How this was built and checked

The gap

Composio already lists 46 OAuth setup guides (45 apps) at composio.dev/auth. We read ten of them in full (GitHub, Notion, Slack, Salesforce, HubSpot, Outlook, Shopify, Google, LinkedIn, Meta). Each covers the clicking. In the ten we read, none gives a setup time, a difficulty rating or a troubleshooting section, and the LinkedIn, Meta, Shopify and Outlook ones do not mention provider approval, review or verification at all. Composio's Google guide says only that you "may need to submit the app for Google verification".

This project adds what is missing and shows how sure we are about each piece.

How every claim is labelled

• Tested: a person did it against the real provider and logged it. Nothing is tagged Tested until that log exists.
• Sourced: stated on a linked page, with the quote shown. In live generation, code checks the quote appears in the page the agent actually fetched.
• Reported: only community or third-party sources say so.
• Inferred: our reasoning. All of our "hands-on minutes" are inferred, because no provider publishes them.
• Unknown: we looked and could not find out.

What is checked by code (live agent)

• Evidence must come from a page fetched in that run; excerpts must literally appear in the page text or the evidence is dropped.
• A claim marked Sourced that loses its evidence becomes Inferred (Reported if only community pages back it). A Sourced claim must share wording with the page it cites, and any year must appear there, and every figure of 10 or more must be on a cited page (otherwise it becomes Inferred). The model cannot mark anything Tested.
• "No review is mentioned" is an absence, so it is never Sourced. A forum or community page is never counted as official, even on the provider's own domain. A Tier 3 or 4 needs a Sourced review step or it is lowered to Tier 2. Steps done in the provider's console are always yours. An unsupported gotcha that is not about setup, auth, review or limits is dropped. A second automatic review checks each claim against its quotes for wrong scope, blended processes and off-topic items, and can only lower or remove, never raise.
• Output must pass a schema and consistency checks, or nothing is shown.
• Fetched pages are treated as data, never instructions. Outbound fetches refuse private and loopback addresses and are size, time and step capped. Live generation is rate limited.

What the library guides rest on

The ten library guides were researched from provider documentation and Composio's own guides on 2026-10-20. Quotes were captured through a page-reading tool that summarises pages, so each quote is marked "not yet re-matched against the raw page" until the verify script (npm run verify-quotes) is run from a machine with open internet access.

How the live agent was audited

We generated guides for 23 apps outside the library (for example TikTok, Zoom, Square, Xero, Spotify, Okta) and read each guide next to its step log and sources. That found real faults, which are now fixed in code: a marketplace listing raising the tier, forum numbers marked Sourced, the provider's quota or certification page never being read, console steps given to the agent, and sources that did not support their claim. This was a read-through. It is not a hands-on registration and does not make any claim Tested.

Limits you should know about

• No provider was registered by hand in the first build; the "What was tested" sections are empty until real attempts are logged.
• Difficulty tiers and effort times are judgements, shown with their rationale.
• Approval wait times are almost never published; where unstated we say so rather than guess.
• Official documentation can change; each guide shows when it was last verified.