Composio vs Metorial (2026)

Each session gives an agent tools from more than 1,500 toolkits, scoped to one of the customer's users, and Composio manages the OAuth redirects, token exchange and refresh behind them. The agent can pause in the middle of a chat, send the user a Connect Link and retry the tool once the account is connected, and the connection persists for later sessions.

Tools run on the server with the credential injected, never handed to the model. Tool search finds the right tools for a task, custom tools and MCP servers sit alongside the catalog, and Instant tools let an agent call paid third party services such as search and enrichment from a Composio balance without the user opening provider accounts.

Sourcedocs.composio.dev/docs/how-composio-worksread 2026-10-24

More than 1,000 catalog integrations are available, each deployed as a provider with its own config and per user authentication (OAuth through Provider Setup Sessions, API tokens or custom credentials). Their tools reach the agent through a session's MCP URL or direct tool calls on the API. Customers add their own tools as custom providers deployed from code, container images or remote MCP servers, and can use their own OAuth apps.

Sourcemetorial.com/docs/build/operate/providersread 2026-09-22

The sandbox is a persistent Python environment where the agent writes code that calls tools programmatically, with helpers for tool execution, LLM calls, file uploads, direct API calls and web search, error correction on generated code, and state that persists across calls, and a MULTI_EXECUTE meta tool runs several tool calls together. There is no workflow definition, versioned flow, or sequencing and branching that combine deterministic workflow nodes with autonomous agent steps.

Sourcedocs.composio.dev/docs/sandbox/remoteread 2026-10-24

Agents connect to tools through Metorial, which does not run the agent itself. Sessions merge the tools of several providers behind one connection. Magic Skills package instructions, files and optional scripts that the customer's AI client or agent follows when it invokes the skill. Sequencing and branching happen in that client or in the customer's framework, and Metorial has no workflow runtime of its own.

Sourcemetorial.com/docs/platform/workforce/magic-skillsread 2026-09-22

Triggers react to events in connected apps and deliver them to the customer's webhook as structured payloads. A trigger can be activated for a user, events arrive through an SDK subscription or in production, and trigger instances can be listed, enabled, disabled and deleted. A worked example runs an agent when an email arrives.

Sourcedocs.composio.dev/docs/triggersread 2026-10-24

Providers expose triggers that fire on events in the external system. A callback, which is a webhook Metorial registers against every matching integration instance, notifies the customer's application so it can run event driven workflows. Callbacks are a metered plan feature, with 10,000 a month on Dev and 100,000 on Scale.

Sourcemetorial.com/docs/build/glossaryread 2026-09-22

There is no retrieval structure Composio maintains over the customer's own documents. Its search finds the right tools for a task, and its sandbox can extract text from files an agent is working on.

Sourcedocs.composio.dev/docs/how-composio-worksread 2026-10-24

Agents get live access, through Metorial's integrations, to the systems that hold company knowledge, such as Google Drive, Notion and Confluence. A Magic Skill can carry reference documents for its instructions. There is no index, retrieval layer or semantic search over the customer's corpus. The API has Documents and Stores resources, but Metorial does not present them as retrieval.

Sourcemetorial.com/docs/platform/get-started/core-conceptsread 2026-09-22

A Composio session scopes execution state for the run, covering logs, tool memory, MCP state and sandbox files, with sandbox variables and runtime state persisting across calls and cleared after roughly 12 hours of inactivity, and sessions can be reused, updated and deleted. The scope (the session and its user) and the lifetime are stated. This is state carried through one task, and there is no memory layer the agent draws on across runs.

Sourcedocs.composio.dev/docs/security/data-retentionread 2026-10-24

Sessions are lightweight runtime contexts created per request or per user interaction. Metorial stores each user's provider credentials as auth configs for reuse. There is no memory layer that keeps an agent's context across runs.

