Composio posted 30 release events in 30 days, and the recent work is not random package churn. The sampled releases point at a focused bet: agent tooling needs a real CLI layer, tighter permissions, MCP fixes, and output shaped for LLM consumers.

ToolVitals gives Composio a 99 overall score, with 100 health and 100 shipping. It also tracks 28,531 GitHub stars and 30 GitHub releases across the 90-day window. That is serious public momentum for an OSI-approved open source project under the MIT license.

The interesting signal is the CLI, not the star count

Composio’s homepage frames the product around just-in-time tool calls, delegated auth, sandboxed environments, parallel execution, and 1,000+ apps. The GitHub repo describes official SDKs for Python and TypeScript agent frameworks.

The recent release notes make that positioning feel less like brochure copy and more like active infrastructure work. The May 19 beta release made CLI output more LLM friendly. Another May 19 release made permission allows expire after one hour. The May 16 releases include an MCP execution fix for empty output parameters, a CLI session header, shared connections docs, and an approval fallback page.

That is the unglamorous part of agent systems. Tool calls fail because schemas are weird, auth state expires badly, permissions are too broad, output is hard for another model to parse, or the local client cannot explain what happened. Composio appears to be spending release cycles on exactly those edges.

The May 20 release is mostly documentation polish, including Algolia search, guide grouping, CLI navigation, and homepage work. Normally docs-only release notes are not thrilling. Here they fit the pattern. A tool layer with 1,000+ integrations needs docs and search to be part of the product, not an afterthought.

What ToolVitals can and cannot infer

ToolVitals can say Composio is alive, visible, and shipping quickly. It sees the release stream, stars, score history, and public first-party pages. Those signals support the view that Composio is actively maintained.

ToolVitals cannot prove the SDKs are pleasant to use, the connectors behave correctly under production load, or the sandbox model is safe enough for your threat model. It also cannot measure revenue, retention, user satisfaction, or whether the product works better than building a smaller tool layer yourself.

So the conservative read is this: Composio is not just collecting GitHub stars. It is pushing public releases around the operational pain of agent tool execution. That matters, but it still deserves hands-on evaluation before it becomes core infrastructure.

The comparison is tighter than it looks

LangChain is still much larger by stars, with 138,055 GitHub stars versus Composio’s 28,531. It also leads slightly on ToolVitals hot score, 240.0 versus 232.4, and release events, 33 versus 30 in 30 days.

That comparison is not a dunk on Composio. It shows Composio shipping at nearly the same short-term public cadence while playing a narrower role: tool access, auth, execution, and agent integration plumbing.

React Email is closer on size, with 19,262 stars and the same 30 release events in 30 days. Gemini CLI is much larger at 104,757 stars, but ToolVitals tracks the same 30 release events in 30 days. Composio sits in that busy tier where developer tools are shipping fast enough that release quality matters more than raw frequency.

PostHog is the outlier in the related set, with 48 release events in 30 days and an open-core model. Composio is different on openness. ToolVitals classifies it as OSI-approved OSS with an MIT license signal, so it is fair to call Composio open source based on the supplied evidence.

Recommendation

If your team is building agents that need to act across SaaS accounts, evaluate Composio early. The recent CLI work targets the boring failure modes that break real agent deployments: auth, permissions, MCP execution, machine-readable output, and sandboxed tool runs.

If your agent only needs a few internal APIs, Composio may be more infrastructure than you need. But if you are wiring agents into many third-party tools, the current release pattern is a strong reason to test it before writing your own integration layer.

Sources