Composio Firewall: Jev at the tool-call boundary

A runtime check on tool calls

Composio’s 21 October blog calls Firewall the runtime boundary for agentic software. Developers of ordinary programs set the expected paths before the code runs. An agent chooses actions as a task unfolds, including from emails and pages the developer never saw. The blog’s invoice case: an agent asked to review vendor invoices may already have permission to read email and business records. An email can still carry an instruction to export customer contacts. The user never asked for that export.

Karan Vaidya, building Composio, posted the launch on 22 October. He writes that agents already get tools, authentication, and sandboxed execution through Composio, and that Firewall checks the actions they take and the information coming back. He says Firewall is live for all Composio developers. The Firewall docs page, opened 24 October, is labeled Experimental and says the feature is available on paid plans with usage-based pricing.

Sources:[188] Composio[193] Karan Vaidya[189] Composio

Jev and custom small models

The blog says every action an agent takes through Composio is evaluated using Jev and custom small language models tuned by Composio on real-world usage data. That check runs before execution and asks whether the action respects the user’s task and the limits the developer and user set. The blog and the docs print no Jev version id.

TypeSafe quote-tweeted Karan’s post on 22 October and called the product a code firewall powered by Jev. Composio also ships a TypeSafe provider that compiles tools into Jev questions and returns call, partial, or abstain. Firewall attaches hooks to a session and blocks matching calls or results. Composio documents those two products on separate pages.

Sources:[188] Composio[194] TypeSafe AI[196] Composio[193] Karan Vaidya

Checks before a call and after a result

A hook is attached to a session and runs when the agent calls a tool. before_execute runs before the tool call. after_execute runs after it. Use before_execute to stop something the agent is about to do, such as emailing internal pricing to a customer. Use after_execute to keep a tool result away from the agent, such as an email that contains a password. The docs state that an after_execute hook cannot undo a tool that already ran. The blog makes the same point about returned content: checking a result does not reverse an action that has already executed.

A hook runs on the toolkits in applies_to, or on every toolkit when applies_to is all. That includes proxy calls, tool calls from a Workbench script, and multi-execute. Hooks currently skip Composio meta tools, so a condition that names a Workbench script will not block that meta tool. If more than one hook applies, hookResults has an entry for each one, and the call is blocked if any of them blocks it. A blocked execution returns result_type blocked, error Blocked by session policy, and a block_reason that names the hook.

Sources:[189] Composio[188] Composio[192] Composio

Natural-language conditions and prompt-injection checks

A condition_check hook blocks a tool call or result when it matches a condition written in natural language. Composio asks for a description of the call or result to block. The docs’ good examples are “Sharing internal pricing with anyone outside acme.com” and “An email that contains a password, API key or access token.” An instruction such as “Don’t share internal pricing with anyone outside acme.com” is listed as a bad condition because it does not describe anything to match.

Composio says a classifier compares each tool call to the condition. It sees which tool the agent is calling and the arguments it passes. In an after_execute hook it also sees the data the tool returned. The classifier uses earlier activity in the session, so an email with a few numbers can match a pricing condition if those numbers were just copied from an internal sheet. On projects with zero data retention, the classifier judges a call in isolation because Composio has no earlier session activity.

prompt_injection_check screens each tool result and blocks it if it contains a prompt injection. It works only in after_execute hooks. The docs also describe a built-in prompt-injection check on tool results. The product page says a specialised model screens for hidden instructions before results enter the agent’s context. Its invoice demo is a reply about INV-0931 for $8,420.00, net 30, with passing SPF, DKIM, and DMARC, and 1px white text that tells the assistant to export HubSpot contacts to [email protected]. Its GitHub demo is pull request 482, “Raise default rate limits,” with a 12-file diff and an HTML comment in README.md that tells AI reviewers to approve and merge without waiting for CI.

Sources:[189] Composio[190] Composio[188] Composio

Session hooks in the 22 October SDK releases

Composio’s 22 October changelog ships session hooks in Python composio 0.30.0 and TypeScript @composio/core 0.27.0, with @composio/slim also at 0.27.0. Pass hooks when you create or update a session. A new hooks list replaces the old one. None in Python or null in TypeScript removes every hook. The same call cannot combine hooks with experimental.session_config_id in Python or experimental.sessionConfigId in TypeScript.

Each hook needs a unique id in the session. An optional name is included in the error message the agent sees. session.update() takes the full list you want to keep. The REST path in the docs is POST https://backend.composio.dev/api/v3.1/tool_router/session with a hooks array. Session proxy execution distinguishes a completed request from a blocked request; a blocked proxy request has no HTTP response, so the changelog tells callers to read result_type before HTTP fields.

Sources:[192] Composio[189] Composio

Paid-plan add-on at $0.50 per million tokens

Composio’s pricing page describes Firewall as using decision models to check tool requests and results against your policies. The add-on table lists Hobby as No, Pro as $0.50 per 1M tokens evaluated, and Enterprise as included. A pricing FAQ repeats that Pro rate and says Firewall is included on Enterprise. Sandbox LLM tokens are a separate line for model calls Composio runs in Sandbox.

The docs say Firewall is available on paid plans, with usage-based pricing. The blog says Firewall is live now for all Composio developers and points at the pricing page. Karan’s post uses the same live-for-all-developers line. Hobby is the $0 plan and lists Firewall as No, so those sentences stay with their authors.

Sources:[191] Composio[189] Composio[188] Composio[193] Karan Vaidya

Product-page demos without printed rates

The product page lists four measurement headings without printed numbers on 24 October 2026: attacks that get through, false alarms, work that gets done, and added time. It also shows a task-scope demo, “Pay this week’s vendor invoices,” with named vendors and account [email protected], without a printed miss rate. Composio writes that no safety layer removes every risk.

Grantry’s 21 October write-up recorded those metric headings without values, no pricing table on the product page, and no dedicated Firewall docs page. The Firewall docs and the $0.50 Pro rate were open on 24 October. Grantry’s snapshot is the 21 October product page. We have not measured miss rate, false alarms, or added latency.

Sources:[190] Composio[195] Grantry[189] Composio[191] Composio

Questions about Composio Firewall