Connect Composio

Set up the Composio broker that powers every Cyborg7 integration, then connect your first toolkit.

Composio is the broker behind Cyborg7's integrations. It handles the OAuth with each provider (Gmail, Slack, Jira, …) and exposes their actions to a cybo as tools. You connect Composio once; after that, connecting any individual toolkit is a couple of clicks.

Before you start

  • You are a workspace admin (only admins configure the broker and grant toolkits).
  • You have a Composio account at composio.dev.

Step 1 — Get your Composio API key

  1. Sign in at app.composio.dev.
  2. Open Settings → API Keys.
  3. Create a key and copy it (it starts with ck_…). Treat it like a password.

Step 2 — Add the key to Cyborg7

The broker is set up from a cybo's editor → Tools, not from Settings → Integrations (that page holds Cyborg7's own GitHub / Slack / Jira / ClickUp / Chrome integrations and no Composio toolkits).

  1. In Cyborg7, open any cybo and go to its Tools step.
  2. Pick a Composio toolkit — Cyborg7 asks you to connect Composio first. Paste the API key and Save.
  3. Cyborg7 validates the key and the broker shows Connected.

Self-hosted deployments can instead set the key as the COMPOSIO_API_KEY environment variable on the daemon/relay; the Tools step will show it as configured.

Step 3 — Connect a toolkit

  1. Still in the cybo's Tools step, pick a toolkit (e.g. Slack).
  2. Choose Personal (your account) or Shared workspace account (admin, for unattended runs).
  3. Complete the provider's OAuth popup and approve the scopes.
  4. The toolkit flips to Connected.

Step 4 — Grant it to a cybo

  1. Open the cybo's Tools step.
  2. Enable the toolkit.
  3. Save. The cybo can now use that toolkit, acting as the identity bound at run time (your account for caller runs, the shared account for service/unattended runs).

What a grant covers today

A grant is toolkit-level, and the cybo receives that toolkit's read actions — fetch, list, search, get. Two limits are worth knowing before you plan around them:

  • Write actions are not granted. Send, create, update and delete are excluded. There is no approval policy to configure yet, and an action left waiting for one would never execute — so nothing is placed there.
  • The read set is capped at 30 actions per toolkit, in the order the provider returns them. A large toolkit (Zoom exposes ~45–50 read actions) loses the remainder. Every dropped action is named in the daemon's error log at spawn, so if a cybo says it has no tool for something, that log tells you whether the cap took it.

Troubleshooting

  • "Invalid API key" — the key was mistyped or revoked; regenerate it in Composio and re-save.
  • A toolkit stays "Not connected" — the OAuth popup was closed or blocked; retry and allow popups for Cyborg7.
  • A cybo can't see a tool — the toolkit is connected but not granted to that cybo (Step 4), or the run needs a service identity it doesn't have, or the action is a write / fell outside the 30-action cap (see What a grant covers today).