Composio

The trait that decides it is per-user authentication. Every agent that touches a real application eventually hits the same wall: consent screens, refresh tokens and a different quirk for every provider, all multiplied by the number of your customers. This handles that layer, and it is the least enjoyable code you will ever avoid writing.

Skip it if your agent only ever acts as one service account, because then you are paying for a problem you do not have. Pick n8n instead when you want the orchestration too, not just the connections.

The concentration is the risk. Credentials for a thousand applications, held per end user, live with a third party so your agents can act without holding them. That is a real convenience and it also means a compromise or an outage there is not degraded service, it is total loss of every connected capability simultaneously, and a credential rotation you would have to explain to your own customers.

Ask for the incident history and the isolation model before designing around it. What it does right: tool execution happens in a sandbox rather than in the calling process.

The arithmetic forces the design. A thousand toolkits cannot be described in a prompt, so the schemas presented to a model must be chosen before the model chooses among them, which turns tool selection into a two-stage retrieval problem. Recognising that explicitly is correct and most catalogues of this size do not.

The unanswered question is recall at the first stage. If the right toolkit is not retrieved, the model cannot select it and will confidently substitute another, and no measurement of that rate is published. Triggers add an event-driven entry point to the same machinery.

The pricing design is smart. Bundling the first month of consumption into the subscription price makes the entry decision feel like a flat fee while leaving the meter running underneath, so revenue per account grows with usage without a renegotiation or a churn event.

The moat is better than the pricing. Once an agent's users have granted access through this provider, moving means asking every one of them to authorise again, and product teams will do almost anything to avoid that request. Likely acquirer: an agent platform or a workflow vendor buying the connector estate. Position: long, on the switching cost.

Consumption pricing means finance gets an estimate instead of a number, and the estimate depends on how chatty our agents turn out to be, which nobody knows before shipping. A hundred thousand calls and fifty thousand events a month are free, then it is three ten-thousandths of a dollar per call, and anything beyond the standard tier is a conversation with sales.

It runs unattended, which suits our services. The condition is a spend cap and a monthly review before anything customer-facing depends on it. Approved with conditions, and one engineer named as the owner of that meter.

The client side is MIT and available from both package managers plus a shell installer, and the adapters mean I can drop it into whichever framework I am already using rather than restructuring around it. Exposing MCP endpoints is genuinely useful: my Claude client gets a thousand toolkits without me writing a server.

What it will not do is consume MCP, so the servers I already run stay invisible to it and I end up maintaining two tool inventories. That is the kind of asymmetry that exists because it suits the vendor, and it is the one thing I would change.