Composio MCP Gateway Server: 500+ SaaS Integrations with OAuth 2.0 & Action-Level RBAC

By Deepak Bagada — AI Architect & Developer

By Deepak Bagada, CEO at SaaSNext & Principal AI Architect.

The fastest way to make an agent useless in an enterprise is to give it tools that are read-only in theory but wide-open in practice. Connecting agents to Slack, Jira, Salesforce, and Gmail individually means five OAuth flows, five SDKs, five maintenance contracts — and five opportunities to over-permission. In 2026 the pattern that won is the integration gateway: a single MCP server that fronts hundreds of SaaS tools, owns all authentication, and enforces action-level access control so an agent can read a Slack channel but absolutely cannot post to it.

This guide builds a production Composio MCP Gateway in TypeScript: one FastMCP server exposing 500+ integrations to any MCP client, secured with automated OAuth 2.0 and action-level RBAC.

The Architecture: One Gateway, 500+ Tools

+---------------------------+
| MCP Clients               |
| Cursor / Claude Desktop / |
| OpenCode / custom agents  |
+-------------+-------------+
              |
              v
+-------------+-------------+
| Composio MCP Gateway       |
| (FastMCP TypeScript)       |
| +------------------------+|
| | Tool catalog (500+)    ||
| | OAuth token manager    ||
| | Action-level RBAC      ||
| | Per-user routing       ||
| +------------------------+|
+-------------+-------------+
              |
      +-------+--------+
      |                |
      v                v
+-----+-----+    +-----+-----+
| Slack /   |    | Jira /    |
| Gmail /   |    | Salesforce|
| Notion    |    | HubSpot   |
+-----------+    +-----------+

Prerequisites and Setup

Node.js 20+
@modelcontextprotocol/sdk
@composio/sdk (TypeScript)
A Composio API key from the dashboard

See the Daily AI World MCP Directory for more SaaS-oriented MCP server patterns.

1. Environment Configuration (.env)

COMPOSIO_API_KEY=cs-...
PORT=3000
LOG_LEVEL=info
DEFAULT_RBAC_POLICY=readonly

2. Gateway Server (server.ts)

import { Server } from "@modelcontextprotocol/sdk/server/index.js";
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
import { Composio } from "@composio/sdk";
import { z } from "zod";

const composio = new Composio({ apiKey: process.env.COMPOSIO_API_KEY! });

const server = new Server(
  { name: "composio-gateway", version: "1.0.0" },
  { capabilities: { tools: {} } }
);

server.setRequestHandler({ method: "tools/list" }, async () => ({
  tools: await composio.tools.list(),
}));

3. Tool Execution with OAuth Injection (tools/call)

server.setRequestHandler({ method: "tools/call" }, async (request) => {
  const { name, arguments: args } = request.params;
  const userId = resolveUserFromContext(request); // from headers or session

  // Action-level RBAC gate
  const allowed = await rbacPolicy.allows(userId, name);
  if (!allowed) {
    return {
      content: [{ type: "text", text: "DENIED: action not in user's policy" }],
      isError: true,
    };
  }

  const result = await composio.execute({
    actionName: name,
    args,
    connectedAccountId: await oauthManager.connectedAccountFor(userId, name),
  });

  return { content: [{ type: "text", text: JSON.stringify(result.data) }] };
});

4. Action-Level RBAC Policy (rbac.ts)

const POLICIES: Record<string, Record<string, string[]>> = {
  "support-analyst": {
    slack: ["slack_read_channel_messages", "slack_search_messages"],
    jira: ["jira_get_issue", "jira_search_issues"],
  },
  "ops-admin": {
    slack: ["slack_send_message", "slack_read_channel_messages"],
    jira: ["jira_get_issue", "jira_create_issue", "jira_transition_issue"],
  },
};

export async function allows(userId: string, actionName: string): Promise<boolean> {
  const role = await getUserRole(userId);
  const [app] = actionName.split("_");
  return POLICIES[role]?.[app]?.includes(actionName) ?? false;
}

5. Client Configuration (claude_desktop_config.json)

{
  "mcpServers": {
    "composio-gateway": {
      "command": "node",
      "args": ["dist/server.js"],
      "env": {
        "COMPOSIO_API_KEY": "cs-...",
        "DEFAULT_RBAC_POLICY": "readonly"
      }
    }
  }
}

Security Guide: OAuth 2.0 & Zero-Trust

Never pass raw user tokens into the agent context. The gateway owns every token: it runs the authorization-code flow, stores refresh tokens encrypted at rest, and injects credentials server-side at execution time. RBAC is enforced per action, not per app. Combine with request-scoped MCP session headers so each agent call is attributed to a real user identity, and rotate the Composio API key quarterly with a secrets manager.

