Automata vs Composio: open-source, self-hosted MCP compared

Composio and Automata both let an AI agent such as Claude, ChatGPT, or Cursor act on your accounts through MCP. They are built for different jobs, and they make opposite choices about where your credentials and data live.

Composio is a hosted integration platform. It connects agents to hundreds of SaaS apps through managed OAuth, and it is aimed at teams building AI products for their own users. Automata is an open-source MCP server you can run yourself. It connects AI clients to a small set of sources (WhatsApp, Telegram, email over IMAP, and PostgreSQL) and decides, on every request, exactly which chats, folders, and tables a client may touch.

We build Automata, so read this with that in mind. Every claim about Composio below links to Composio's own pages, checked in November 2026, and there is a section on where Composio is the better choice.

At a glance

What each product is

Composio gives agent developers one API key and a catalog of toolkits for apps such as Gmail, Slack, GitHub, Notion, and Salesforce. It handles the OAuth flow for your end users, refreshes their tokens, runs the tool calls on its servers, and exposes them through its SDKs or a hosted MCP endpoint. It raised a $25M Series A led by Lightspeed in 2025 (announcement) and its SDK repository has more than 30,000 GitHub stars.

Automata is narrower and deeper. A connection is exactly one WhatsApp account, Telegram account, mailbox, or Postgres database. You give each AI client a connector token, and the token decides which actions it can call and which chats, folders, or tables those actions can reach. Automata checks that scope on the server on every request, so a model cannot talk its way past it. See how Automata works.

Open source: the whole server, not just the SDK

Composio describes its main GitHub repository as “the Composio SDK monorepo”: TypeScript and Python SDKs, a CLI, and adapters for agent frameworks, all under the MIT license (GitHub). The part that stores your credentials and executes tool calls is not in it. That platform runs on Composio's servers, and its source is not public.

The Automata repository contains the whole thing under the MIT license: the web app and MCP endpoint, the permission checks, the Telegram bridge, and the Docker images built from them. That matters for a tool that sits between an AI model and your messages:

• You can audit the enforcement path. You can read exactly how a chat allowlist is applied to a search, or how a SQL query is refused when its plan touches a table you did not allow.
• You can verify what is stored. Our claims about what Automata logs are checkable in the source, not just in a policy page.
• You can change it. Fork it, add a connector, or harden it for your environment. The license allows it.

An open SDK lets you inspect the client. An open server lets you inspect the thing that holds your credentials and reads your data.

Self-hosting: a Docker command, not a sales call

Composio lists four deployment models in its token custody docs: Composio Cloud (the default), Private VPC, Self-hosted, and customer-managed keys. VPC and self-hosting are each an “Enterprise arrangement”, and the docs tell you to “contact Composio to establish the architecture and contractual requirements” (Composio docs). On every self-serve plan, your users' credentials live in Composio's cloud.

Automata's self-hosted edition is the same software as our hosted service, and anyone can run it:

git clone https://github.com/ju-li/automata-mcp.git && cd automata-mcp
cp .env.selfhost.example .env
# fill in the generated secrets and your public URL
docker compose up -d

If you would rather not run Docker, the one-click Railway template provisions the full stack, including Postgres and Redis, in a few minutes. A Postgres-only deployment needs just two services, the web app and its database. See the self-hosting guide.

Self-hosting means your messages, query results, and upstream credentials stay on a server you control, and a self-hosted deployment never sends us telemetry (telemetry docs).

Price: free, without a meter

Composio changed its pricing for signups from August 15, 2026 (pricing):

• Hobby, $0: 100,000 tool calls a month (up to 20,000 on Composio-managed apps), 3 team members, and 30 days of audit logs. Usage pauses at the cap.
• Pro, $29 a month: the fee comes as usage credit, then tool calls, trigger events, and connected accounts are metered. Zero data retention, IP allowlisting, and HIPAA BAAs are paid add-ons.
• Enterprise, custom: SSO, SCIM, customer-managed keys, and the VPC and self-hosted options above.

