Composio is shipping like a platform team trying to own the action layer for AI agents. ToolVitals sees 47 release events in 30 days, 30 GitHub releases in 90 days, a 100 shipping score, and a 94 ToolVitals score. The interesting part is not only the volume. The recent releases cluster around CLI, auth, proxy execution, webhooks, and SDK adapters, which lines up with the product claim on Composio’s site: agents decide what to do, Composio handles tool calls, delegated auth, sandboxes, and parallel execution across 1,000+ apps.

Composio is not selling another agent framework first. Its public positioning is narrower and more useful: give agents the right tools at the right time, manage OAuth, execute actions, and keep work isolated in sandboxes. That is a hard plumbing problem, and the release stream looks like plumbing work.

The April 25 CLI @composio/cli@0.2.26 release added connection removal. The same day, the CLI beta @composio/cli@0.2.27-beta.219 release included changelog work around proxy execute same-domain enforcement, a composio.trigger.disabled webhook event, and a Composio-managed OAuth migration note. The 0.6.11 package releases for Anthropic, Claude Agent SDK, CLI, and Cloudflare were dependency updates tied back to @composio/core@0.6.11.

That pattern matters. Agent tools die when auth, connection lifecycle, webhooks, and execution boundaries become afterthoughts. Composio’s recent public work is pointed at those boring failure modes. Good. Boring is where production agents usually bleed.

What ToolVitals can and cannot infer

ToolVitals can say Composio is active, visible, and shipping. The repo has 28,132 GitHub stars in the ToolVitals snapshot, a health score of 100, a shipping score of 100, and 47 release events in 30 days. The official site also confirms the current product framing around just-in-time tool calls, delegated auth, sandboxed environments, parallel execution, and 1,000+ apps.

ToolVitals cannot say the integrations work well in your stack. It cannot see customer retention, revenue, production incident rate, support quality, or whether the tool schemas are pleasant under real agent load. The payload also has null values for GitHub commits in the last 30 days and active contributors, so those should not be inferred from this run.

The release notes support a conservative read: Composio is actively maintaining the surfaces that matter for agent actions. They do not prove that every connector is mature, or that the sandbox model fits every security policy.

Competitor context

n8n is still larger on GitHub by a lot, with 187,248 stars and 49 release events in 30 days. Composio has 28,132 stars and 47 release events in the same window. That puts Composio close to n8n on release-event volume, but nowhere near it on GitHub audience size.

LangChain has 136,262 stars and 33 release events in 30 days. Composio is smaller by stars, but its 47 release events suggest a faster recent release cadence in this ToolVitals snapshot. The comparison is not one-to-one. LangChain is a broader developer framework, while Composio is more focused on agent actions, tool access, auth, and execution.

Recommendation

If your team is building agents that need to act across SaaS tools, evaluate Composio because the hard parts match the release activity: auth, connections, webhooks, CLI workflows, SDK adapters, and sandboxed execution. Do not evaluate it only by connector count. Pick three workflows your users actually run, test auth recovery and failure handling, then decide whether Composio removes enough operational pain to justify another platform dependency.

Sources