This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to next, this PR will be updated. # Releases ## @composio/cli-local-tools@0.0.3 ### Patch Changes - Updated dependencies [84a3a07] - Updated dependencies [c358ffa] - @composio/core@0.9.1 ## @composio/core@0.9.1 ### Patch Changes -84a3a07: Add `accountType` and per-user ACL support for SHARED connected accounts. - **`accountType` on create**: `composio.connectedAccounts.link(userId, authConfigId, { accountType: 'SHARED' })` creates a SHARED connection. Default remains `PRIVATE`. A SHARED connection can be used by other `userId`s, but only when the connection is explicitly pinned in a tool-router session's config and only when the requesting `userId` passes the connection's ACL. - **`accountType` on retrieve**: `get()` and `list()` responses now include `accountType` (`'PRIVATE' | 'SHARED'`). - **`aclConfigForShared` on create + retrieve**: per-user ACL block — `{ allowAllUsers, allowedUserIds, notAllowedUserIds }`. On responses the field is `undefined` when the caller isn't authorised to see the ACL, so callers can distinguish _"I can't see the ACL"_ from _"ACL is the default deny-by-default state"_. - **`updateAcl()` method** (new): `composio.connectedAccounts.updateAcl(nanoid, { allowAllUsers, allowedUserIds, notAllowedUserIds })` writes the ACL via `PATCH`. PATCH semantics — omit a field to leave it unchanged; pass an empty array to clear an allow/deny list. At least one field required. Calling on a PRIVATE connection raises `ComposioAclOnlyForSharedError` (400). - **`ToolRouterSession.authorize()` options gain `accountType` + `aclConfigForShared`**, so a SHARED connection with an ACL can be created in one call from inside a tool-router session. ACL resolution rule (deny wins): 1. requesting `userId` ∈ `notAllowedUserIds` → DENY 2. `allowAllUsers === true` → ALLOW 3. requesting `userId` ∈ `allowedUserIds` → ALLOW 4. otherwise → DENY (deny-by-default) Limits: each ACL list accepts up to 1000 entries; each `userId` is 1..256 characters. The SDK enforces these caps at the input boundary. New error classes: - `ComposioSharedAccessDeniedError` (403) — surfaces from direct `connectedAccountId` execution paths when the requesting user fails the ACL. - `ComposioAclOnlyForSharedError` (400) — ACL fields sent on a PRIVATE connection. - `ComposioSharedConnectionNotAccessibleError` (400) — tool-router session create / PATCH with a pinned SHARED connection the session user cannot use. No breaking changes. Existing `link()` callers without the new options get a `PRIVATE` connection exactly as today; existing `get()` / `list()` callers see new optional fields. The Python SDK mirror ships in a separate PR. -c358ffa: Fix false-positive `initiate()` deprecation warning for custom auth configs (SEC-339 follow-up). `composio.connectedAccounts.initiate()` previously emitted a one-time `console.warn` on every redirectable-OAuth response, regardless of whether the auth config was Composio-managed (subject to the 2026-07-03 cutover) or custom (unaffected). The wording was conditional ("If this auth config is Composio-managed…") so callers using their own OAuth apps could ignore it, but the warning still printed and caused noise in logs. Apollo already emits the SEC-339 `Deprecation` / `Sunset` / `Link rel="deprecation"` headers (RFC 9745 / RFC 8594) **only** on the retiring branch — managed + redirectable OAuth. The SDK now reads the `Deprecation` header from the response (via `APIPromise.withResponse()`) and gates the warning on its presence. Custom auth configs and non-OAuth schemes get a clean response from the server and now stay silent in the SDK as well. - **Behavior change:** No warning is emitted for `initiate()` calls against custom OAuth auth configs or non-OAuth schemes (API key, bearer, basic). Managed-OAuth callers continue to get exactly one warning per process, now with revised wording that points at the response's `Sunset` header for the precise cutover date. - **No public API change:** `initiate()` returns the same `ConnectionRequest` shape and respects the same `allowMultiple` guard. `ComposioLegacyConnectedAccountsEndpointRetiredError` continues to surface from the 400 retired-path response. - **Test scaffolding:** new mock helper `mockApiPromiseWithHeaders()` in `connectedAccounts.test.ts` wraps a value as an `APIPromise`-shaped thenable so the new tests can simulate apollo's header behavior. Pre-existing initiate tests using `mockResolvedValueOnce` continue to pass via the SDK's defensive fallback when `withResponse` is absent on the mock. Python SDK gets the matching change in the same release train. ## @composio/anthropic@0.9.1 ### Patch Changes - Updated dependencies [84a3a07] - Updated dependencies [c358ffa] - @composio/core@0.9.1 ## @composio/claude-agent-sdk@0.9.1 ### Patch Changes - Updated dependencies [84a3a07] - Updated dependencies [c358ffa] - @composio/core@0.9.1 ## @composio/cloudflare@0.9.1 ### Patch Changes - Updated dependencies [84a3a07] - Updated dependencies [c358ffa] - @composio/core@0.9.1 ## @composio/google@0.9.1 ### Patch Changes - Updated dependencies [84a3a07] - Updated dependencies [c358ffa] - @composio/core@0.9.1 ## @composio/langchain@0.9.1 ### Patch Changes - Updated dependencies [84a3a07] - Updated dependencies [c358ffa] - @composio/core@0.9.1 ## @composio/llamaindex@0.9.1 ### Patch Changes - Updated dependencies [84a3a07] - Updated dependencies [c358ffa] - @composio/core@0.9.1 ## @composio/mastra@0.9.1 ### Patch Changes - Updated dependencies [84a3a07] - Updated dependencies [c358ffa] - @composio/core@0.9.1 ## @composio/openai@0.9.1 ### Patch Changes - Updated dependencies [84a3a07] - Updated dependencies [c358ffa] - @composio/core@0.9.1 ## @composio/openai-agents@0.9.1 ### Patch Changes - Updated dependencies [84a3a07] - Updated dependencies [c358ffa] - @composio/core@0.9.1 ## @composio/vercel@0.9.1 ### Patch Changes - Updated dependencies [84a3a07] - Updated dependencies [c358ffa] - @composio/core@0.9.1 ## @composio/cli@0.2.29 ### Patch Changes - Updated dependencies [84a3a07] - Updated dependencies [c358ffa] - @composio/core@0.9.1 - @composio/cli-local-tools@0.0.3 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This repository contains the official Software Development Kits (SDKs) for Composio, providing seamless integration capabilities for Python and Typescript Agentic Frameworks and Libraries.
