CrewAI

CrewAI: a code-first framework with a governed platform built around it

CrewAI is the most code-first builder on this site, and around its framework it now offers a platform that business teams can use too¹. Its GitHub repository describes a framework for orchestrating role-playing, autonomous AI agents², released under the MIT license³; the license file is the standard MIT permission grant⁴. The home page presents CrewAI as The Enterprise Agent Build & Runtime⁵, and says it gives business and engineering teams a unified build and runtime platform that is centrally governed¹.

For a Head of Digital choosing a build style, that dual identity is the key fact about CrewAI. Developers get a permissive open-source framework and a CLI. Business users get a visual editor whose output can be exported to Python. A platform team gets a control plane that sits in the execution path. This page reviews each layer, the enterprise controls and the published limits. CrewAI ranks seventh on this site.

Scale and positioning

The repository showed 60.7k stars when checked⁶. The home page claims use by 65% of the Fortune 500⁷, a vendor claim. The framework is built on Crews of AI agents and event-driven Flows⁸.

The commercial product is CrewAI AMP. The enterprise documentation describes it as a platform for deploying, monitoring and scaling crews and agents in production⁹, extending the open-source framework with features for production deployments, collaboration and scalability¹⁰. The README lists a Unified Control Plane for managing, monitoring and scaling agents and workflows¹¹, and tracing and observability with metrics, logs and traces¹².

Three ways to build

The code-first route is the original one. The home page offers a code-first API built for total control¹³. The CLI command crewai create crew creates a JSON-first crew project¹⁴, with agents defined in agents/*.jsonc¹⁵. For an engineering team this means agent definitions live in files that can be reviewed, versioned and diffed like any other code.

The visual route is newer. The home page describes a no-code visual editor, exportable to Python¹⁶. The enterprise docs describe Crew Studio as a no-code/low-code interface for creating and customizing crews¹⁷. The export path is the interesting part for a Head of Digital: a business user's prototype can become a developer's codebase without being rebuilt.

The third route is assisted. An automated multi-agent builder is described as intelligently guided by 700k agent workflow patterns¹⁸. CrewAI Discovery matches patterns observed over billions of agent runs against a customer's tickets, chats, apps and workflows¹⁹. Both are vendor descriptions of method; a buyer should test them on its own processes.

Nexus follows a related idea with Cue, its build loop, which settles the use case with the user, asks follow-up questions and wires the agent to company data under proper permissions²⁰; Nexus consultants sit beside the customer while it runs (owner decision²¹).

The control plane

CrewAI's distinctive design choice is where governance sits. The home page says the Control Plane sits in the execution path of every workflow²², so agent interactions can be observed and controlled as they run. Real-time tracing covers every LLM call, tool call and memory read, with full cost accounting²³. Runtime hooks inject PII redaction and policy checks at every LLM and tool call²⁴. Human-in-the-loop approval gates and intervention are available during execution²⁵. Optimize includes multi-LLM testing for swapping models at runtime²⁶.

For a Head of Digital worried about agent sprawl, this is a strong architecture. The home page frames the buyer journey in three stages: teams ready for agents that need a foundation²⁷, teams with pilots that now need production²⁸, and teams with running agents that need to manage the sprawl²⁹.

Deployment

The platform deploys crews to managed infrastructure in a few clicks³⁰, and crews are monitored with detailed execution traces and logs³¹. Code can be deployed by connecting a GitHub repository³² or through the CLI for more advanced workflows³³, and Crew Studio builds can be deployed from the no-code interface³⁴. GitHub deployments use repository secrets for the CrewAI token and automation UUID³⁵, and pull-request deployments are triggered by a label³⁶. Getting started begins with account sign-up³⁷.

Enterprise deployment can run on CrewAI cloud, the customer's own VPC or the customer's own infrastructure³⁸, and a dedicated VPC is an Enterprise option³⁹. That range puts CrewAI alongside Dify and n8n as builders that can run inside a customer's perimeter.

