This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to next, this PR will be updated. # Releases ## @composio/core@0.12.0 ### Minor Changes -a0bef5d: Bump `@composio/client` to `0.1.0-alpha.74`. -dfd7a08: Add per-request cancellation to public SDK methods via a new `ComposioRequestOptions` (`{ signal?: AbortSignal }`) trailing argument, plus a typed `ComposioRequestCancelledError` for detecting caller-initiated aborts. Without this, a slow `tools.get` or `tools.execute` had no way to be cancelled — a 100s search would block the calling agent indefinitely. The new shape: ```typescript try { const tools = await composio.tools.get( 'user_1', { search: 'send email', limit: 50 }, { signal: AbortSignal.timeout(5_000) } ); } catch (err) { if (err instanceof ComposioRequestCancelledError) { return; } throw err; } ``` The signal is forwarded to the underlying `@composio/client` fetch. Any abort error (`APIUserAbortError`, `AbortError`, or `DOMException(name='AbortError')`) coming back is normalized to `ComposioRequestCancelledError` so callers can `instanceof`-detect cancellation without unwrapping nested causes. Catch-and-wrap paths in `tools.execute` / `tools.getRawComposioToolBySlug` / `toolkits.get` re-throw the cancellation error rather than remapping it to `ComposioToolExecutionError` / `ComposioToolNotFoundError` / `ComposioToolkitFetchError`. Wired through on: - **Tools**: `get`, `getRawComposioTools`, `getRawComposioToolBySlug`, `getRawToolRouterSessionTools`, `execute`, `executeSessionTool`, `getToolsEnum`, `getInput`, `proxyExecute` - **Toolkits**: `get`, `listCategories` - **AuthConfigs**: `list`, `create`, `get`, `update`, `delete`, `updateStatus`, `enable`, `disable` - **ConnectedAccounts**: `list`, `get`, `delete`, `refresh`, `updateStatus`, `enable`, `disable`, `update` - **Triggers**: `listActive`, `create`, `update`, `delete`, `enable`, `disable`, `listTypes`, `getType`, `listEnum` - **MCP**: `create`, `list`, `get`, `delete`, `update`, `generate` - **ToolRouter** (`composio.create` / `composio.use`, `composio.toolRouter.create` / `.use`) — long-running session-creation paths - **ToolRouterSession**: `authorize`, `toolkits`, `search`, `execute`, `proxyExecute`, `update` ### Custom-tool cooperative cancellation Native tool execution is cancelled by the SDK (the underlying `fetch` is aborted). Custom tools are different — the SDK can't preempt user-supplied JavaScript. Two affordances are added so callers get sensible behavior anyway: 1. **Pre-execute signal check**: if `signal.aborted` is true before the user's `execute` runs, the SDK throws `ComposioRequestCancelledError` and never invokes user code. 2. **Cooperative signal forwarding**: the same `AbortSignal` is exposed via `SessionContext.signal` for Tool Router custom tools. Long-running implementations can wire `ctx.signal` into their own `fetch` (or any abortable IO) to abort mid-execution; the resulting `AbortError` is normalized to `ComposioRequestCancelledError` by the SDK. ```typescript import { experimental_createTool } from '@composio/core'; const longRunningFetch = experimental_createTool('LONG_RUNNING_FETCH', { name: 'Long-running fetch', description: 'Fetches a URL with cooperative cancellation', inputParams: z.object({ url: z.string() }), execute: async (input, ctx) => { // Pass ctx.signal into fetch so a session.execute(...) abort cancels // the in-flight HTTP request mid-flight. const resp = await fetch(input.url, { signal: ctx.signal }); return { result: await resp.json() }; }, }); ``` -025a657: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. -4b76dbf: Remove the deprecated `uuid` field from the auth config retrieve/list response type. The platform has removed the deprecated V1/V2 UUID-mirror field from V3 API responses (it was a mirror of the canonical nanoid `id`). The SDK no longer reads or re-exposes `uuid` on `AuthConfigRetrieveResponse` (and therefore on the items of `AuthConfigListResponse`). This is technically a breaking change to the SDK response type: consumers should use `id` instead of `uuid`. The `expectedInputFields` field is unaffected — it remains a top-level field on the API response. ### Patch Changes -552859a: Expose `search` and `showDisabled` filters on `authConfigs.list()`. -23f9053: Replace `chalk` with `picocolors` for colored error and log output. The two render identically, but `picocolors` is a fraction of the size (~0.8 kB gzipped vs chalk's much larger footprint), shrinking the bundled package. -507318d: Add a provider-agnostic JSON-schema property-key sanitizer: `sanitizeSchemaPropertyKeys(schema, policy)`, `restoreOriginalKeys(value, mapping)`, `mappingHasRenames(mapping)`, and the `KeyMapping` / `KeySanitizationPolicy` types. Some providers constrain the characters and length