GILD verdict
Choose CrewAI when your agent work maps to specialist roles and you want crews running quickly on models from several vendors, with a managed platform to deploy them.
- The workflow
- A Python team building research, analysis, or drafting pipelines from agents with roles, deployed as a service or on CrewAI AMP.111
- The decisive evidence
- DocumentedCrews of agents with roles, goals, and tools run inside Flows that hold state, route between steps, persist to SQLite, restore from checkpoints, and pause for human feedback.1234
- DocumentedAMP meters workflow executions: Basic is free with a hard maximum of 50 a month, and Enterprise sizes included executions to the workflow with flexible overage and no published rate.9
- DocumentedThe library sends anonymous telemetry by default, and AMP tracing has its own switch, CREWAI_TRACING_ENABLED=false.78
- GILD analysisTen public accounts on this Hub's Signals praise how fast a crew comes together. Concerns run wider: runtime defects in 10 sources, coarse control in 9, and tools that rerun or never run in 7. The only production gains with numbers come from CrewAI's own case studies, which state no method, so the evidence settles prototype speed and leaves production cost to your own test.
- DocumentedThe crewai package requires chromadb 1.5.9, a range GitHub advisory GHSA-f4j7-r4q5-qw2c rates critical for pre-authentication code injection with no patched version, and an agent with no model set falls back to gpt-4.1-mini in the library's code.181923
CrewAI
Agent Framework by CrewAI
−7 MixedFit and limits
Who it fits
- The work divides into specialist roles, such as researcher, analyst, and writer, that hand results to each other.
- The team wants models from several vendors, through native SDKs for OpenAI, Anthropic, Gemini, Azure, Bedrock, and Snowflake Cortex or LiteLLM for the rest.
- Code should decide which crew runs next, through Flows with persisted state and human review steps.
- The organization wants a managed platform with SSO, role-based access control, and deployment in its own VPC.
- Rules must decide the outcome while agents do the reading: IBM Consulting's federal eligibility pilots let Flows choose when rules or agents run, per CrewAI's 2025 case study.
Where it falls short
- Workflows where every transition must be explicit and replayable: agents inside a crew decide how they collaborate unless Flows constrain them.
- Tools with side effects: checkpoint restore reruns unfinished tasks, and builders report tools that run twice on retry.
- Budgets that need a published platform price above 50 executions a month: Enterprise is quoted per customer.
- TypeScript teams: CrewAI is a Python framework.
- Security reviews that block known critical advisories: every crewai release requires ChromaDB, and GHSA-f4j7-r4q5-qw2c rates ChromaDB 1.0.0 to 1.5.9 critical with no patched version. Headroom and ai-agent-assembly removed CrewAI from their lockfiles over it in 2026.
- Platforms that would carry the framework inside their own code: EpicStaff deleted its vendored CrewAI and mem0, 180,251 lines, in September 2026.
Implementation reality
Put crews inside a Flow
Let a Flow decide which crew runs, with @start, @listen, and router steps, and add @persist so state survives a restart. Turn on checkpointing for long runs, and remember that restore skips completed tasks and reruns the rest.
Choose models and keys
Set each agent's model as provider/model-id in the MODEL variable, agent YAML, or code, and supply an API key for each provider you use. memory=True embeds with OpenAI text-embedding-3-large unless you configure another embedder, so set one if memory must stay off OpenAI. An agent with no model set falls back to gpt-4.1-mini in the library's code, while the Agents docs still say gpt-4, so set the model explicitly.
Decide telemetry and tracing
Set CREWAI_DISABLE_TELEMETRY or OTEL_SDK_DISABLED to stop anonymous telemetry, and leave share_crew off unless task details may leave your systems. AMP tracing has its own switch, CREWAI_TRACING_ENABLED=false.
Plan where it runs
AMP Basic covers 50 executions a month, enough for a pilot. Production volume needs Enterprise, quoted per customer with flexible overage, or the open-source library in your own service, where your team runs workers and storage.
What to verify before you buy
What to measure in your pilot
- What an Enterprise quote charges per execution beyond the included volume, which CrewAI does not publish.
- Whether the async, memory, and checkpoint issues filed in September and October 2026 close in the next releases.
- How much token cost default context passing adds to a five-agent crew on your own workload.
- Whether CrewAI moves off ChromaDB 1.5.9, or ChromaDB ships a patch for GHSA-f4j7-r4q5-qw2c.
- How PwC measured the rise from 10% to 70% in code-generation accuracy, which CrewAI's case study does not say.
Sources
- Official documentation
- 22
- Public source
- 4
- CrewAI docs: Introduction (Crews and Flows)
- CrewAI docs: Flows (state and @persist)
- CrewAI docs: Checkpointing
- CrewAI docs: Human feedback in Flows
- CrewAI docs: LLMs (model setup and providers)
- CrewAI docs: Memory (default embedder)
- CrewAI docs: Telemetry
- CrewAI docs: CrewAI Tracing
- CrewAI pricing (AMP Basic and Enterprise, executions, overage)
- CrewAI AMP docs: Introduction
- CrewAI AMP docs: Deploy to AMP
- CrewAI AMP docs: Just-in-Time SSO provisioning
- CrewAI AMP docs: Role-Based Access Control
- CrewAI AMP docs: Flow HITL Management (audit logs)
- CrewAI Trust Center (SOC 2, HIPAA, data retention)
- CrewAI on GitHub (MIT license, Python versions, telemetry)
- CrewAI releases on GitHub (1.15.32, Oct 27, 2026)
- CrewAI source: pyproject.toml, which requires chromadb~=1.5.9
- CrewAI source: constants.py, DEFAULT_LLM_MODEL gpt-4.1-mini
- CrewAI customer story: PwC accelerates enterprise-scale GenAI adoption with CrewAI (undated, read Oct 28, 2026)
- CrewAI customer story: Gelato accelerates fulfillment via agentic integration (undated, read Oct 28, 2026)
- CrewAI customer story: IBM automates federal eligibility with agents (undated, read Oct 28, 2026)
- GitHub advisory GHSA-f4j7-r4q5-qw2c: ChromaDB pre-authentication code injection, critical (May 18, 2026)
- EpicStaff pull request #768: delete vendored CrewAI and mem0 libraries (Aug 20, 2026, merged Sep 4, 2026)
- Headroom pull request #3870: drop the crewai extra to remove chromadb from the lockfile (Sep 30, 2026)
- ai-agent-assembly pull request #133: remove crewai to fix a critical chromadb vulnerability (Jul 7, 2026)