Bumps the mise-pinned Bun toolchain from 1.3.10 to 1.4.0 and replaces the one CLI dependency that a Bun 1.4 built-in can verifiably take over. ## Binary size: Linux shrinks a lot, macOS grows a little Measured per target, byte counts from `build:binary:all` on a darwin-arm64 host. | Target | Before (1.3.10) | After runtime (1.4.0) | After full | Δ total | Δ % | |---|---:|---:|---:|---:|---:| | `composio-darwin-aarch64` | 80,850,704 (77.1 MiB) | 83,790,962 (79.9 MiB) | 83,790,962 (79.9 MiB) | +2,940,258 (+2.8 MiB) | +3.6% | | `composio-darwin-x64` | 85,710,240 (81.7 MiB) | 90,430,880 (86.2 MiB) | 90,430,880 (86.2 MiB) | +4,720,640 (+4.5 MiB) | +5.5% | | `composio-linux-x64` | 123,666,298 (117.9 MiB) | 102,270,152 (97.5 MiB) | 102,270,152 (97.5 MiB) | -21,396,146 (-20.4 MiB) | -17.3% | | `composio-linux-aarch64` | 121,153,270 (115.5 MiB) | 102,221,816 (97.5 MiB) | 102,221,816 (97.5 MiB) | -18,931,454 (-18.1 MiB) | -15.6% | **Attribution — read this before quoting the numbers.** Every byte of movement above comes from the **Bun runtime bump**, not from dependency removal. The "after runtime" and "after full" columns are byte-identical: the only dependency dropped here is `tar`, a devDependency used by one build script that never reaches the binary. Its size contribution is exactly **0 bytes**. (The identical columns also confirm the compiled build is reproducible across runs.) Linux users — the large majority of installs — get a ~18-20 MiB smaller binary. macOS grows 2.8-4.5 MiB. This matches the direction upstream reports for the standalone Bun binary. ## What changed - `mise.toml` pins `bun = "1.4.0"`; `mise.lock` regenerated with the exact platform list `ts.audit` uses. - `scripts/_acp-adapters.ts` extracts npm tarballs with `Bun.Archive` instead of the `tar` package. - `tar` dropped from `@composio/cli` devDependencies (plus `@isaacs/fs-minipass`, `chownr`, `minizlib`, `yallist` from the lockfile). ## Verified negative results These are the two adjacent candidates a reviewer would expect to see replaced. Both were probed against a real Bun 1.4.0 binary and both fail — recorded here so nobody re-derives the dead ends: - **`extract-zip` stays.** `Bun.Archive` cannot read zip: `new Bun.Archive(zipBytes)` throws `Unrecognized archive format`, and `ArchiveOptions.compress` accepts only `"gzip"`. Still used at three call sites. - **`semver` stays.** `Object.keys(Bun.semver)` returns exactly `["satisfies", "order"]`. The CLI also needs `valid`, `prerelease`, `compare`, `gt`, and `lt`. `valid` and `prerelease` have no equivalent, so a partial migration would only add a second semver dialect. ## `json5` → `Bun.JSON5` was attempted and backed out `parse-json.ts` is covered by the CLI's Vitest suite, which runs on **Node**, where the `Bun` global does not exist — `Bun.JSON5.parse` throws `ReferenceError` under test. The suite cannot move to the Bun runtime (88 of 122 files fail there on unrelated zod resolution errors), and `bun test` for a single file would conflict with the repo's `@effect/vitest` lint rule. The swap itself is sound — `Bun.JSON5.parse` matched the `json5` package on all nine contract cases against a real 1.4.0 binary, including `SyntaxError` on malformed input. It is the test harness, not the parser, that blocks it. Deferred rather than shipped with weakened coverage. For sizing the follow-up: `--metafile-md` puts `json5` at **28,045 bytes (0.1%)** of the JS bundle, imported only by `src/utils/parse-json.ts` — roughly 0.03% of a compiled binary. Worth doing for dependency-surface reasons, not for size. ## Verification - All four release targets cross-compile on Bun 1.4.0. - `mise lock --platform linux-x64,linux-arm64,macos-arm64,macos-x64` then `git diff --exit-code mise.lock` is clean, replayed in a CI-like environment. - `pnpm typecheck` clean; CLI suite green (122 files, 1248 passed, 1 skipped). - `Bun.Archive` adapter build against the live npm registry produces codex-acp binaries **byte-identical** (SHA-256) to the `tar`-produced ones, at the same `package/bin/<name>` paths, executable after `chmod`, extracted concurrently. A truncated tarball throws `ReadError` rather than silently yielding an empty directory. - Runtime smoke on the 1.4.0 binary: `composio version`, `composio --help`, and the `composio run` companion-module spawn path (reports `process.version` v26.3.0 — no Node 26 stream regression). `extract-zip` verified working under the new runtime. ### Not run locally `pnpm test:e2e:cli` needs Docker, which was unavailable on this machine. CI covers it. Worth a look at that job: the e2e image is version-keyed and has served a stale Bun binary from a cached layer before, so confirm the container reports 1.4.0. ## Notes - `@types/bun` is deliberately not bumped: `Bun.JSON5` and `Bun.Archive` are already declared in the installed `bun-types@1.3.14`, no `@types/bun` 1.4.x exists yet, and `minimumReleaseAge` would block a fresh pin anyway. - No changeset: `@composio/cli` is in `.changeset/config.json`'s `ignore` list and no published package is touched. - `mise lock` locally adds a stray `[[tools.node]] 24.19.0` block sourced from the developer's global mise config. It was stripped; the committed lock is stable under the audit gate's exact command.
composio.dev • Documentation • Quickstart • Changelog
Composio
Composio gives your AI agents 1000+ pre-authenticated toolkits, per-user sessions, authentication, triggers, and a sandbox, so you can ship agents that turn intent into action.
