Add Composio (Composio Connect MCP gateway) to the integrations catalog #756

Composio (composio.dev) is not in the integrations catalog, so it cannot be added from the MCP marketplace UI. Users must configure it manually in mcp_config, and manually-added servers render with the generic puzzle fallback icon.

Composio Connect is a hosted MCP gateway at https://connect.composio.dev/mcp with header auth (x-consumer-api-key), documented at https://docs.composio.dev/docs/composio-connect. One connection exposes Composio's meta-tools (tool search, tool execution, connection management), which broker per-app OAuth to 500+ SaaS apps (Gmail, Slack, GitHub, Notion, Calendar and more). The endpoint is live and enforces auth (401 without a key, verified 2026-10-07), and the integration is in daily use on a live Agent Canvas via the documented configuration.

Proposed addition follows the standard catalog pattern (same shape as the Slack/Salesforce api-key-style entries):

• integrations/catalog/composio.json - shttp transport, x-consumer-api-key header field (password type, required), auth.strategy: api_key, docs link to composio's Connect docs
• integrations/icons/composio.svg - mark-only icon from official Composio brand assets, black on white
• integrations/catalog-index.js regenerated via npm run build:integrations

A working implementation with a marketplace screenshot exists and is validated against integrations/catalog.schema.json (Draft 2020-12) plus the repo's catalog test suites.

OpenHands AI triage

The following comments and acceptance criteria were added by the OpenHands AI agent.

Triage

This is a bounded, additive catalog request: add one hand-authored entry (integrations/catalog/composio.json), one local icon, and the regenerated integrations/catalog-index.js, following the repository's existing integration-catalog contract. The source of truth is the single JSON file; no aggregate catalog, schema, or package-export changes are needed. The entry shape is grounded in the repository's established patterns: the only existing hosted MCP option that authenticates with named request headers is Datadog's api option (shttp + headerFields), and locally-bundled icons follow the Slack/Salesforce integrations/icons/<id>.svg + jsDelivr logoUrl pattern. The Composio Connect docs and endpoint behavior referenced in the issue were independently confirmed (docs page resolves; the MCP endpoint returns 401 without a key).

The issue body already states the desired behavior; the repository defines no issue-template body sections (the readiness workflow only governs who may apply ready-for-dev), so no additional readiness sections are required.

Explicit non-goals:

• No changes to Agent Canvas / integrations-hub UI code or any other repository; the deliverable here is catalog data only.
• No OAuth connection option, no provider-specific runtime code, and no aggregate integration-catalog.json.
• No edits to existing catalog entries, the schema, index.d.ts, or unrelated package exports.
• No SDK/backend behavior changes.

Acceptance Criteria

• integrations/catalog/composio.json exists with "id": "composio", non-empty name/description, and docsUrl: "https://docs.composio.dev/docs/composio-connect", and validates against integrations/catalog.schema.json (Draft 2020-12).
• The entry declares one MCP connection option with the shttp transport at url: "https://connect.composio.dev/mcp" and exactly one required password header field keyed x-consumer-api-key; being a password field, it has non-empty helperText containing an https:// link (or a helperLink) that explains how to obtain the key.
• The install flow collects only the x-consumer-api-key credential (no duplicate or extra credential input appears for the option); with a valid consumer key the connection lists Composio's meta-tools, and connecting without a key surfaces the endpoint's 401 auth failure rather than hanging or reporting success.
• integrations/icons/composio.svg exists and the entry's logoUrl uses the local-icon CDN form https://cdn.jsdelivr.net/gh/OpenHands/extensions/integrations/icons/composio.svg (matching the Slack/Salesforce pattern), with mark-only black-on-white artwork and iconBg/iconColor set as needed for contrast.
• npm run build:integrations regenerates integrations/catalog-index.js to statically import ./catalog/composio.json; the generated file is committed in sync with the catalog and is not hand-edited.
• No aggregate catalog JSON is introduced; the entry is discoverable once, with a unique id, via listIntegrationCatalog() / getIntegrationCatalogEntry("composio") (JS) and list_integration_catalog_models() / get_integration_catalog_entry_model("composio") (Python).
• The repository catalog test suites pass on the change: tests/test_catalog_schema.py, tests/test_catalogs.py, and tests/test_integration_catalog_in_sync.py (including the password-field helper-link check, the locally-installable-option expectations for other entries, and the no-aggregate-catalog check).
• The change is purely additive: no existing catalog entry, the shared schema, integrations/index.d.ts, or package exports are modified, and MCP/OAuth filtering for existing entries is unchanged.
• No credential value or secret is committed; only the field definition (key, label, password type, required, helper text/link) and public docs link are added.