Sourcemetorial.com/docs/build/operate/sessionsread 2026-09-22

A session can require the user's approval before chosen tools run. The customer picks them by tag, such as tools that create, update or delete something, and can set different rules for each toolkit or tool. When the agent calls one of those tools, Composio does not run it. It asks the user to approve the call, runs the tool once the user answers, and passes a decline or cancel back unchanged, and an MCP client that cannot ask can be set to deny or allow by default.

Approvals arrived in October 2026 and are still marked experimental. Firewall adds checks written in plain language that block a tool call before it runs or a result before the agent sees it, with a built in check for prompt injection in tool results. The customer also chooses which toolkits and tools a session exposes, and scoped API keys keep session management apart from tool execution.

Sourcedocs.composio.dev/docs/approvalsread 2026-10-24

Several controls constrain what agents may do. Access groups decide which integrations and skills each user or SSO group sees. People request more access, and administrators review and resolve those requests. Session tool filters can restrict a provider to read only tools, and Protoguard screens each message and tool call, blocking prompt injection and requests outside the customer's policies. No person approves a specific agent action before it commits.

Sourcemetorial.com/docs/platform/workforce/portalsread 2026-09-22

Composio is SOC 2 Type II attested and ISO 27001:2022 certified, with the SOC 2 report and sub processor list in its Trust Center at trust.composio.dev. Access controls include organization and project isolation, scoped project API keys that keep session management apart from tool execution with an IP allowlist for each key, MFA an organization admin can enforce, and signed webhook deliveries.

Credentials stay out of the model's context, APIs no longer return connected account tokens or custom OAuth client secrets, OAuth credentials use envelope encryption, and API keys are stored only as hashes. Composio disclosed a security incident in May 2026, in which an attacker reached internal systems and customer credentials, and its September update lists that remediation, a rebuilt tool building service and independent assessors who re-verified the fixes. Enterprise adds SAML or OIDC SSO with SCIM provisioning and customer managed keys.

Sourcecomposio.dev/blog/composio-may-2026-security-incidentread 2026-10-24

The platform is SOC 2 Type 2 compliant, independently audited for security, availability and confidentiality, with reports under NDA. It is also GDPR compliant, with a DPA and a published subprocessor list, and Metorial displays a SOC 2 badge on its homepage. Access uses SSO and SAML with per user and per group policies, and roles are named permission sets attached to members and teams. SCIM and SAML IdP sign in are offered too, and secrets are encrypted in Vault with keys managed through KMS. RBAC and SAML SSO come with the Enterprise plan.

Sourcemetorial.com/securityread 2026-09-22

Every tool execution and trigger event is logged with the toolkit and action, status, connection and auth config IDs, the supplied user ID, timing and source, and by default the request arguments and response data, kept for up to a year. Enterprise sets its own retention, from 7 days to a year, and zero data retention keeps only metadata. A Logs API and both SDKs search records by user, tool and status, and records export as CSV or into a SIEM or observability platform.

Sourcedocs.composio.dev/docs/poc-to-prod/stream-logs-to-a-siemread 2026-10-24

Connection logs record what agents did. Each session has a timeline, and every tool call opens to its tool name, arguments and result. Logs filter across sessions by status, source and agent, with tool errors listed separately. Workforce shows each agent's operations and connection history tied to its linked identity. The logs also carry provider auth and Protoguard events, and the Tool Calls API exposes inputs, outputs and status. Log retention is 30 days on Dev, 90 on Scale and custom on Enterprise.

Sourcemetorial.com/docs/platform/integrations/review-connection-logsread 2026-09-22

Customers choose among four deployment options, each with its own credential boundary. Besides Composio Cloud there is a private VPC deployment inside the customer's network boundary, a self hosted deployment in the customer's environment with Helm support, and a deployment with customer managed keys, where a proxy in the customer's cloud holds credential plaintext under keys in its own KMS (AWS KMS, Google Cloud KMS or HashiCorp Vault Transit).

Sourcedocs.composio.dev/docs/security/token-custodyread 2026-10-24

Deployment can sit in Metorial's cloud or the customer's. On premises deployment runs in the customer's own cloud or data center, and customers can choose EU or US regions for data residency. Each provider runs in its own isolated enclave behind firewalls. On premises deployment comes with the Enterprise plan.

