Reference implementation Data compiled from public sources as of 2026-10-26. Not an assessment, certification or recommendation. Confirm current status with the vendor and the issuing body.
AgentDossier · AI Agent Registry Find agents you can actually trust - public or inside your enterprise.
Business & Enterprise Operations Top 100 / #6ARD = Agentic Resource Discovery · A2A = Agent2Agent · MCP = Model Context Protocol
Agent runtime / orchestration · MIT · GitHub; LangGraph Platform

LangGraph

Stateful graph orchestration, durable execution, strong production adoption signals. Publisher: LangChain. Also ranked in Technology & Software Engineering (#7), Supply Chain, Manufacturing & Logistics (#18), Cybersecurity (#20).

Vendor page ↗+ CompareExport JSON
Trust profileas of 2026-10-26
Publisherconfirmed · Vendor-domain page, marketplace listing or metadata at publisher domain — ARD or A2A metadata served at the publisher's own domainconfirmed
Complianceno evidence about this agent · 4 vendor-level records (inherited)T5
Security4 CVEs linked in the registry · 2 critical/high · newest 2026-09-14linked
ProtocolsModel Context Protocol (MCP) found but invalidAgent2Agent (A2A) verified at the publisher's endpointAgentic Resource Discovery (ARD) probed, not found1 / 3
Traces1 public trace · best: reproducible runT1
Issues found0 regulator actions · 0 incidents · 0 withdrawn certificates · CVEs: see Securitylinks only

Evidence available — not a safety certification. Suitability depends on your task, deployment and permissions. Rows marked vendor-level describe LangChain, not this agent specifically.

Traces — under attack, in defence, in incidents

1 public · what a trace is
◎
registry probe
T1 reproducible run · unreviewed
Fetch and validate the ARD manifest, A2A agent card and MCP server card at the publisher's well-known paths
Observed: A2A verified (unsigned); MCP invalid · egress: no
AgentDossier refresh
2026-10-11

● third-party or vendor report · ◎ this registry's own probe transcript · ⚠ data left the environment. A trace describes one version on one date; it is evidence of behaviour, never a certification. Rows marked unreviewed have not yet been checked against their source by the maintainer.

CVEs — on the official record

4 linked · the registry
CVE-2026-55253
2026-09-14
LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, MongoDBSav…
— · unreviewed
High 7.7
CVE-2026-48121
2026-08-04
@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL inje…
— · unreviewed
Medium 6.7
CVE-2026-14742
2026-07-05
A vulnerability was determined in langchain-ai langgraph up to 1.2.4. The affected element is the function _freeze of the file libs/langgraph/langgraph/_internal/_cache.py of the…
— · unreviewed
Low 1.3
CVE-2025-8709
2025-10-26
A SQL injection vulnerability exists in the langchain-ai/langchain repository, specifically in the LangGraph's SQLite store implementation. The affected version is langgraph-check…
Data exfiltration · Credential access · unreviewed
High 7.3

All 4 in the registry → Severity is the official record's; nothing here enters the score. Links are by listed product, so a CVE that names a different component of the same platform may be missing.

Compliance evidence

Jurisdiction: EU + US · 6 frameworks shown
–
ISO 27001
T5 Unknown
Nothing found in the sources checked.
Scope: — · registries, marketplaces, vendor pages
ask the vendor
–
ISO 42001
T5 Unknown
Nothing found in the sources checked.
Scope: — · registries, marketplaces, vendor pages
ask the vendor

"Unknown" means nothing was found in the sources checked — registries, marketplaces and the vendor's own pages. It is not a finding of non-compliance; ask the vendor.