Integrations

The integration documentation has a page per connector, from Asana to Zendesk⁴⁰. Triggers include a Zapier trigger⁴¹. Webhook streaming sends real-time events to the customer's systems⁴². OpenTelemetry export⁴³ and a Datadog integration⁴⁴ are documented. Enterprise includes enterprise connectors, which Basic does not⁴⁵. Both plans can export a crew as an MCP server⁴⁶ or as a UI component⁴⁷.

The Marketplace is for discovering, installing and governing reusable assets for enterprise crews⁴⁸. Agent repositories store, share and reuse agent definitions across teams and projects⁴⁹, and Tools & Integrations connect external apps and manage internal tools agents can use⁵⁰.

CrewAI documents its connectors one page at a time⁴⁰, while Nexus publishes a single count of more than 4,000 integrations⁵¹.

Security and identity

Enterprise includes SSO with Microsoft Entra and Okta⁵² and role-based access control⁵³. The pricing page summarizes enterprise governance as SSO, RBAC, workload identity, PII redaction and policies⁵⁴. The home page adds immutable audit trails and Enterprise IAM⁵⁵. The Hallucination Guardrail is an enterprise feature that validates AI-generated content⁵⁶.

PII handling is documented in detail. PII Redaction detects and masks personal data in crew and flow execution traces⁵⁷, masking sensitive data before it is stored⁵⁸. It is available on Enterprise⁵⁹ and must be enabled manually for each deployment⁶⁰. Each enabled entity adds processing overhead⁶¹. The page names GDPR, HIPAA and PCI-DSS as regulations that make compliance hard without redaction⁶².

On certifications, the home page footer links to a security trust center⁶³, but the saved copy of that page loads only its title⁶⁴. SOC 2, ISO 27001 and other certifications are not publicly stated on the pages we opened. For a security reviewer this is the first item to request. Nexus holds SOC 2 Type 2, GDPR, ISO 27001 and ISO 42001 (owner decision²¹).

Access control

RBAC in CrewAI AMP works in two layers, feature permissions and entity-level permissions⁶⁵. Predefined roles are Owner and Member⁶⁶. The Owner has full access to all features and settings and cannot be restricted⁶⁷. The Member has read access to most features and manage access to environment variables, LLM connections and Studio projects⁶⁸. Custom roles can be created⁶⁹. Each feature has a level of Manage, Read or No access⁷⁰, though environment variables, LLM connections and Studio projects support only Manage or No access⁷¹.

Entity-level rules go further. Private automations are visible only to whitelisted users and roles⁷², and the organization owner always has access⁷³. Entity-level RBAC can restrict which roles or users view or manage specific environment variables⁷⁴. A human_in_the_loop permission covers responding to HITL requests⁷⁵. Deploying from GitHub requires crews_dashboards at Read⁷⁶, and zip deployments require that the organization has not disabled them⁷⁷. Read on organization_settings shows the Members tab without granting access to the settings page⁷⁸.

Identity provisioning is Just-in-Time. JIT SSO provisions users and Team access from identity-provider groups⁷⁹, and it is not Directory Sync or SCIM⁸⁰. Entra ID, Okta, Keycloak and Auth0 SAML connections receive the group mapping automatically when active⁸¹. Group-to-Team mappings add or remove SSO-managed Team access⁸², though memberships assigned directly in CrewAI are not removed by SSO reconciliation⁸³. Removing a user's SSO assignment prevents future sign-ins without immediately deleting the CrewAI user⁸⁴.

The documented edge cases matter for an identity team. Entra omits the group list when a SAML assertion exceeds its 150-group limit⁸⁵. Group changes apply when the user next completes an SSO sign-in⁸⁶, and refreshing an existing session does not reconcile Team access⁸⁷. Group membership in Entra ID requires Entra ID P1 or P2⁸⁸.

