CrewAI

CrewAI: an open framework with an enterprise control plane on top

Fourth place on this list goes to CrewAI. It reaches the build-versus-buy question from the framework side and then climbs toward a governed product. On GitHub the project is still a framework in which autonomous agents play assigned roles and are orchestrated together¹, yet the marketing site now leads with a bigger claim, "The Enterprise Agent Build & Runtime"², explained as one platform, governed centrally, for both business and engineering teams³. A platform leader can start with the open-source library and later buy the enterprise layer, called CrewAI AMP, without changing the underlying model of crews and flows.

Framework, license and scale

The repository is MIT licensed⁴, and the license file carries the standard MIT permission grant⁵. Developer interest is visible in the star count, which stood at 60.7k on our check date⁶. Two primitives organize everything in the README: Crews, which are groups of agents, and Flows, which are driven by events⁷.

The CLI creates a JSON-first crew project with a single command⁸, and in that scaffold each agent is defined in its own file under an agents folder⁹. Engineers who prefer code also get a code-first API that CrewAI describes as built for total control¹⁰.

Adoption is claimed at 65 percent of Fortune 500 companies¹¹. That is a vendor claim, and the page does not say how it is counted.

The enterprise layer

Its paid layer, CrewAI AMP, is where crews go to run in production, be watched and grow¹²; the docs position it as the open-source framework plus what a company needs for live deployment, teamwork and scale¹³. The README promises one control plane across all agents and workflows¹⁴ and real-time observability covering metrics, logs and traces¹⁵.

The design point that matters most to a platform team is where that control plane sits. CrewAI puts it directly in the execution path of each workflow¹⁶. As a result, each model call, tool invocation and memory lookup is recorded live, with its cost attached¹⁷. Hooks at runtime then apply policy checks and strip personal data at every one of those calls¹⁸. A person can also be placed in the loop, approving steps or stepping in while a run is in progress¹⁹.

This is the CrewAI argument for buying: the governance that a team would otherwise bolt on around a framework is placed inline, at every call.

Building for two audiences

Non-developers get a visual editor that needs no code, and what they build there can leave the editor as Python²⁰. Crew Studio is the name for that environment, usable with or without code²¹, and a crew made in it can be shipped to production from Studio directly²². For speed, an automated builder proposes multi-agent designs drawn from what CrewAI describes as 700k workflow patterns²³. A Discovery feature compares your tickets, chats, apps and workflows with patterns seen across billions of runs to suggest where agents fit²⁴, and Optimize lets a team test several LLMs and switch between them at runtime²⁵.

The export to Python is the bridge. A business user can start a crew visually and an engineer can take the exported code into a repository. Few products on this site make that path explicit; Relevance AI lets engineers drive its platform from coding tools²⁶, and Dify publishes every app as an API²⁷, but neither describes exporting a visual build to Python.

The homepage describes the intended split: business and technical teams build agents, and platform teams get the control to govern them²⁸.

Deployment path

Getting started on the enterprise platform begins with an account sign-up in four steps²⁹. Two routes exist for shipping code, a linked GitHub repository³⁰ or the command line, which CrewAI suggests for more complex pipelines³¹. In the GitHub route, two values, CREWAI_PAT and CREWAI_AUTOMATION_UUID, are stored as repository secrets³², and tagging a pull request with a label deploys it³³. Crews then run on infrastructure CrewAI manages³⁴, and every execution leaves traces and logs for monitoring³⁵.

Enterprise customers choose among three homes for the runtime, namely CrewAI's cloud, a VPC of their own, or hardware they operate³⁶. Dedicated VPC is an Enterprise option and is not on the Basic plan³⁷. Sensitive data is masked before it is written to traces³⁸.

Integrations

The integration docs give each connector its own page, running alphabetically from Asana to Zendesk³⁹. Among the trigger options is one fed from Zapier⁴⁰. Live events can also be pushed out to your own systems over webhooks⁴¹. Teams with an existing monitoring stack will find guides for exporting via OpenTelemetry⁴² and for connecting Datadog⁴³.

Connectors to enterprise systems come only with the Enterprise plan⁴⁴. On either plan, a finished crew can be published outward as an MCP server⁴⁵ or embedded as a UI component⁴⁶. The marketplace is where teams discover, install and govern reusable assets⁴⁷; agent repositories let teams store, share and reuse agent definitions⁴⁸; and the tools section connects external apps and manages internal tools agents can use⁴⁹.

CrewAI does not publish a total connector count on the pages opened. For comparison, Nexus lists more than 4,000 integrations⁵⁰.

Security and identity

A trust center is linked from the site footer⁵¹, but our saved copy of it contained nothing beyond the page title⁵². We found no named attestation, SOC 2 or ISO 27001 included, anywhere in the CrewAI pages we saved. As with LangGraph, a buyer should request the reports directly.

The identity controls are well documented. Sign-on on the Enterprise plan works with Okta or Microsoft Entra⁵³, and access is governed by roles there, a feature the free plan lacks⁵⁴. Pricing copy bundles governance into the Enterprise tier from day one, naming sign-on, role-based access, workload identity, redaction of personal data and policy controls⁵⁵. Audit trails that cannot be altered, together with enterprise IAM, are added on the home page⁵⁶. A Hallucination Guardrail validates AI-generated content as an enterprise feature⁵⁷.

User accounts and team membership can be created on first login from the groups held in your identity provider⁵⁸. CrewAI states that JIT SSO is distinct from directory sync or SCIM⁵⁹. For SAML connections from four providers, Entra ID, Okta, Keycloak and Auth0, the group mapping is applied by itself once the link goes live⁶⁰.

