Rating · evidence to 26 Sept 2026
70
- Provisional
- Trust B
- Open source
The Register / Multi-agent frameworks / CrewAI
Register entry · Multi-agent frameworks · updated 26 Sept 2026
CrewAI
CrewAI, Inc. · Multi-agent frameworks
CrewAI is an MIT-licensed Python framework in which developers define agents with a role, goal and backstory, assign them tasks and tools, and run them as a Crew (LLM-driven collaboration) or a Flow (deterministic, event-driven steps with state). The company sells a hosted Agent Management Platform (AMP) with a visual Studio builder, tracing and enterprise controls; a free Basic tier allows 50 workflow executions a month. Version 1.0 of the open-source core was declared GA in October 2025 and the 1.15.x line was shipping weekly in September 2026.
What reviewers and users praise
- Fast route from idea to a working multi-agent prototype (Cybernews, vibecoding.app, Rework; several Reddit users)
- Role-based model is easy to understand (Reddit r/LangChain, r/AI_Agents comments)
- Model-agnostic, with local model support (Cybernews review)
What they criticise
- Users report it becomes hard to control once workflows need branching, retries or custom error handling (Reddit r/LangChain, r/AI_Agents)
- Context bloat and token cost in delegated handoffs and at scale (vibecoding.app review; r/LangChain comment)
- Observability and governance features sit in the paid AMP, not the open-source framework (Cybernews review)
- Four CVEs (RCE, file read, SSRF) disclosed March 2026 in bundled tools; fixed by removing/validating tools
Experts vs the crowdneeds both scores
Experts—
Crowd43
| Price | Free |
|---|---|
| Use it via | API, CLI, Web app |
| Runs on | macos, linux, windows, web |
| Licence | MIT |
| Updated | Evidence collected 26 Sept 2026 |
How the rating was worked out
Weights for Multi-agent frameworks: adoption 45%, experts 30%, crowd 25%. Pillars without enough evidence are left out and the others re-weighted. The method.
| Adoption & momentumweight 45% | 86 | GitHub stars 59k → 84 · PyPI monthly downloads 2.4M → 75 · 26 releases in 90 days → 100reach × 0.7 + momentum × 0.3 |
|---|---|---|
| Expertsindependent reviews · weight 30% | — | Only 2 independent reviews (3 needed) |
| Crowdcommunity sample · weight 25% | 43 | 14 dated posts from reddit, hackernews: 4 positive · 3 mixed · 7 negative (positive + ½ mixed) ÷ n, averaged toward 50 for small samples |
| Rating | 70 | Provisional: low confidence (2 of 3 pillars, 14 community posts). |
Evidence checks. 2 reviews from tool directories, AI-written pages or unnamed authors not counted. 1 item could not be checked at the source (the page could not be fetched, or the quote is from a comment under the linked post); kept and marked “unverified”. How evidence is checked.
Editorial adjustment. Incident-history re-grade under methodology revision 2 (see the trust section).
Trust & safety
Seven dimensions graded A–D from documented facts. Overall: B.
