Composio vs Arcade

For developers building agents across business apps, Composio is worth evaluating for its managed authentication and broad toolkit catalog, while Arcade is worth evaluating for its tool platform and customizable execution hooks. Choose by testing the exact operations and authorization flows your application needs, not by treating toolkit counts and tool counts as interchangeable.

For IT and security leaders, both vendors document encrypted credential storage, execution controls, enterprise deployment options, and SOC 2 Type II attestation. Composio also publicly states ISO 27001:2022 certification, but neither a badge nor this comparison replaces reviewing the current reports, deployment boundaries, and contract terms.

TL;DR, reviewed October 29, 2026

These are vendor-published claims checked on October 29, 2026, not independently measured catalog totals or contractual guarantees. Undated product pages are cited with that retrieval date. The reviewed SLA pages do not establish comparable numeric uptime commitments.

Compare coverage at the operation level

The current Composio documentation index says 1,600+ toolkits, while its enterprise and pricing pages still use 1,500+. We use the current docs figure and disclose the mismatch rather than freezing the older count or pretending the sources agree. Neither figure promises that every API operation in every app is supported.

A tool is an individual callable operation. Arcade's advertised 8,000+ tools and Composio's 1,600+ toolkits count different things. Test required reads and writes, provider scopes, pagination, error handling, and refresh behavior against the actual catalog before choosing a vendor.

Both platforms can work with the Model Context Protocol. An MCP gateway is an access point for MCP clients, not evidence by itself that every downstream tool or arbitrary HTTP request follows the same permission rules.

Where credentials live

With Composio-managed authentication, an auth config defines authentication settings and a connected account represents an authorized provider account. A session binds tool access to an application-supplied user and selected accounts. The security architecture describes encrypted storage and execution-time credential injection without returning the token to the application or putting it in model context.

The encryption key is per organization, not per project. Projects within an organization share that key. Project-level logical isolation and encryption-key scope are separate properties, as confirmed in the October 21, 2026 architecture review. The linked architecture article now uses the corrected scope.

Default Composio Cloud is not a zero-knowledge deployment. Its runtime must decrypt managed credentials to authenticate provider requests. Optional customer-managed KMS uses a customer-operated proxy and customer-held keys; it requires arrangement with Composio. The pricing description explicitly limits that feature to secret storage, not data residency. Pricing also documents self-managed credentials passed at execution time, which Composio does not store or refresh. Review token custody and the chosen deployment rather than assuming one credential model applies to all configurations.

Arcade also has a vault. Its architecture documentation, updated October 28, 2026, says the Engine stores encrypted end-user tokens, refreshes them before expiry, and supplies credentials to the MCP server executing the tool. Just-in-time authorization can defer user consent until access is needed. It does not establish that every provider token is short-lived, action-specific, or absent from persistent storage.

What the execution boundary enforces

Both vendors document controls outside the model's reasoning. With Composio, session configuration restricts available tools and connected accounts. Toolkit filters, tool allow and deny lists, and tool tags narrow predefined-tool access. These checks apply when requests execute; describing them as happening "before any model interaction" confuses the model's choice of a tool with authorization to run it.

Composio's Proxy Execute restrictions matter when calling an endpoint that has no predefined tool. Proxy execution needs its own permission. Session proxy calls obey toolkit allow and deny lists and reject cross-domain requests, but hint filters and per-tool rules do not constrain arbitrary HTTP endpoints. A readOnlyHint filter is not a read-only policy for proxy calls. Disable proxy execution if the application should expose only its selected predefined tools.

Arcade's Contextual Access documentation, updated October 28, 2026, describes an Access Hook for tool visibility, a Pre-Execution Hook that can allow, deny, or modify inputs, and a Post-Execution Hook that can allow, deny, or modify results. Customers implement those rules in a logic-extension server. The earlier version of this comparison incorrectly reduced Arcade's controls to OAuth scopes alone.

Neither architecture makes overbroad permissions safe. An injected instruction can still misuse an allowed operation. Restrict provider scopes and tool access, and build human approval for sensitive actions into your application. Do not assume a product's configurable hooks or optional controls are enabled in every deployment.