Getting Started
TypeScript SDK Installation
# Using npm
npm install @composio/core
# Using yarn
yarn add @composio/core
# Using pnpm
pnpm add @composio/core
Quick start:
import { Composio } from '@composio/core';
// Initialize the SDK
const composio = new Composio({
// apiKey: 'your-api-key',
});
Simple Agent with OpenAI Agents
npm install @composio/openai-agents @openai/agents
import { Composio } from '@composio/core';
import { OpenAIAgentsProvider } from '@composio/openai-agents';
import { Agent, run } from '@openai/agents';
const composio = new Composio({
provider: new OpenAIAgentsProvider(),
});
const userId = 'user@acme.org';
const tools = await composio.tools.get(userId, {
toolkits: ['HACKERNEWS'],
});
const agent = new Agent({
name: 'Hackernews assistant',
tools: tools,
});
const result = await run(agent, 'What is the latest hackernews post about?');
console.log(JSON.stringify(result.finalOutput, null, 2));
// will return the response from the agent with data from HACKERNEWS API.
Python SDK Installation
# Using pip
pip install composio
# Using poetry
poetry add composio
Quick start:
from composio import Composio
composio = Composio(
# api_key="your-api-key",
)
Simple Agent with OpenAI Agents
pip install composio_openai_agents openai-agents
import asyncio
from agents import Agent, Runner
from composio import Composio
from composio_openai_agents import OpenAIAgentsProvider
# Initialize Composio client with OpenAI Agents Provider
composio = Composio(provider=OpenAIAgentsProvider())
user_id = "user@acme.org"
tools = composio.tools.get(user_id=user_id, toolkits=["HACKERNEWS"])
# Create an agent with the tools
agent = Agent(
name="Hackernews Agent",
instructions="You are a helpful assistant.",
tools=tools,
)
# Run the agent
async def main():
result = await Runner.run(
starting_agent=agent,
input="What's the latest Hackernews post about?",
)
print(result.final_output)
asyncio.run(main())
# will return the response from the agent with data from HACKERNEWS API.
For more detailed usage instructions and examples, please refer to each SDK's specific documentation.
Open API Specification
To update the OpenAPI specifications used for generating SDK documentation:
# Pull the latest API specifications from the backend
pnpm api:pull
This command pulls the OpenAPI specification from https://backend.composio.dev/api/v3/openapi.json and updates the local API documentation files.
This is pulled automatically with build step.
Available SDKs
TypeScript SDK (/ts)
The TypeScript SDK provides a modern, type-safe way to interact with Composio's services. It's designed for both Node.js and browser environments, offering full TypeScript support with comprehensive type definitions.
For detailed information about the TypeScript SDK, please refer to the TypeScript SDK Documentation.
Python SDK (/python)
The Python SDK offers a Pythonic interface to Composio's services, making it easy to integrate Composio into your Python applications. It supports Python 3.10+ and follows modern Python development practices.
For detailed information about the Python SDK, please refer to the Python SDK Documentation.
Provider Support
The following table shows which AI frameworks and platforms are supported in each SDK:
| Provider | TypeScript | Python |
|---|---|---|
| OpenAI | ✅ | ✅ |
| OpenAI Agents | ✅ | ✅ |
| Anthropic | ✅ | ✅ |
| LangChain | ✅ | ✅ |
| LangGraph | ✅* | ✅ |
| LlamaIndex | ✅ | ✅ |
| Vercel AI SDK | ✅ | ❌ |
| Google Gemini | ✅ | ✅ |
| Google ADK | ❌ | ✅ |
| Mastra | ✅ | ❌ |
| Cloudflare Workers AI | ✅ | ❌ |
| CrewAI | ❌ | ✅ |
| AutoGen | ❌ | ✅ |
* LangGraph in TypeScript is supported via the @composio/langchain package.
Don't see your provider? Learn how to build a custom provider to integrate with any AI framework.
Packages
Core Packages
| Package | Version |
|---|---|
| TypeScript | |
| @composio/core | |
| Python | |
| composio |
Provider Packages
Utility Packages
| Package | Version |
|---|---|
| @composio/json-schema-to-zod | |
| @composio/ts-builders |
if you are looking for the older sdk, you can find them here
Rube
Rube is a Model Context Protocol (MCP) server built with Composio. It connects your AI tools to 500+ apps like Gmail, Slack, GitHub, and Notion. Simply install it in your AI client, authenticate once with your apps, and start asking your AI to perform real actions like "Send an email" or "Create a task."
It integrates with major AI clients like Cursor, Claude Desktop, VS Code, Claude Code and any custom MCP‑compatible client. You can switch between these clients and your integrations follow you.
Contributing
We welcome contributions to both SDKs! Please read our contribution guidelines before submitting pull requests.
License
This project is licensed under the MIT License - see the LICENSE file for details.
Support
If you encounter any issues or have questions about the SDKs:
- Open an issue in this repository
- Contact our support team
- Check our documentation