Traces from crews and flows can be scrubbed, with personal data found and masked automatically⁶¹. The redaction feature is available on Enterprise⁶², it must be turned on for each deployment⁶³, and each entity enabled adds processing overhead⁶⁴. That page cites GDPR, HIPAA and PCI-DSS to explain why redaction matters⁶⁵; read the mention as motivation for the feature, since it asserts no certification.

Governance and permissions

RBAC in CrewAI AMP has two layers: feature permissions and entity-level permissions⁶⁶. The predefined roles are Owner and Member, and custom roles can be created^67,68. Owners hold every permission, and no setting can narrow it⁶⁹. Members, by default, can view most of the product and can fully manage three things, namely environment variables, model connections and Studio projects⁷⁰. Permissions run on a three-step scale of Manage, Read and none⁷¹, except for those same three areas, where the middle step is missing and access is all or nothing⁷².

Entity-level permissions go further. An automation marked private can be reached only by the people and roles on its allow list⁷³, with the organization's owner always included⁷⁴. One automation permission type covers responding to human-in-the-loop requests⁷⁵. Individual environment variables can carry their own permission, limiting who sees or edits each one⁷⁶. To ship from GitHub a user needs at least Read on the dashboard where deployments are made⁷⁷, and uploading a zip works only if an admin has left that option switched on⁷⁸.

SSO reconciliation has edges worth knowing. When identity groups map to teams, sign-in can grant or revoke team access⁷⁹; yet a membership someone added by hand inside CrewAI survives that reconciliation⁸⁰. Offboarding through the identity provider blocks new logins, but the CrewAI account lingers until removed⁸¹. Timing matters too, since a group change only lands when the person next signs in through SSO⁸², and a session refresh does not trigger it⁸³. Entra omits the group list when an assertion exceeds 150 groups⁸⁴, and group membership in Entra needs a P1 or P2 license⁸⁵. One quirk: Read permission on organization settings reveals the Members tab but keeps the settings page itself closed⁸⁶.

A security architect will appreciate that these behaviors are written down. Each one is a case to test during onboarding.

Pricing

The Basic plan is free and includes 50 workflow executions a month⁸⁷. That free tier still includes the editor with its AI copilot⁸⁸, Studio⁸⁹ and GitHub linking⁹⁰, and CrewAI markets it as the place to try a first agentic workflow⁹¹. Maximum executions on Basic are 50, and Custom on Enterprise⁹². Help on Basic comes from the community, whereas Enterprise customers get a dedicated team reachable in Slack or Teams⁹³.

Enterprise has a quoted price and starts from the free feature set, adding the governance layer on top⁹⁴. It comes with a 45-day onboarding⁹⁵ and flexible overage for extra executions⁹⁶. Forward deployed engineering and training are sold a la carte⁹⁷. CrewAI describes the plan as scaling agentic AI across the organization with the governance to keep it in production⁹⁸.

The a la carte line is the clearest contrast with Nexus. A CrewAI buyer who wants vendor engineers on the build adds that as a separate purchase. Nexus includes consultancy support in a software price set per role automated, with no consultant time billed⁹⁹.

Customer stories

CrewAI publishes several customer claims on its home page. At Docusign, agents pull lead data out of several internal systems, merge it and score it, which the company credits with faster first contact¹⁰⁰. General Assembly uses a crew to speed up and scale how it designs courses¹⁰¹. Gelato's agents enrich incoming leads, upward of 3,000 each month by the published figure¹⁰². Testing a voice agent automatically took one customer's QA effort from 74 hours down to 3¹⁰³, and Piracanjuba cites accuracy of 95 percent on support answers¹⁰⁴.

The home page also maps buyers by stage: a first stage for organizations laying foundations¹⁰⁵, a second for those moving pilots into production¹⁰⁶, and a third for those whose running agents now need managing as a fleet¹⁰⁷.

Build, buy or both with CrewAI

The build path costs nothing to start. The framework is MIT licensed⁴, the CLI scaffolds a project in one command⁸, and the free Basic plan adds the visual editor, an AI copilot and the GitHub integration^88,90. A platform team can prototype on the framework, push to a repository and deploy without a contract.

The buy path is CrewAI AMP on the Enterprise plan. It adds the control plane in the execution path¹⁶, enterprise connectors⁴⁴, a dedicated VPC³⁷, dedicated support with Slack or Teams channels⁹³ and a 45-day onboarding⁹⁵. Usage above plan comes through flexible overage⁹⁶.

The "both" story is stronger here than at most contenders because the artifacts move. A crew built in the no-code editor exports to Python²⁰, crews from Crew Studio deploy through the same interface²², and agent repositories store definitions that teams can share and reuse⁴⁸. There is also an exit route on the runtime side: LangChain's LangSmith Deployment lists CrewAI among the frameworks it can deploy¹⁰⁸. An engineering leader worried about runtime lock-in has a documented alternative.

The cost picture follows the same pattern as the other frameworks. The license is free and the Enterprise price is custom. Vendor engineers who would speed the build are sold a la carte⁹⁷. A team should add its own build hours to the comparison. Nexus folds that build work into its charge per role automated and bills no consultant hours⁹⁹.

Verdict

CrewAI is a strong fit for a platform team that wants an open framework now and a governed runtime later, with one programming model across both. Its control plane sits in the execution path¹⁶, its RBAC and SSO behavior is documented in unusual detail^66,58, and it deploys to its cloud, a VPC or the customer's own infrastructure³⁶. It ranks fourth because certifications were not named on the pages that loaded, vendor engineering is an add-on⁹⁷, and the free tier stops at 50 executions a month⁸⁷. Teams that want the build done for them on a fixed timeline will find Nexus closer to that brief.