Logs, deployment, and procurement evidence

Composio's architecture account describes execution records with the supplied user ID, connected-account and auth-config IDs, outcome, and timing. Payload retention depends on configuration. Zero Data Retention has feature and plan limits and does not erase existing payload logs. This comparison does not assert an independently verified complete schema for every denied request.

Arcade distinguishes administrative audit logs from tool execution history. Its documentation, updated October 28, 2026, says Cloud execution logging defaults on with seven-day retention, configurable up to 90 days. Self-hosted execution logging requires configuration. Verify export, payload visibility, and retention for the deployment you intend to buy.

Composio's enterprise page offers Cloud and arranged private VPC or self-hosted deployments. Arcade's pricing offers Cloud, VPC, and fully air-gapped Enterprise options, and its architecture guide documents Kubernetes deployment. Ask both vendors which services, credential stores, telemetry, backups, and support paths remain outside your network. A deployment label alone does not establish data residency.

Enterprise SLA language is public for both vendors. Composio lists dedicated support and custom SLAs; Arcade lists 24/7 SLA-backed support. Obtain the actual availability target, measurement window, exclusions, remedies, and support response times in the contract. We found no basis in the reviewed pages for quoting a numeric uptime comparison.

Composio publicly states SOC 2 Type II attestation and ISO 27001:2022 certification. Arcade's August 18, 2025 announcement explicitly establishes its public SOC 2 Type 2 claim. The previous version of this article acknowledged that announcement and later claimed Arcade had no publicly documented SOC 2; that contradiction is corrected in this October 29 review. We did not establish Arcade's ISO 27001 status from the reviewed public sources. That is not a claim that Arcade lacks certification.

SOC 2 Type II is an attestation about controls over a reporting period, not a blanket product certification. Request the reports and certificate scope from Composio's Trust Center and Arcade's Trust Center. Their public landing pages do not substitute for inspecting those documents; this review did not inspect the underlying gated reports or certificates.

Composio's May 2026 incident belongs in the evaluation

An attacker compromised Composio systems and customer credentials in May 2026. Read the incident record alongside how Composio rebuilt credential security after May 2026, published October 21, 2026. The incident record reports about 0.3% of active connections leaked, including 5,001 GitHub connections, and separately identifies 5,241 Composio API keys as potentially exposed. Those are different exposure categories.

The rebuild documents per-organization envelope encryption, hashed Composio keys, token redaction and Proxy Execute, optional customer-managed KMS, IP allowlisting, and independent verification. Its assessment results reflect the August 2026 whitepaper reported in September, not a new October assessment. Request current remediation evidence and open-finding status before relying on these controls; the rebuild does not erase the incident history or guarantee no future incident.

Frequently asked questions

Does Arcade store OAuth tokens?

Yes. Arcade's platform architecture, updated October 28, 2026, documents an encrypted token vault, token refresh, and credential delivery to tools at execution time. Just-in-time consent does not mean credentials are never stored.

Can both platforms run in enterprise infrastructure?

Yes. Composio offers arranged private VPC and Enterprise self-hosted deployments through its enterprise team. Arcade documents Kubernetes self-hosting and lists VPC and fully air-gapped Enterprise options on pricing. Confirm the components and responsibilities covered by your agreement.

What security assurance does each vendor publicly claim?

Composio states SOC 2 Type II attestation and ISO 27001:2022 certification on its enterprise page. Arcade announced SOC 2 Type 2 on August 18, 2025. Review current scope and reporting periods through each vendor's trust center; this review did not establish Arcade's ISO status.

Are Composio's encryption keys isolated per project?

No. Managed credential envelope encryption uses a per-organization key, shared by projects in that organization. Projects remain logical isolation boundaries. See the corrected security architecture and the October 21 review.

Review ownership and next review

Last reviewed: October 29, 2026. Review owner: Brendan O'Leary, Developer Marketing. Next quarterly review due: January 29, 2027.

At each quarterly review, recheck the linked catalogs and count units, deployment and proxy restrictions, SLA wording, assurance evidence, incident and rebuild updates, and Arcade's dated documentation. Update the visible comparison and FAQ together, and confirm the HTML, Markdown, and FAQ structured data agree. Change the review date only after that source review, not when the site rebuilds.