composio

Least-privilege permissions

• Request minimal OAuth scopes per integration; audit Composio's default scopes and explicitly restrict to only required permissions (e.g., read-only for passive integrations).
• Rotate API credentials regularly and use short-lived tokens wherever possible; implement credential expiration policies within Composio's credential management interface.
• Create separate OAuth applications per agent workload rather than sharing a single high-privilege credential across multiple agents.
• Deny broad scopes like "full account access" or "all files"; enforce granular, resource-specific permissions at the integration provider level.

Network isolation

• Deploy Composio in a network-segmented environment with egress filtering; whitelist only required external APIs and block unexpected outbound connections.
• Run agents in isolated VPCs or containers with no direct access to internal databases, file systems, or sensitive service endpoints.
• Disable agent internet access unless explicitly required; use a proxy or API gateway to log and control external API calls made by tool integrations.
• Encrypt all credential storage and API traffic to Composio endpoints using TLS 1.2+; validate certificate pinning for critical integrations.

Monitoring

• Log all credential access events, tool invocations, and OAuth authorization grants; correlate Composio audit logs with agent behavior to detect anomalies.
• Monitor for unusual API rate patterns, unexpected scopes being used, or credentials accessed outside normal operational windows.
• Implement alerting on sandboxed execution errors, timeouts, or resource exhaustion that may indicate escape attempts or resource abuse.
• Track upstream toolkit SDK versions and Composio service updates; alert on security advisories affecting dependencies your agents rely on.

Red flags to watch for

• Tool results containing raw user data (file contents, API responses, database records) fed directly into LLM prompts without sanitization or validation.
• Agents requesting or using OAuth scopes broader than their documented function, or credentials being reused across unrelated tool integrations.
• Unexplained file system or network access from sandboxed workbench environments; inability to verify cryptographic isolation boundaries.
• Composio or upstream toolkit dependencies with unpatched vulnerabilities, missing security documentation on data residency, or unclear vendor compliance certifications (SOC 2, HIPAA, GDPR).