Composio's free tier is generous, and its Pro plan is reasonably priced for a business. The difference is structural: Composio is metered software, so your cost grows with your agents' usage.

Automata self-hosted is free, with no usage meter and no cap on connections or tool calls. You pay only for the server you run it on and your AI plan. If you would rather not operate anything, hosted Automata has a free tier. On the hosted free plan, Automata keeps a 30-day record of each tool call's name and the reason the AI gave for it; the Pro plan lets you turn that off.

Permissions: which chats and tables, not just which tools

Both products let you limit which tools an agent can call. Composio's session policies can allow specific tools per toolkit or filter tools by tags such as read-only or destructive, and OAuth scopes limit what the provider grants (Composio docs). Those are useful controls. They stop at the tool: once an agent can call “read messages”, nothing in Composio's policy limits which conversations it reads.

Automata adds a second, independent gate on resources:

• Chats. A WhatsApp or Telegram token lists only the chats you allowed. Reading or sending to any other chat is refused, and search is narrowed inside the database query rather than filtered afterwards.
• Folders. An email token sees only the IMAP folders you allow. It can save drafts but cannot send.
• Tables. A PostgreSQL token hides other tables, and Automata checks the query plan of every SQL statement before running it, refusing any query that touches a table off the list. Write tools start disabled. See how to give Claude read-only Postgres access safely.

Scopes load on every request, so editing a token takes effect on the next call, and each client gets its own token that you can revoke without touching the others. Read more about tokens and permissions.

This is the difference between “the agent can read WhatsApp” and “the agent can read the Suppliers group and the two client chats, and nothing else”.

Your own WhatsApp and Telegram, not a bot

If what you want is an AI that works with your conversations, the two products are not doing the same thing.

WhatsApp. Composio's WhatsApp toolkit is built on the WhatsApp Business API: sending template and interactive messages, managing business phone numbers, and similar (toolkit page). That is the right tool for a business that messages customers. It is not a way to read your personal or team chats. Automata pairs your existing WhatsApp account as a linked device, the same way WhatsApp Web does, so the AI can read and search the private chats and groups you allow, with history (WhatsApp MCP).

Telegram. Composio's Telegram toolkit uses the Bot API. A bot sees only chats it has been added to, and Composio's own docs warn that its chat history tool “is not complete chat history” (Composio docs). Automata links your personal Telegram account as an additional device, syncs new messages in real time, and backfills older history up to limits you set (Telegram MCP).

What gets logged

By default, Composio's execution logs store “the request arguments and response data” of every tool call and keep them for up to a year, on every plan (Composio docs). For a messaging or email toolkit, the response data is the messages. Zero data retention removes the payloads, but it is a paid add-on on Pro (about $0.0001 per call), included only in Enterprise, and not available on the free plan.

Automata never records tool arguments, results, message content, or query rows. When telemetry is on, it keeps the tool name, whether it worked, the client, and the one-line reason the AI gave, for 30 days. Self-hosted deployments have it off by default and never send it to us (telemetry docs).

Where your credentials live

A hosted integration platform holds OAuth tokens and API keys for many companies in one place. That is what makes it convenient, and it is also what makes it a valuable target.

In May 2026, Composio disclosed that an attacker had gained a foothold in an internal agentic monitoring tool, escalated privileges, and ran code in its tool-execution sandbox. Its incident page reports leaked connections representing about 0.3% of active connections, including 5,001 GitHub connections, and 5,241 Composio API keys identified as potentially exposed (Composio incident update). Composio rotated keys, revoked tokens across about 100 toolkits, moved to envelope encryption, and commissioned independent reviews. It published its findings and remediation in detail, which is to its credit.

No vendor is immune to this, and that includes hosted Automata: if you use our hosted service, your credentials sit on our servers. The structural point is about concentration. When you self-host Automata, a breach of anyone else's deployment, including ours, does not reach your accounts, and your credentials are only as exposed as the server you run.