Pricing and onboarding

The Basic plan is free with a limit of 50 workflow executions a month⁸⁹ and includes the visual editor and AI copilot⁹⁰, Studio⁹¹ and the GitHub integration⁹². It is presented as a starting point for building an agentic workflow⁹³. Basic support is community only, while Enterprise adds dedicated and Slack or Teams support⁹⁴.

Enterprise is custom priced⁹⁵ and includes everything in Free plus governance⁹⁶. It includes a 45-day onboarding that lays the foundation for agent production at scale⁹⁷, flexible overage for additional executions⁹⁸, and forward deployed engineering and training available a la carte⁹⁹. Maximum executions are 50 on Basic and custom on Enterprise¹⁰⁰.

The commercial structure is clear on one point that matters to a Head of Digital. Hands-on engineering help is available, priced as an add-on⁹⁹. Nexus includes consultancy support in a software pricing model, priced per role automated, with no per diem or consultant time, and puts the first agent live in 4 weeks inside a 3-month proof of concept (owner decision²¹).

Customer evidence

The home page lists several customer claims. Docusign accelerated lead time-to-first-contact by extracting, consolidating and evaluating lead data from multiple internal systems¹⁰¹. General Assembly scaled its curriculum design with a crew of agents¹⁰². Gelato enriches leads with agents, reported as 3,000+ a month¹⁰³. One customer cut voice-agent QA from 74 to 3 hours¹⁰⁴. Piracanjuba reports 95% response accuracy for customer support¹⁰⁵. The home page frames the audience as business and technical teams building agents while platform teams govern them¹⁰⁶.

Where CrewAI fits among build styles

Read against the three build styles, CrewAI is code-first with a visual front door. A business user can start in Crew Studio¹⁷, but the destination of that work is Python¹⁶ and a repository deployed through GitHub³². A low-code team will find the visual editor useful for drafting crews and the CLI useful for everything after³³. A code-first team gets the most: agent definitions in JSON files¹⁵, deployments driven by pull-request labels³⁶, and traces exported through OpenTelemetry⁴³.

Three questions follow for an evaluation. Does the company have engineers who will own the exported code and the deployment pipeline³⁵? Will the security team accept a vendor whose certifications are not publicly stated on the pages we opened, pending the trust center documents? And will the 45-day onboarding⁹⁷ plus a la carte forward deployed engineering⁹⁹ cover the first production agents, or will internal staff carry the build? A team that answers yes to the first and has a plan for the other two is a natural CrewAI customer.

Strengths

CrewAI offers the strongest code-first path on this site, with an MIT-licensed framework³, a JSON-first CLI¹⁴ and GitHub-driven deployment³². A visual editor exports to Python¹⁶, which links business prototypes to engineering ownership. The control plane traces every LLM call, tool call and memory read²³, with runtime policy hooks²⁴. Deployment can run in the customer's VPC or infrastructure³⁸. RBAC is detailed and documented⁶⁵.

Limits

Certifications are not publicly stated on the pages we opened. The free plan allows 50 executions a month⁸⁹. PII Redaction is Enterprise only and must be enabled per deployment^59,60. JIT SSO is not SCIM⁸⁰, and group changes wait for the next sign-in⁸⁶. Forward deployed engineering is an extra⁹⁹. Enterprise prices are not published⁹⁵.

Verdict

CrewAI ranks seventh. For a Head of Digital with a strong engineering team that wants a permissive framework, code-reviewed agent definitions and a runtime control plane, it is an excellent technical foundation. It ranks behind Nexus because Nexus covers what CrewAI leaves open or sells as extras. Nexus consultants build next to the customer, production starts at week 4 of a 3-month proof of concept, pricing follows the role automated, and the Nexus certifications are SOC 2 Type 2, GDPR, ISO 27001 and ISO 42001 (owner decision²¹). Its unstated certifications also place it behind the other platforms reviewed here for a buyer whose security team must sign off early.