One browser flow, 1,000+ apps — and the third party that holds your OAuth tokens.

What you get

Vercel Connect ships four Vercel Managed Connectors — Slack, GitHub, Snowflake, Salesforce — where Vercel registers the OAuth client and you just authorize it. It also ships two Customer Managed Connector types that cover everything else: Custom OAuth ("OAuth 2.0 / OIDC against any service URL you provide", both the authorization-code and client-credentials flows) and API key. Those need you to register the OAuth client or generate the key yourself and hand Vercel the credentials. eve separately connects to arbitrary MCP servers.

This page used to say "four managed connectors" and stop, which understated Connect considerably — the coverage limit is not the four apps, it is who does the OAuth-client registration.

evestack wires in Composio instead: 1,000+ toolkits, including Gmail (61 tools) and GitHub (871 tools) — both of which connect in a single click.

Why "1,000+" and not an exact figure. We counted the live catalog against GET /api/v3/toolkits and got 1,070 on 2026-08-04; Composio's own public directory listed 1,069 five days later. It moves by ones as toolkits are added and retired, so every surface in evestack — this page, the README, the site, the scaffolder's prompt, the dashboard's Integrations page — says 1,000+, which stays true. The dashboard shows the live number: its Apps available tile reads whatever countToolkits() returns from your own key.

The catalog and the one-click subset are two different numbers, and attaching the first to the second is the mistake this page exists to prevent. Measured against the live catalog on 2026-08-19: 1,326 toolkits, of which 121 publish a Composio-managed OAuth client. Those 121 connect with one click and nothing else. A further 96 support OAuth but require you to register your own OAuth client — the exact registration burden described at the top of this page — and 1,126 authenticate with an API key you go and fetch yourself.

So a sentence of the form "one-click OAuth into 1,000+ toolkits" is false: it attaches the catalog size to a capability 121 of them have. Say "1,000+ toolkits" about the catalog, and "one click" only about the managed-OAuth subset.

The apps the scaffolder offers by name — Gmail, Slack, Notion, Linear, Google Calendar, GitHub — are all inside the 121, so the path most people take really is one click. Re-measure by counting composio_managed_auth_schemes containing OAUTH2 over GET /api/v3/toolkits.

Composio is a hosted third party, and this is the one place evestack's "everything runs on your network" stops being true. Composio performs the OAuth flow and holds the resulting access and refresh tokens for every account you connect — your Gmail, your GitHub, your Slack. That data lives on Composio's infrastructure, not yours, and is subject to their terms rather than your Postgres backup policy.

It is genuinely opt-in: with COMPOSIO_API_KEY unset the agent still boots with its sandbox, memory and durable sessions, and simply has no connectors. If token custody is the thing you are self-hosting to avoid, leave it unset.

How it reaches the model

The agent doesn't get ten thousand individual tools. It gets a handful of meta-tools — COMPOSIO_SEARCH_TOOLS, COMPOSIO_GET_TOOL_SCHEMAS, COMPOSIO_MANAGE_CONNECTIONS, COMPOSIO_MULTI_EXECUTE_TOOL — and Composio's Tool Router resolves the real set per session. Which ones it returns is the router's decision, not a guarantee: COMPOSIO_MULTI_EXECUTE_TOOL covers both single and batch calls, and COMPOSIO_EXECUTE_TOOL is a legacy slug the current router no longer returns. agent/tools/composio.ts in the template is two lines of code, under a comment block explaining why:

import { composioTools } from "@evestack/composio";
export default composioTools();

With COMPOSIO_API_KEY unset, this resolves to no tools and logs one line. The agent still boots, still has its sandbox and memory — you just don't get the connectors. Nothing about Composio being unreachable holds up the rest of the stack.

The tradeoff, stated plainly

Composio's managed OAuth is genuinely one-click, and that convenience has a real cost:

The consent screen reads "Composio wants to access your account," not your app's name
Rate limits are shared across every Composio customer on the managed app
A 15-minute minimum polling interval applies to managed auth

That's the right tradeoff for personal use, prototypes, and internal tools. Before you onboard other people's accounts in production, read Composio's docs on registering your own OAuth app — it removes all three limits at the cost of the one-click setup.

The dashboard's integrations page

http://localhost:4000/integrations lists the live catalog, what's already connected, and a one-click Connect button per app — built directly against the Composio API, not a static list.

Composio auth

What you get

How it reaches the model

The tradeoff, stated plainly

The dashboard's integrations page

On this page