Self-hosting moves that responsibility to you. Automata keeps upstream credentials in its own Postgres schema and does not encrypt them at rest (Telegram sessions are the exception), so treat that database and its backups like production secrets. The security guide covers hardening.

Where Composio is the better choice

Composio is a strong product, and for many teams it is the right one:

• Breadth. Composio covers hundreds of SaaS apps. Automata covers four kinds of source. If your agent needs Salesforce, HubSpot, Jira, and Google Drive, Composio already has them.
• Managed OAuth. Composio runs the OAuth flows, including Google and Microsoft. Automata connects email over IMAP with an app password, and cannot connect Microsoft 365 or Outlook.com.
• Building a product for your users. Composio's SDKs, white-labeled auth screens, and per-user connected accounts are designed for a SaaS company letting thousands of its customers connect their own apps. Automata is designed for you, or your team, connecting your own accounts.
• Triggers and sandboxes. Composio can push events to your agent and run code in a remote sandbox. Automata is a request-response MCP server.
• Compliance paperwork. Composio cites a SOC 2 Type II report and offers BAAs, SSO, SCIM, and customer-managed keys on its higher plans. If procurement needs those from a vendor, Composio has them.
• Official APIs. Composio's WhatsApp toolkit uses Meta's Business API. Automata's WhatsApp connector uses the linked-device protocol, as WhatsApp Web does, which is what lets it read personal chats but is not an official Meta API.

Which should you choose?

Choose Automata if:

• you want to read and audit the code that holds your credentials and enforces permissions;
• your data has to stay on infrastructure you control, without an enterprise contract;
• you want an AI to work with your own WhatsApp or Telegram chats, your mailbox, or a Postgres database;
• you need to limit access to specific chats, folders, or tables, not just specific tools;
• you want it free, with no usage meter.

Choose Composio if:

• you need many SaaS integrations with managed OAuth;
• you are building an AI product where your customers connect their own apps;
• you need triggers, a hosted sandbox, or vendor compliance documents, and are comfortable with a hosted, metered service.

Use both if you want SaaS breadth and private data under tight control. Claude, ChatGPT, and Cursor can all hold more than one MCP server: connect Composio for your SaaS tools and Automata for your messages and databases, each with its own scope. See the MCP clients guide.

Frequently asked questions

Is Composio open source?

Partly. Composio's SDKs and CLI are open source under the MIT license, but the platform that stores credentials and executes tool calls is closed and runs on Composio's servers. Automata publishes the whole server under the MIT license.

Can I self-host Composio?

Only as an Enterprise arrangement. Composio offers Private VPC and self-hosted deployments with Helm support, set up through its sales team. On self-serve plans, credentials are stored in Composio's cloud. Automata can be self-hosted by anyone, for free, with Docker or a one-click Railway template.

Is Automata really free?

Yes. The self-hosted edition is MIT licensed, with no usage limits, no cap on connections, and no license key. You pay for your own server and your AI plan. Hosted Automata also has a free tier.

Can Composio read my personal WhatsApp chats?

Not with its WhatsApp toolkit as documented. That toolkit is built on the WhatsApp Business API, which is for businesses messaging customers from a business number. Automata pairs your own WhatsApp account as a linked device, so an AI can read the chats and groups you choose.

Can I use Automata and Composio together?

Yes. Both are MCP servers, and MCP clients such as Claude, ChatGPT, and Cursor can connect to several at once. Many people would use Composio for SaaS apps and Automata for messengers and databases.

Which AI clients work with Automata?

Any client that supports remote MCP servers over HTTP, including Claude (web, desktop, and Claude Code), ChatGPT, Cursor, Grok, Meta Muse, and Hermes Agent.

Next steps

• Deploy Automata on Railway, or self-host it with Docker.
• Connect your first client: WhatsApp to Claude, Claude to Telegram, or Claude to email.
• Read the source on GitHub.

Composio's pricing, features, and documentation change often. Details here were checked against Composio's own pages on November 10, 2026; check composio.dev for the current versions.