of tool `input_schema` property keys and reject the whole request on a single violation. This utility rewrites offending keys to conforming aliases (recursing through `properties`, array `items`/`prefixItems`, the composition keywords `allOf`/`anyOf`/`oneOf` and `not`/`if`/`then`/`else`, plus `additionalProperties`/`patternProperties`/`$defs`/`contains`) and records a schema-shaped reverse mapping so the original parameter names can be restored before execution. The _constraint_ is injected as a `KeySanitizationPolicy`, so the traversal, collision handling, prototype safety, and depth cap stay provider-agnostic. The `@composio/anthropic` provider now consumes it. -6a4cb54: Preserve root `$defs` / `definitions` blocks on tool parameter schemas and dereference them in the Node file modifier, so auto file upload/download detection works when `file_uploadable` or `file_downloadable` is hidden behind an internal `$ref`. -cbbad15: Improve Zod compatibility at the SDK schema boundary. Custom tools now convert both `zod/v3` and Zod v4 schemas to JSON Schema correctly instead of degrading Zod v4 object schemas to empty schemas. `@composio/core` now exposes `jsonSchemaToZodShape` via `@composio/core/utils/json-schema`, and the Claude Agent SDK provider uses that core subpath instead of converting to a full Zod object and casting `.shape` out of it. - Updated dependencies [025a657] - @composio/json-schema-to-zod@0.2.0 ## @composio/json-schema-to-zod@0.2.0 ### Minor Changes -025a657: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ## @composio/anthropic@0.10.0 ### Minor Changes -025a657: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ### Patch Changes -507318d: Harden the Anthropic tool property-key sanitizer: - **Broader schema coverage.** Illegal keys are now sanitized wherever they appear in a tool schema — under the composition keywords (`allOf`/`anyOf`/`oneOf`, `not`/`if`/`then`/`else`), `prefixItems` tuples, `additionalProperties`/`patternProperties`, and `$defs`/`definitions` — not just top-level `properties` and array `items`. Previously a single illegal key under one of these would still 400 the entire request. Renames inside composition keywords are restored correctly (they fold into the value level they share). - **`$ref` keys restored.** `wrapTool` now dereferences internal `$ref`/`$defs` (leniently — a dangling ref degrades to a permissive schema instead of throwing) before sanitizing, so keys reachable only through a reference are both made compliant and restored. Only genuinely dynamic positions (`additionalProperties`, `patternProperties`, `contains`) remain rewrite-only. - **Shared core implementation.** The traversal/restoration mechanism now lives in `@composio/core` (`sanitizeSchemaPropertyKeys` / `restoreOriginalKeys`); this provider supplies only the Anthropic key constraint as a policy, reusing core's prototype-pollution guard and depth cap. - **Prototype-safe key restoration.** Reverse-mapping lookups and the rebuilt argument object are now prototype-free, so a tool call whose arguments use a key matching an `Object.prototype` member (`__proto__`, `constructor`, `toString`, `hasOwnProperty`, …) no longer throws or silently corrupts the payload sent to the backend. `Object.prototype` is never mutated. - **Depth cap.** Schema sanitization and key restoration now bound recursion (matching core's JSON-schema walker) so a pathologically deep schema or argument object fails with a clear error instead of overflowing the stack. - **Empty / all-illegal keys.** A property key that is empty (or made entirely of stripped characters) now becomes a deterministic non-empty alias instead of an empty string, which would itself have violated Anthropic's `{1,64}` length bound. - **Collision loop.** Replaced a latent non-terminating fixed point in the alias collision resolver with a counter that always makes progress. - **Observability.** The provider now emits `debug` logs when it rewrites a tool's schema keys and when it restores them at execution time, and the wrap-then-execute (same provider instance) contract for key restoration is documented. -c90ae95: Sanitize tool `input_schema` property keys that violate Anthropic's `^[a-zA-Z0-9_.