Sourcemetorial.com/securityread 2026-09-22

There is no agent or workflow a customer adopts whole. Composio ships toolkits and meta tools that let an agent find and run actions, plus example applications. Its skills are execution playbooks for single tasks, such as sending a Slack message, derived from real usage and returned with tool search as ordered steps and known pitfalls. Nothing is installed or chosen, so they guide the customer's own agent rather than arriving as ready made workflows, templates or agents for particular roles.

Sourcedocs.composio.dev/docs/skillsread 2026-10-24

Metorial supplies the tools to package a customer's own workflows. Magic Skills come with templates, groups and curated skill marketplaces, imports from public repositories, and portals that publish them to users. The skills in those catalogs are written by the customer's own experts. The integration catalog is a set of integrations, and the three sample apps in the docs are tutorial code. Metorial ships no ready made skill, template or role specific agent of its own.

Sourcemetorial.com/docs/platform/workforce/magic-skillsread 2026-09-22

The agent and its model stay entirely the customer's. Composio never proxies the customer's LLM or runs an agent on its behalf, and its provider adapters serve tools to whatever framework and model the customer runs, so the model is the customer's choice throughout.

Sourcedocs.composio.dev/docs/sandbox/remoteread 2026-10-24

Tools reach whatever model the customer runs. The provider runtime formats session tools for OpenAI, Anthropic, Google Gemini and OpenAI compatible APIs such as DeepSeek, Together AI and xAI, and for the Vercel AI SDK, each called with the customer's own provider key. Any MCP client, such as Cursor, Claude Code or Codex, can connect. Metorial names no model of its own, so the model, provider and key are always the customer's choice.

Sourcemetorial.com/docs/build/providersread 2026-09-22

Developers get Python and TypeScript SDKs, a CLI, a current REST API (v3.1) with a published reference, provider adapters for the major agent frameworks, sessions exposed over MCP, single-toolkit MCP servers and an agent skill for wiring Composio into a coding agent.

Sourcedocs.composio.dev/llms.txtread 2026-10-24

A REST API with keys scoped to one environment makes Metorial callable from outside. It covers providers, deployments, sessions, tool calls, skills, portals and callbacks, alongside JavaScript and Python SDKs and a CLI. Metorial serves MCP as addressed endpoints, a session connection URL and Magic MCP URLs. Customers package their own tools as versioned custom providers with rollback.

Sourcemetorial.com/docs/build/apiread 2026-09-22

There is no evaluation harness, scored test cases, quality gate or optimization loop after deployment for the customer's agent. Composio's guidance covers building, authenticating and running tools, with advice on production readiness and rate limits, but no gate or debugging path for agent behavior.

Sourcedocs.composio.dev/llms.txtread 2026-10-24

Customers can test before production. Sandbox environments have their own deployments, keys, auth configs and logs, and a development key never reaches production. Metorial Explorer calls a provider's tools against test data, and custom providers have version pinning and instant rollback. There is no way to evaluate the customer's agent with a readable, comparable result such as scored test cases, a pass rate or a judge verdict.

Sourcemetorial.com/docs/build/operate/organizations-and-projectsread 2026-09-22

Composio's Browser Tool gives an agent a cloud browser for sites with no API. The agent hands it a task in plain language, and a browser agent navigates, clicks, fills forms, handles multi step logins and returns the data or any files it produced.

A live link lets the user watch the browser as it works, a session can be reused so logins and cookies carry over to the next task, and a stuck task can be stopped. The agent sets the task rather than steering each step, and there is no desktop or remote computer session. Separately, the sandbox runs code, which is code execution rather than computer use.

Sourcedocs.composio.dev/toolkits/browser_toolread 2026-10-24

Everything runs through APIs and MCP servers, which is how Metorial's providers reach applications. Metorial has no browser, desktop or remote machine control of its own.

Sourcemetorial.com/docs/build/operate/providersread 2026-09-22