C
Permission model
Agents call their assigned tools without per-action approval by default; human review of a task's final answer is opt-in (human_input 'Defaults to False'). Built-in code execution (Docker 'safe' mode) is deprecated and the CodeInterpreterTool removed; docs point to external sandboxes (E2B, Modal). source
B
Data access scope
Agents reach only the tools and knowledge sources the developer assigns, but tools run with the host process's permissions; no framework-level folder/URL allowlist until validate_file_path()/validate_url() were added after CVE-2026-2285/2286. source
A
Data storage
Open-source framework runs locally or self-hosted; no required cloud storage. The hosted AMP is optional. source
n/e
Data retention & training
Framework sends anonymous telemetry by default (versions, crew/agent/task metadata, tool usage; no prompts or task content), opt-out via CREWAI_DISABLE_TELEMETRY or OTEL_SDK_DISABLED; opt-in share_crew sends goals, backstories and outputs. No retention period or training statement found for AMP; model-provider policies govern prompts. source
C
Incident history (24 months)
Two separate serious events in 24 months, both resolved. Noma Labs reported an exposed internal CrewAI GitHub token with admin access (disclosed Sept 2025, fixed). CERT/CC VU#221883 (30 Mar 2026): four CVEs (RCE via sandbox fallback, arbitrary file read, SSRF, Docker-check bypass); vendor states all fixed in current releases. Regraded from D: Revision 2: serious issues that were each fixed and publicly disclosed grade C; D is kept for unresolved issues or slow or undisclosed fixes. source
n/e
Compliance
Sources disagree: Cybernews (May 2026) and Speakeasy (Mar 2026) say AMP Enterprise is SOC 2 Type II and HIPAA compliant; Waxell (a competitor, Aug 2026) quotes the CrewAI Trust Center as 'SOC 2 Type II (in progress)'. trust.crewai.com renders client-side and could not be read. source
A
Transparency
MIT-licensed source with public GitHub releases and a docs changelog. source
The experts
2 named independent reviews found; dated reviews from the last 12 months are scored.
- positive
CrewAI is the strongest open-source multi-agent framework available right now for Python developers.
Aurelija Tomkevičiūtė, Cybernews · 28 May 2026 · unverified · cybernews.com - mixed
The cracks show at scale. Observability, speed, and token costs become real problems without additional tooling.
Zane, vibecoding.app · 29 Jun 2026 · vibecoding.app
The crowd
14 coded posts from reddit, hackernews.
4 positive3 mixed7 negative
- negative
CrewAI’s team abstraction feels natural in demos, but passing tasks via implicit message histories turns into context bloat the moment a run hits an operational bump.
r/LangChain · 21 Sept 2026 · reddit.com - mixed
CrewAI feels more natural for role based workflows, but LangGraph's explicit state, checkpoints, and retries make complex handoffs much easier to manage.
r/LangChain · 22 Sept 2026 · reddit.com - mixed
That pushes me toward LangGraph for the outer orchestration; CrewAI Flows can get close now with structured state and persistence.
r/LangChain · 21 Sept 2026 · reddit.com - negative
crewai fights you the moment you want something the role/task model didn't plan for.
r/LangChain · 1 Jul 2026 · reddit.com - negative
CrewAI: Great concept, too opinionated for production. The moment you need custom error handling or fine control over tool execution, you are fighting the framework
r/AI_Agents · 27 Mar 2026 · reddit.com - negative
CrewAI is great for demos, falls apart under real load.
r/AI_Agents · 21 Mar 2026 · reddit.com - positive
Switched to self-hosted n8n + Python for enrichment/Clearbit scrapes + CrewAI agents for ops. Now it's dirt cheap and actually reliable.
r/AI_Agents · 19 Mar 2026 · reddit.com - positive
Set up multi-agent teams in like 10 lines of Python, and it worked through errors on its own.
r/AI_Agents · 18 Mar 2026 · reddit.com
Pricing
As published, checked 26 Sept 2026.
| Plan | Price | Notes |
|---|---|---|
| Open-source framework | Free | MIT licence; you pay only for model API usage and your own hosting. |
| AMP Basic | Free | Visual editor and AI copilot, GitHub integration, 50 workflow executions per month. |
| AMP Enterprise | Custom | Custom pricing; adds SSO, RBAC, workload identity, PII redaction and policies. |
Recent changes
Sources
Every figure above traces to one of these, observed up to 26 Sept 2026.
- CrewAI pricing (Basic free / Enterprise custom; 'Used by 65% of the Fortune 500')
- CrewAI docs: Telemetry
- CrewAI docs: Agents (code execution deprecated)
- CrewAI OSS 1.0 - We are going GA (20 Oct 2025; search snippet)
- Waxell vs CrewAI (competitor; cites Trust Center 'SOC 2 Type II (in progress)'; search snippet)
- Speakeasy framework comparison ('CrewAI is SOC 2 Type II and HIPAA compliant'; search snippet)