$ show ComposioHQ/composio
Composio is a production-grade, dual-language SDK monorepo that connects AI agents to external services (Gmail, GitHub, Slack, Notion, Salesforce, and hundreds more) through a unified tool abstraction. In production it operates as the client layer of the Composio platform: applications create a Composio session bound to a user_id, discover toolkits, manage OAuth auth-configs and connected accounts, and execute tool calls either remotely or via a session-scoped Tool Router that also exposes hosted MCP endpoints. The repository ships a TypeScript SDK (@composio/core), a Python SDK (composio), a standalone Effect-TS-based CLI, 15+ framework provider adapters (OpenAI, Anthropic, LangChain, LlamaIndex, CrewAI, AutoGen, Mastra, Vercel AI, Google/ADK, etc.), and a Next.js documentation site. It is unambiguously an application/developer-platform repo rather than data research, although it contains data-adjacent engineering assets: a cross-SDK JSON Schema conversion corpus, OpenAPI dereferencing tooling, a knowledge-base hybrid-search index, and telemetry redaction utilities.
The LLM identified 6 files worth highlighting for reuse:
Converts JSON Schema (Draft 7) into runtime Zod schemas, including raw shape extraction (jsonSchemaToZodShape) and ReDoS-hardened regex handling. Validated by property-based tests against an Ajv oracle and a cross-language parity corpus shared with the Python SDK. Self-contained package, extractable for any project that needs to validate API payloads or LLM tool arguments at runtime from JSON Schema definitions.
OS-backed secret persistence for CLI credentials with JWE sealing (RSA-OAEP-256 + A256GCM) and platform stores for macOS Security framework (FFI with subprocess fallback) and Linux secret-tool, with an explicit unsupported-platform error. Isolated store abstraction; reusable for any CLI needing durable, encrypted API-key storage without home-dir plaintext.
Programmatic TypeScript source-generation toolkit: builders for imports, classes, interfaces, methods, properties, doc comments, unions, and function types, plus a virtual compiler host for validating generated code in-memory without disk I/O. Used to emit SDK/toolkit stubs; extractable into any codegen pipeline that produces TypeScript.
Dereferences local $ref/$defs in OpenAPI documents, handling cycles, sibling overrides, and external references; a companion openapi-deprecated.ts prunes deprecated fields for playground views while preserving the original contract. Reusable for API-docs renderers, schema validators, or any OpenAPI-consuming tooling.
Best-effort sensitive-text redaction (API keys, passwords, tokens, emails) applied to error messages and logs before they reach telemetry; paired with an equivalent redactSensitiveText utility in the TypeScript core. An SDK-end defense-in-depth pattern for any library that serializes or transmits error payloads.
Docker-based e2e runner that executes the CLI/SDK across runtime images (Node 22–25, Deno 2.6.7, Cloudflare Workers) with volume handling, image lifecycle management, and output sanitization. A transferable harness pattern for teams that need to prove a CLI works across multiple JS runtimes rather than a single CI job.