Business & Enterprise Operations Top 100 / #5ARD = Agentic Resource Discovery · A2A = Agent2Agent · MCP = Model Context Protocol

Framework / orchestration · MIT · GitHub; LangSmith/LangGraph Platform

LangChain

Huge open-source adoption; broad model/tool ecosystem; active enterprise ecosystem. Publisher: LangChain. Also ranked in Technology & Software Engineering (#6), Sales, Marketing & Customer Experience (#19), Supply Chain, Manufacturing & Logistics (#20).

Vendor page ↗+ CompareExport JSON

Trust profileas of 2026-10-26

Publisherconfirmed · Vendor-domain page, marketplace listing or metadata at publisher domain — ARD or A2A metadata served at the publisher's own domainconfirmed

Complianceno evidence about this agent · 4 vendor-level records (inherited)T5

Security81 CVEs linked in the registry · 56 critical/high · newest 2026-10-22linked

ProtocolsModel Context Protocol (MCP) claimed — vendor documentation — langchain-mcp-adapters (official LangChain organisation) (checked 2026-10-02) sourceAgent2Agent (A2A) verified at the publisher's endpointAgentic Resource Discovery (ARD) probed, not found2 / 3

Traces1 public trace · best: reproducible runT1

Issues found0 regulator actions · 0 incidents · 0 withdrawn certificates · CVEs: see Securitylinks only

Evidence available — not a safety certification. Suitability depends on your task, deployment and permissions. Rows marked vendor-level describe LangChain, not this agent specifically.

Traces — under attack, in defence, in incidents

1 public · what a trace is

◎

registry probe

T1 reproducible run · unreviewed

Registry probe of LangChain's discovery endpoints

Fetch and validate the ARD manifest, A2A agent card and MCP server card at the publisher's well-known paths

Observed: A2A verified (unsigned); MCP invalid · egress: no

AgentDossier refresh
2026-10-11

● third-party or vendor report · ◎ this registry's own probe transcript · ⚠ data left the environment. A trace describes one version on one date; it is evidence of behaviour, never a certification. Rows marked unreviewed have not yet been checked against their source by the maintainer.

CVEs — on the official record

81 linked · the registry

CVE-2026-114510

2026-10-22

Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across multiple graph, vector, and search backends. From 0.6.0 until 0.8…

— · unreviewed

High 7.1

CVE-2026-75128

2026-10-20

Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell too…

Tool execution · Auth bypass · unreviewed

Critical 9.3

CVE-2026-108748

2026-10-11

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /_chat/routes endpoint that allows unauthenticated remote…

Auth bypass · unreviewed

Medium 6.9

CVE-2026-105799

2026-10-06

LangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacker-controlled values in structured RediSearch TAG filters an…

— · unreviewed

Low 2.3

CVE-2026-106119

2026-10-06

LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured s…

— · unreviewed

Medium 6.0

CVE-2026-51882

2026-10-01

The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An attacker can write files to arbitrary locations outside the…

Path traversal · unreviewed

Critical 9.1

CVE-2026-51883

2026-10-01

The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences (such…

Path traversal · unreviewed

Critical 9.1

CVE-2026-51884

2026-10-01

The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal. By crafting malicious filenames, an attacker c…

Path traversal · unreviewed

Critical 9.8

73 more · All 81 in the registry → Severity is the official record's; nothing here enters the score. Links are by listed product, so a CVE that names a different component of the same platform may be missing.

Compliance evidence

Jurisdiction: EU + US · 6 frameworks shown

–

ISO 27001

T5 Unknown

Nothing found in the sources checked.

Scope: — · registries, marketplaces, vendor pages

ask the vendor

–

ISO 42001

T5 Unknown

Nothing found in the sources checked.

Scope: — · registries, marketplaces, vendor pages

ask the vendor

"Unknown" means nothing was found in the sources checked — registries, marketplaces and the vendor's own pages. It is not a finding of non-compliance; ask the vendor.

