Langflow
Visual drag-and-drop builder for LangChain agents and RAG workflows.
Acquired — still operating
acquired via DataStax/IBM May 2025; actively released
About
Langflow is a Python/React open-source platform for building AI agents and RAG pipelines on a visual canvas, where every component exposes editable Python source. Each flow can be served as a REST API, an MCP server, or an OpenAI-compatible Responses endpoint. Originally created by Logspace, it was acquired by DataStax and is now part of IBM (DataStax acquisition closed May 2025); the project remains MIT-licensed and is actively released (v1.12.x, Sep 2026).
What it can do
- Drag-and-drop canvas (React Flow) for agents, chains, and RAG pipelines
- Every component exposes editable Python source code
- Interactive playground to test and refine flows step by step
- Every flow deploys as a REST API, an MCP server, or an OpenAI-compatible Responses endpoint
- Multi-agent orchestration with conversation management and retrieval
- Knowledge bases and per-flow memory bases (long-term conversation memory)
- Human-in-the-loop checkpoints and A2A protocol support (v1.11+)
- Observability via OpenTelemetry, LangSmith, and LangFuse integrations
- Langflow Assistant: describe a flow in natural language and it generates the canvas
Setup
- Install uv and have Python 3.10–3.14 available.
- From a fresh directory, install the package:
uv pip install langflow -U(orpip install langflow -U). - Start Langflow:
uv run langflow run(equivalentlylangflow runorpython -m langflow run). - Open
http://127.0.0.1:7860, create an account, and drag components onto the canvas to build your first flow. - Alternative installs: Docker via
docker run -p 7860:7860 langflowai/langflow:latest, or download Langflow Desktop (Windows/macOS) from the official site.
Prerequisites
Python 3.10–3.14 with uv (or Docker); an LLM provider API key for most flows.
Use cases
Works with
Trust score — 9/10
Massive adoption (155k+ stars) and very active maintenance (v1.12.3 Sep 2026, desktop apps, cloud option). Score capped because of real security history: critical RCE CVE-2026-105697 (Oct 2026, MCP stdio config) with public PoC, patched in 1.10.3+, plus SSRF/sandbox/credential-isolation fixes in 1.12.3 — the attack surface is genuinely wide (flows execute arbitrary Python components, The Register explicitly advises sandboxing before production). Corporate ownership churn (Logspace -> DataStax -> IBM) is a governance footnote, not a blocker; project stays MIT. Red flags: CVE-2026-105697 (critical, OS command injection via MCP stdio server configuration, PoC public) — fixed in 1.10.3+; do not run <1.10.3. Helm chart for 1.12.3 documents additional sandbox/SSRF/credential-isolation/cache-deserialization security fixes. Flows execute arbitrary Python — sandbox before production use. Metrics-v1 score 9/10 — adoption 8.7, maintenance 9.7, openness 10, manual 7.
★ 155,548 GitHub stars
How the trust score is built
Full methodology →- Adoption · stars/downloads, log-scaled vs peers
- 8.7/10
- Maintenance · recency, releases, issue load
- 9.7/10
- Openness · license + docs
- 10.0/10
- Manual review · sanity read + red-flag check
- 7.0/10
- · 155,548 GitHub stars (log-scaled vs catalog peers)
- · blended with ~37,742 monthly package downloads
- · last push 0d ago; 45 releases/12mo; 1150 open issues
- · manual review: critical RCE CVE-2026-105697 (Oct 2026, patched in 1.10.3+); flows execute arbitrary Python — sandbox in production
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.