This is the Composio SDK monorepo. It contains:
@composio/core: TypeScript SDKcomposio: Python SDKcomposioCLI: search, execute, and script tools from your shell- Provider adapters for OpenAI Agents, Claude Agent SDK, Vercel AI SDK, LangChain, and more
Quickstart
Create a session for a user, hand its tools to your agent, and let the agent take action across 1000+ apps. Grab a COMPOSIO_API_KEY from the dashboard first.
TypeScript
npm install @composio/core @composio/openai-agents @openai/agents
@composio/coreintentionally packages its TypeScript source and SDK docs so the installed package is inspectable to coding agents. If you want a smaller install with the same API, use@composio/slim.
import { Composio } from "@composio/core";
import { OpenAIAgentsProvider } from "@composio/openai-agents";
import { Agent, run } from "@openai/agents";
const composio = new Composio({ provider: new OpenAIAgentsProvider() });
// Each session is scoped to one of your users
const session = await composio.create("user_123");
const tools = await session.tools();
const agent = new Agent({
name: "Personal Assistant",
instructions: "You are a helpful assistant. Use Composio tools to take action.",
tools,
});
const result = await run(agent, "Summarize my emails from today");
console.log(result.finalOutput);
Python
pip install composio composio-openai-agents openai-agents
from composio import Composio
from composio_openai_agents import OpenAIAgentsProvider
from agents import Agent, Runner
composio = Composio(provider=OpenAIAgentsProvider())
# Each session is scoped to one of your users
session = composio.create(user_id="user_123")
tools = session.tools()
agent = Agent(
name="Personal Assistant",
instructions="You are a helpful assistant. Use Composio tools to take action.",
tools=tools,
)
result = Runner.run_sync(starting_agent=agent, input="Summarize my emails from today")
print(result.final_output)
By default a session gets meta tools that discover, authenticate, and execute app tools at runtime, so you don't load hundreds of tool definitions into context. Store session.session_id and reuse it with composio.use() across turns. See what a session is and configuring sessions for restricting toolkits, auth configs, and connected accounts.
Prefer MCP? Every session also exposes a hosted MCP endpoint. Pass mcp: true to composio.create() and point Claude, Cursor, or any MCP client at session.mcp.url. See sessions via MCP.
CLI
The composio CLI runs Composio from your shell and gives coding agents like Claude Code a local tool surface.
curl -fsSL https://composio.dev/install | sh
The installer puts composio on your PATH for future terminals. Open a new terminal, then run composio login. See INSTALL.md for shell setup overrides, including COMPOSIO_INSTALL_SHELL=none for install-only runs.
Use composio search to find tools, composio execute to run them, composio link to connect accounts, and composio run to script workflows in TypeScript. See the CLI docs.
Providers
A provider adapts Composio tools to your agent framework's native tool format:
| Provider | TypeScript | Python |
|---|---|---|
| OpenAI | @composio/openai |
composio-openai |
| OpenAI Agents | @composio/openai-agents |
composio-openai-agents |
| Anthropic | @composio/anthropic |
composio-anthropic |
| Claude Agent SDK | @composio/claude-agent-sdk |
composio-claude-agent-sdk |
| Vercel AI SDK | @composio/vercel |
— |
| Google GenAI | @composio/google |
composio-gemini, composio-google |
| Google ADK | — | composio-google-adk |
| LangChain | @composio/langchain |
composio-langchain |
| LangGraph | via @composio/langchain |
composio-langgraph |
| LlamaIndex | @composio/llamaindex |
composio-llamaindex |
| Mastra | @composio/mastra |
— |
| Pi | @composio/experimental* |
— |
| Cloudflare Workers AI | @composio/cloudflare |
— |
| CrewAI | — | composio-crewai |
| AutoGen | — | composio-autogen |
* The Pi provider is experimental and ships from @composio/experimental.
Don't see your framework? Build a custom provider, or skip providers entirely and connect over MCP.
All packages
Everything published from this repo:
| Package | Description |
|---|---|
@composio/core |
TypeScript SDK |
@composio/slim |
@composio/core without packaged source or docs; same API, smaller install |
composio CLI |
Standalone CLI binary: curl -fsSL https://composio.dev/install | sh |
@composio/experimental |
Experimental integrations, including the Pi provider |
@composio/json-schema-to-zod |
JSON Schema to Zod conversion |
@composio/* provider adapters |
OpenAI, OpenAI Agents, Anthropic, Claude Agent SDK, Vercel, Google, LangChain, LlamaIndex, Mastra, Cloudflare |
composio |
Python SDK |
composio-* provider adapters |
OpenAI, OpenAI Agents, Anthropic, Claude Agent SDK, Gemini, Google, Google ADK, LangChain, LangGraph, LlamaIndex, CrewAI, AutoGen |
Repository layout
ts/ TypeScript SDK workspace
packages/core/ @composio/core
packages/providers/ Provider adapters
packages/cli/ Composio CLI
python/ Python SDK and provider packages
docs/ Documentation site (docs.composio.dev)
The TypeScript SDK is tested against Node 22+; the Python SDK supports Python 3.10+.
Development
mise install # pinned toolchain (Node, Python, pnpm)
pnpm install
pnpm build
pnpm test
Python commands run from python/; see python/README.md. We welcome contributions to both SDKs; read the contribution guidelines before submitting pull requests.
Support
License
MIT. See LICENSE.