About the vendor — inherited, not agent-specific

4 records matched at organisation level

✔

CSA STAR · STAR Level 1

T1 Registry-matched · vendor-level

found in CSA STAR Registry on 2026-10-26

Scope: entity · CSA STAR Registry · 2026-10-26

re-check 2026-11-02

○

GDPR

T4 Vendor-claimed · vendor-level

Vendor-claimed

Scope: entity · vendor page · 2026-10-26

re-check 2026-11-02

○

HIPAA

T4 Vendor-claimed · vendor-level

BAA available

Scope: entity · vendor page · 2026-10-26

re-check 2026-11-02

○

SOC 2 · SOC 2 Type II

T4 Vendor-claimed · vendor-level

Vendor-claimed

Scope: entity · vendor page · 2026-10-26

re-check 2026-11-02

A vendor-level registry entry proves the organisation was assessed; whether this agent is inside that scope is a question for the vendor. These rows do not count toward the agent's evidence tier.

✔ found · ○ claimed · – not found · ⚠ expired, stale or revoked. Every row links to its source.Dispute or correct this dossier

GDPR, assembled from checks

GDPR● 0 found in registries or documents○ 1 vendor-claimed⚠ 0 issues linkedas of 2026-10-26

○ ClaimedVendor-claimed (vendor page, 2026-10-26).

– Not foundNo Article 42 GDPR seal. "GDPR certified" is never shown without one.

☐ You checkYour lawful basis, DPIA, and whether this agent is inside the certificate scope.

News and chatter

last 90 days · linked with confidence ≥ 0.85

2026-10-22

langchain release langchain-core 1.7.0

GitHub releases · Changes since langchain-core==1.6.13 release(core): 1.7.0 (#41418) feat(core): emit `tool-call-delta` for streamed tool-call args (#41257) ## Notes - Tool-call args now stream as `tool-call-delta` slices instead of `block-delta` snapshot

Product update

2026-10-21

langchain release 1.4.7

GitHub releases · Changes since langchain==1.4.6 chore(langchain): update lockfile (#41402) release(langchain): 1.4.7 (#41401) chore(deps): bump certifi from 2025.11.12 to 2026.10.19 in /libs/langchain_v1 (#41370) feat(core,langchain,standard-tests): read `

Product update

Headline, link and a summary attributed to the outlet. News never changes trust or domain scores.

Business & Enterprise Operations score

general profile · sar-score-2.0 · #5 of 100 in the curated list

Adoption / usage30 / 30

Trust & security22 / 25

Project / product health20 / 20

Ecosystem / interoperability15 / 15

Domain expertise / fit100 / 100

Governance / compliance evidence16 / 100

Docs / transparency10 / 10

Raw component / maximum, then weighted by the general profile (adoption 25, trust 20, project 15, ecosystem 10, domain 10, governance 5, docs 5). Trust and governance are computed from the evidence on this page (vendor-level rows at half credit); the other components come from the curated workbook, whose order is the rank. Unknown components count as 0 and are never imputed.

Before you deploy

Derived from the evidence ledger. This agent is not yet in the reference set, so deployment questions (credentials, approval, data handling) are not answered here — ask the vendor.

Evidence supporting this use (4)

CSA STAR STAR Level 1 — registry-matched, vendor-level source

GDPR — vendor-claimed, vendor-level source

HIPAA — vendor-claimed, vendor-level source

SOC 2 Type II — vendor-claimed, vendor-level source

Unknowns to check (6)

Your lawful basis and DPIA for PHI and personal data the agent will touch

That the SOC 2 report period covers the components you will use; request the report under NDA

That the HIPAA BAA is offered for this product tier and region

Whether the CSA STAR entry covers this product; Level 1 is a self-assessment, Level 2 a third-party attestation

The transfer mechanism you will rely on; DPF covers EU-to-US transfers only

Ask the vendor for ISO 27001, ISO 42001 evidence; none was found in the sources checked

Suggested restrictions for a pilot (0)

No restriction rule fired — review the unknowns above before relying on that.

Rules: config/deploy_rules.json. Advice for a bounded pilot, not a verdict.

Provenance

seed workbookscores, rank, category

GitHubrepository signals, license

CSA STAR Registrycompliance evidence

vendor pageclaims

NVDsecurity (CVE keyword search)

Hacker News, GDELT, vendor feedsnews and chatter

First seen2026-10-26

Recordres_55582a24f05e0d8c

Open the full record (JSON) →