-plus toolkits. That number is real, and it is also the wrong one to stare at. A thousand SaaS wrappers is a large catalog for the apps a sales-ops agent actually needs. It is a small catalog for the systems that run a regulated business: the regional payer portal, the EHR with a custom FHIR profile, the mainframe screen nobody wrapped. Discovery beats hand-coding when the action is generic and the vendor is healthy. Hand-coding wins when the action is the product and the vendor will not be the one in the incident channel.
Authentication is the part I am leaving on the table for Tuesday. The first time an agent needs an app, Composio still generates an OAuth link a human has to approve in a browser. After that the connection persists on the user_id. That is a solved onboarding flow. It is not agent-scale credential rotation, least privilege, or an audit trail an examiner will accept. The catalog gets the tool into the session. The auth layer decides whether it stays. MCP has nothing to say about it. Neither does a registry.
Tomorrow is Strands, Amazon’s quieter bet that tool middleware is a layer worth standardizing around Bedrock and Lambda without pretending to be a framework. The decision I would make tonight is narrower than whether Composio is “the npm of agents.” Are you buying a catalog, or are you buying a session that decides which tools the model is even allowed to see?
If this was useful, forward it to one engineer who needs less noise in their feed.