Deep-Dive Production Architecture & Unit Economics

Hand-rolling Slack + Jira + Salesforce + Gmail MCP servers costs $15K–$40K in build effort plus continuous drift maintenance as SDKs change. Composio collapses that to one server maintained by the platform, and per-action RBAC eliminates the class of 'agent accidentally sent an email to 40,000 customers' incidents that cost far more than the platform fee. The gateway adds 1–3ms overhead per tool call versus direct SDK usage — irrelevant against LLM round-trips.

Step-by-Step Production Security Checklist

1. OAuth tokens encrypted at rest, never logged or leaked into prompts.
2. Action-level allowlists as the default policy, read-only for new roles.
3. Per-user attribution on every tool call for audit and chargeback.
4. Quarterly credential rotation and immediate revocation on role change.
5. Request logging to OpenTelemetry with redaction of message bodies.

Find more gateway patterns in the Daily AI World MCP Directory and platform updates on the AI news feed.

Frequently Asked Operational Questions

Which SaaS tools are supported? Over 500, including Slack, Gmail, Jira, Salesforce, HubSpot, Notion, GitHub, Google Drive, and Zoom, with new connectors added continuously.

Can the gateway run fully on-premises? Composio offers self-hosted deployment options for regulated environments; the TypeScript gateway code itself is portable either way.

How do agents discover what they can do? The tools/list response is filtered by the caller's RBAC policy, so agents only ever see the actions they are permitted to invoke.

Final Summary & Key Takeaways

• One gateway replaces dozens of bespoke SaaS MCP servers.
• Automated OAuth removes manual token management entirely.
• Action-level RBAC keeps powerful integrations safe by default.

Explore more MCP servers on the Daily AI World MCP Directory hub.

Scaling to Thousands of Users

The gateway pattern pays off at scale. When 2,000 employees connect their agents, per-user OAuth becomes a security and ops problem — the gateway solves both: tokens live server-side with automatic refresh, and role membership drives tool visibility dynamically. Add a small user-mapping service that resolves MCP session identities to roles, and cache the RBAC decision for a few minutes so tool-list requests stay fast. Composio's connected-account model means one user can grant the gateway access to their Slack, Gmail, and Jira with a single consent flow — far better than asking agents to store raw tokens.

Audit Trails & Compliance

Every tool execution should emit a log line with user identity, action name, app, success/failure, latency, and token footprint. These logs feed your SIEM, satisfy SOC 2-style 'who did what with which tool' questions, and power chargeback reporting per team. Because the RBAC policy is centralized, a compliance change (for example, 'support analysts may no longer send Slack messages') propagates instantly across every agent in the company — a property hand-rolled integrations cannot offer.

Frequently Asked Operational Questions

What happens when a user leaves the company? Disconnect their connected accounts and revoke their tokens centrally; the gateway automatically blocks their agents from executing any tool.

Can I use the gateway with Python agents too? Yes — the MCP endpoint is language-agnostic; Python clients use the same tools/list and tools/call contract.

How do I handle app-specific rate limits? Composio surfaces per-app rate information, and you can enforce gateway-level limits per consumer group to keep one chatty agent from exhausting a shared Slack quota.

Additional Implementation Notes

For teams adopting this pattern, start with a small pilot: pick one workflow, instrument it with the observability described above, and run it for two weeks before expanding. Document every failure mode you observe and feed those notes back into the retry and checkpointing configuration. Production agent systems are never finished — they are continuously hardened against the specific failure modes of the environments where they run. Pair this dispatch with the other blueprints in the Daily AI World Workflows hub and the tooling catalog in the MCP Directory to complete your production stack.