-]{1,64}$` constraint before sending tools to the Messages API, then restore the original names when the tool is executed. A single non-conforming key previously made Anthropic reject the entire `tools` array with HTTP 400, taking down every other tool in the same request. This commonly happened with OneDrive's Microsoft Graph OData parameters (`$top`, `$filter`, `@microsoft.graph.conflictBehavior`) and with over-long flattened keys from tools such as Zoom. Offending keys are now rewritten to conforming aliases (`$` → `dollar_`, `@` → `at_`, any other illegal character → `_`, keys longer than 64 characters truncated with a deterministic suffix), recursing through nested object `properties` and array `items` schemas. The original parameter names are restored before the call reaches the Composio backend, so the model sees `dollar_top` while the backend still receives `$top`. Schemas whose keys already conform are left unchanged. ## @composio/claude-agent-sdk@0.10.0 ### Minor Changes -025a657: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ### Patch Changes -cbbad15: Improve Zod compatibility at the SDK schema boundary. Custom tools now convert both `zod/v3` and Zod v4 schemas to JSON Schema correctly instead of degrading Zod v4 object schemas to empty schemas. `@composio/core` now exposes `jsonSchemaToZodShape` via `@composio/core/utils/json-schema`, and the Claude Agent SDK provider uses that core subpath instead of converting to a full Zod object and casting `.shape` out of it. ## @composio/cloudflare@0.10.0 ### Minor Changes -025a657: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ## @composio/google@0.10.0 ### Minor Changes -025a657: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ## @composio/langchain@0.10.0 ### Minor Changes -025a657: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ## @composio/llamaindex@0.10.0 ### Minor Changes -025a657: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ## @composio/mastra@0.10.0 ### Minor Changes -025a657: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ### Patch Changes -aaabf5e: Relax the Mastra provider output schema so real third-party API responses are no longer rejected by Mastra's output validation (which dropped the data and substituted an error). Before compilation the output schema is made lenient: every typed node becomes nullable, objects allow extra keys (`additionalProperties: true`), `enum`/`const` are widened to also admit `null`, and `required` is dropped (APIs omit unset fields rather than returning `null` for them). All of these only widen what validates, so previously-valid output is unaffected. ## @composio/openai@0.10.0 ### Minor Changes -025a657: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ## @composio/openai-agents@0.10.0 ### Minor Changes -025a657: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ## @composio/vercel@0.10.0 ### Minor Changes -025a657: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ## @composio/ts-builders@0.2.0 ### Minor Changes -025a657: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ## @composio/cli@0.3.0 ### Minor Changes -a0bef5d: Bump `@composio/client` to `0.1.0-alpha.74`. -025a657: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ### Patch Changes -5f004ff: Drop `COMPOSIO_UPSERT_RECIPE` and `COMPOSIO_GET_RECIPE` from the CLI meta-tool list. These slugs were removed from `@composio/client` (alpha.74), so listing them broke the type-checked CLI build. -23f9053: Remove the unused `ansis` dependency from the CLI. Colored output is already handled by `picocolors`, so `ansis` was a dead production dependency that shipped with the package. -446c6f6: Fix virtual TypeScript file resolution used by CLI type generation so in-memory imports resolve consistently during transpilation and validation. - Updated dependencies [552859a] - Updated dependencies [a0bef5d] - Updated dependencies [23f9053] - Updated dependencies [dfd7a08] - Updated dependencies [507318d] - Updated dependencies [025a657] - Updated dependencies [6a4cb54] - Updated dependencies [4b76dbf] - Updated dependencies [cbbad15] - @composio/core@0.12.0 - @composio/json-schema-to-zod@0.2.0 - @composio/ts-builders@0.2.0 - @composio/cli-keyring@0.2.0 - @composio/cli-local-tools@0.1.0 ## @composio/cli-keyring@0.2.0 ### Minor Changes -025a657: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ## @composio/cli-local-tools@0.1.0 ### Minor Changes -025a657: Drop CommonJS entrypoints and publish the TypeScript SDK packages as ESM-only packages. This is a breaking change within the existing 0.x release line: consumers must use Node.js 22.22.3 or newer. CommonJS callers can only rely on Node's native `require(esm)` interop, and the SDK no longer ships custom CommonJS compatibility machinery or `.cjs` artifacts. ### Patch Changes - Updated dependencies [552859a] - Updated dependencies [a0bef5d] - Updated dependencies [23f9053] - Updated dependencies [dfd7a08] - Updated dependencies [507318d] - Updated dependencies [025a657] - Updated dependencies [6a4cb54] - Updated dependencies [4b76dbf] - Updated dependencies [cbbad15] - @composio/core@0.12.0 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This repository contains the official Software Development Kits (SDKs) for Composio, providing seamless integration capabilities for Python and Typescript Agentic Frameworks and Libraries.
