
Security News
npm Adopts OIDC for Trusted Publishing in CI/CD Workflows
npm now supports Trusted Publishing with OIDC, enabling secure package publishing directly from CI/CD workflows without relying on long-lived tokens.
@composio/core
Advanced tools
The core Composio SDK which allows users to interact with the Composio Platform. It provides a powerful and flexible way to manage and execute tools, handle authentication, and integrate with various platforms and frameworks.
The core Composio SDK which allows users to interact with the Composio Platform. It provides a powerful and flexible way to manage and execute tools, handle authentication, and integrate with various platforms and frameworks.
npm install @composio/core
# or
yarn add @composio/core
# or
pnpm add @composio/core
import { Composio } from '@composio/core';
import { OpenAIProvider } from '@composio/openai';
const composio = new Composio({
apiKey: process.env.COMPOSIO_API_KEY,
// OpenAIProvider is the default, so this is optional
provider: new OpenAIProvider(),
});
// Fetch a single tool by slig
const tools = await composio.tools.get('user123', 'HACKERNEWS_SEARCH_POSTS');
// Fetch multiple tools
const tools = await composio.tools.get('user123', {
category: 'search',
limit: 10,
});
The Composio constructor accepts the following configuration options:
interface ComposioConfig {
apiKey?: string; // Your Composio API key
baseURL?: string; // Custom API base URL (optional)
allowTracking?: boolean; // Enable/disable telemetry (default: true)
allowTracing?: boolean; // Enable/disable tracing (default: true)
provider?: TProvider; // Custom provider (default: OpenAIProvider)
host?: string; // Name of the host service which is using the SDK, this is for telemetry.
}
Composio SDK supports powerful modifiers to transform tool schemas and execution behavior.
Schema modifiers allow you to transform tool schemas before they are used:
const tools = await composio.tools.get('user123', 'HACKERNEWS_SEARCH_POSTS', {
modifySchema: (toolSlug: string, toolkitSlug: string, tool: Tool) => ({
...tool,
description: 'Enhanced HackerNews search with additional features',
inputParameters: {
...tool.inputParameters,
limit: {
type: 'number',
description: 'Maximum number of posts to return',
default: 10,
},
},
}),
});
For agentic providers (like Vercel AI and Langchain), you can also modify tool execution behavior:
const tools = await composio.tools.get('user123', 'HACKERNEWS_SEARCH_POSTS', {
// Transform input before execution
beforeExecute: (toolSlug: string, toolkitSlug: string, params: ToolExecuteParams) => ({
...params,
arguments: {
...params.arguments,
limit: Math.min((params.arguments?.limit as number) || 10, 100),
},
}),
// Transform output after execution
afterExecute: (toolSlug: string, toolkitSlug: string, response: ToolExecuteResponse) => ({
...response,
data: {
...response.data,
posts: (response.data?.posts as any[]).map(post => ({
...post,
url: post.url || `https://news.ycombinator.com/item?id=${post.id}`,
})),
},
}),
});
Composio SDK provides a powerful way to manage third-party service connections through Connected Accounts. This feature allows you to authenticate with various services and maintain those connections.
import { Composio } from '@composio/core';
const composio = new Composio({
apiKey: process.env.COMPOSIO_API_KEY,
});
// Create a connected account
const connectionRequest = await composio.createConnectedAccount(
'user123', // userId
'HACKERNEWS', // authConfigId
{
redirectUrl: 'https://your-app.com/callback',
data: {
// Additional data for the connection
scope: ['read', 'write'],
},
}
);
// Wait for the connection to be established
// Default timeout is 60 seconds
const connectedAccount = await connectionRequest.waitForConnection();
The waitForConnection
method is available on both the ConnectionRequest
and ConnectedAccounts
classes. It allows you to poll for a connection to become active:
// From a ConnectionRequest instance (returned by createConnectedAccount)
const connectedAccount = await connectionRequest.waitForConnection(120000); // 2 minute timeout
// From the ConnectedAccounts class (using a connected account ID)
const connectedAccount = await composio.connectedAccounts.waitForConnection('conn_abc123', 60000); // 1 minute timeout
The method continuously polls the Composio API until the connection:
ACTIVE
(returns the connected account)FAILED
, EXPIRED
, or DELETED
(throws an error)If the connection does not complete within the provided timeout (default: 60 seconds), a ConnectionRequestTimeoutError
is thrown.
// List all connected accounts
const accounts = await composio.connectedAccounts.list({
userId: 'user123',
});
// Get a specific connected account
const account = await composio.connectedAccounts.get('account_id');
// Enable/Disable a connected account
await composio.connectedAccounts.enable('account_id');
await composio.connectedAccounts.disable('account_id');
// Refresh credentials
await composio.connectedAccounts.refresh('account_id');
// Delete a connected account
await composio.connectedAccounts.delete('account_id');
Connected accounts can have the following statuses:
ACTIVE
: Connection is established and workingINACTIVE
: Connection is temporarily disabledPENDING
: Connection is being processedINITIATED
: Connection request has startedEXPIRED
: Connection credentials have expiredFAILED
: Connection attempt failedComposio supports various authentication schemes:
COMPOSIO_API_KEY
: Your Composio API keyCOMPOSIO_BASE_URL
: Custom API base URLCOMPOSIO_LOGGING_LEVEL
: Logging level (silent, error, warn, info, debug)DEVELOPMENT
: Development mode flagCI
: CI environment flagWe welcome contributions! Please see our Contributing Guide for more details.
ISC License
For support, please visit our Documentation or join our Discord Community.
FAQs
The core Composio SDK which allows users to interact with the Composio Platform. It provides a powerful and flexible way to manage and execute tools, handle authentication, and integrate with various platforms and frameworks.
The npm package @composio/core receives a total of 4,158 weekly downloads. As such, @composio/core popularity was classified as popular.
We found that @composio/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
npm now supports Trusted Publishing with OIDC, enabling secure package publishing directly from CI/CD workflows without relying on long-lived tokens.
Research
/Security News
A RubyGems malware campaign used 60 malicious packages posing as automation tools to steal credentials from social media and marketing tool users.
Security News
The CNA Scorecard ranks CVE issuers by data completeness, revealing major gaps in patch info and software identifiers across thousands of vulnerabilities.