About the vendor — inherited, not agent-specific

4 records matched at organisation level
✔
CSA STAR · STAR Level 1
T1 Registry-matched · vendor-level
found in CSA STAR Registry on 2026-10-26
Scope: entity · CSA STAR Registry · 2026-10-26
re-check 2026-11-02
○
GDPR
T4 Vendor-claimed · vendor-level
Vendor-claimed
Scope: entity · vendor page · 2026-10-26
re-check 2026-11-02
○
HIPAA
T4 Vendor-claimed · vendor-level
BAA available
Scope: entity · vendor page · 2026-10-26
re-check 2026-11-02
○
SOC 2 · SOC 2 Type II
T4 Vendor-claimed · vendor-level
Vendor-claimed
Scope: entity · vendor page · 2026-10-26
re-check 2026-11-02

A vendor-level registry entry proves the organisation was assessed; whether this agent is inside that scope is a question for the vendor. These rows do not count toward the agent's evidence tier.

✔ found · ○ claimed · – not found · ⚠ expired, stale or revoked. Every row links to its source.Dispute or correct this dossier

GDPR, assembled from checks

GDPR● 0 found in registries or documents○ 1 vendor-claimed⚠ 0 issues linkedas of 2026-10-26
○ ClaimedVendor-claimed (vendor page, 2026-10-26).
– Not foundNo Article 42 GDPR seal. "GDPR certified" is never shown without one.
☐ You checkYour lawful basis, DPIA, and whether this agent is inside the certificate scope.

News and chatter

last 90 days · linked with confidence ≥ 0.85
2026-10-24
langgraph==1.2.17
GitHub releases · Changes since 1.2.16 * release(langgraph): 1.2.17 (#9418) * fix(langgraph): apply an explicit recursion_limit equal to the default (#9417) * fix(langgraph): keep the caller's namespace in RemoteGraph.stream(subgraphs=True) (#9401) * chore(
Product update
2026-10-23
langgraph-cli==0.4.38
GitHub releases · Changes since cli==0.4.37 * release(cli): 0.4.38 (#9411) * feat(cli): add the priority section to langgraph.json (#9393) * chore(deps): bump uv from 0.11.15 to 0.13.4 in /libs/cli (#9366) * chore(deps): bump certifi from 2026.2.25 to 2026.
Product update

Headline, link and a summary attributed to the outlet. News never changes trust or domain scores.

Business & Enterprise Operations score

91
general profile · sar-score-2.0 · #6 of 100 in the curated list
Adoption / usage29 / 30
Trust & security21 / 25
Project / product health20 / 20
Ecosystem / interoperability15 / 15
Domain expertise / fit100 / 100
Governance / compliance evidence16 / 100
Docs / transparency10 / 10

Raw component / maximum, then weighted by the general profile (adoption 25, trust 20, project 15, ecosystem 10, domain 10, governance 5, docs 5). Trust and governance are computed from the evidence on this page (vendor-level rows at half credit); the other components come from the curated workbook, whose order is the rank. Unknown components count as 0 and are never imputed.

Before you deploy

Derived from the evidence ledger. This agent is not yet in the reference set, so deployment questions (credentials, approval, data handling) are not answered here — ask the vendor.

Evidence supporting this use (4)
CSA STAR STAR Level 1 — registry-matched, vendor-level source
GDPR — vendor-claimed, vendor-level source
HIPAA — vendor-claimed, vendor-level source
SOC 2 Type II — vendor-claimed, vendor-level source
Unknowns to check (6)
Your lawful basis and DPIA for PHI and personal data the agent will touch
That the SOC 2 report period covers the components you will use; request the report under NDA
That the HIPAA BAA is offered for this product tier and region
Whether the CSA STAR entry covers this product; Level 1 is a self-assessment, Level 2 a third-party attestation
The transfer mechanism you will rely on; DPF covers EU-to-US transfers only
Ask the vendor for ISO 27001, ISO 42001 evidence; none was found in the sources checked
Suggested restrictions for a pilot (1)
Do not wire it in over MCP until the server card validates.

Rules: config/deploy_rules.json. Advice for a bounded pilot, not a verdict.

Provenance

seed workbookscores, rank, category
GitHubrepository signals, license
CSA STAR Registrycompliance evidence
vendor pageclaims
NVDsecurity (CVE keyword search)
Hacker News, GDELT, vendor feedsnews and chatter
First seen2026-10-26
Recordres_c7563a5f79c4e793
Open the full record (JSON) →