Getting Started
TypeScript SDK Installation
# Using npm
npm install @composio/core
# Using yarn
yarn add @composio/core
# Using pnpm
pnpm add @composio/core
Quick start:
import { Composio } from '@composio/core';
// Initialize the SDK
const composio = new Composio({
// apiKey: 'your-api-key',
});
Simple Agent with OpenAI Agents
npm install @composio/openai-agents @openai/agents
import { Composio } from '@composio/core';
import { OpenAIAgentsProvider } from '@composio/openai-agents';
import { Agent, run } from '@openai/agents';
const composio = new Composio({
provider: new OpenAIAgentsProvider(),
});
const userId = 'user@acme.org';
const tools = await composio.tools.get(userId, {
toolkits: ['HACKERNEWS'],
});
const agent = new Agent({
name: 'Hackernews assistant',
tools: tools,
});
const result = await run(agent, 'What is the latest hackernews post about?');
console.log(JSON.stringify(result.finalOutput, null, 2));
// will return the response from the agent with data from HACKERNEWS API.
Python SDK Installation
# Using pip
pip install composio
# Using poetry
poetry add composio
Quick start:
from composio import Composio
composio = Composio(
# api_key="your-api-key",
)
Simple Agent with OpenAI Agents
pip install composio_openai_agents openai-agents
import asyncio
from agents import Agent, Runner
from composio import Composio
from composio_openai_agents import OpenAIAgentsProvider
# Initialize Composio client with OpenAI Agents Provider
composio = Composio(provider=OpenAIAgentsProvider())
user_id = "user@acme.org"
tools = composio.tools.get(user_id=user_id, toolkits=["HACKERNEWS"])
# Create an agent with the tools
agent = Agent(
name="Hackernews Agent",
instructions="You are a helpful assistant.",
tools=tools,
)
# Run the agent
async def main():
result = await Runner.run(
starting_agent=agent,
input="What's the latest Hackernews post about?",
)
print(result.final_output)
asyncio.run(main())
# will return the response from the agent with data from HACKERNEWS API.
For more detailed usage instructions and examples, please refer to each SDK's specific documentation.
Open API Specification
To update the OpenAPI specifications used for generating SDK documentation:
# Pull the latest API specifications from the backend
pnpm api:pull
This command pulls the OpenAPI specification from https://backend.composio.dev/api/v3/openapi.json and updates the local API documentation files.
This is pulled automatically with build step.
Available SDKs
TypeScript SDK (/ts)
The TypeScript SDK provides a modern, type-safe way to interact with Composio's services. It's designed for both Node.js and browser environments, offering full TypeScript support with comprehensive type definitions.
For detailed information about the TypeScript SDK, please refer to the TypeScript SDK Documentation.
Python SDK (/python)
The Python SDK offers a Pythonic interface to Composio's services, making it easy to integrate Composio into your Python applications. It supports Python 3.10+ and follows modern Python development practices.
For detailed information about the Python SDK, please refer to the Python SDK Documentation.
Provider Support
The following table shows which AI frameworks and platforms are supported in each SDK:
| Provider | TypeScript | Python |
|---|---|---|
| OpenAI | ✅ | ✅ |
| OpenAI Agents | ✅ | ✅ |
| Anthropic | ✅ | ✅ |
| LangChain | ✅ | ✅ |
| LangGraph | ✅* | ✅ |
| LlamaIndex | ✅ | ✅ |
| Vercel AI SDK | ✅ | ❌ |
| Google Gemini | ✅ | ✅ |
| Google ADK | ❌ | ✅ |
| Mastra | ✅ | ❌ |
| Cloudflare Workers AI | ✅ | ❌ |
| CrewAI | ❌ | ✅ |
| AutoGen | ❌ | ✅ |
* LangGraph in TypeScript is supported via the @composio/langchain package.
Don't see your provider? Learn how to build a custom provider to integrate with any AI framework.
Packages
Core Packages
| Package | Version |
|---|---|
| TypeScript | |
| @composio/core | |
| Python | |
| composio |
Provider Packages
Utility Packages
| Package | Version |
|---|---|
| @composio/json-schema-to-zod | |
| @composio/ts-builders |
if you are looking for the older sdk, you can find them here
Rube
Rube is a Model Context Protocol (MCP) server built with Composio. It connects your AI tools to 500+ apps like Gmail, Slack, GitHub, and Notion. Simply install it in your AI client, authenticate once with your apps, and start asking your AI to perform real actions like "Send an email" or "Create a task."
It integrates with major AI clients like Cursor, Claude Desktop, VS Code, Claude Code and any custom MCP‑compatible client. You can switch between these clients and your integrations follow you.
Contributing
We welcome contributions to both SDKs! Please read our contribution guidelines before submitting pull requests.
License
This project is licensed under the MIT License - see the LICENSE file for details.
Support
If you encounter any issues or have questions about the SDKs:
- Open an issue in this repository
- Contact our support team
- Check our documentation
