{
"canonical_url": "github.com/langchain-ai/langgraph",
"capabilities": [],
"category": "Agent runtime / orchestration",
"commercial": false,
"compliance": [
{
"certificate_id": "langchain, inc.",
"covers_resource": "unknown",
"credited": true,
"detail": {
"note": "From the STAR Registry index card; STAR Level 1 is a self-assessment (CAIQ), Level 2 a third-party certification or attestation.",
"organization": "LangChain, Inc.",
"terms": [
"star_level_1",
"caiq"
]
},
"display": "STAR Level 1: found in CSA STAR Registry on 2026-10-26",
"evidence_url": "https://cloudsecurityalliance.org/star/registry/langchain, inc.",
"framework": "csa_star",
"issued": "2025-11-25",
"issuer": "Cloud Security Alliance",
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "51c7c3cba565bd44fb1a057b2b3d9312894a56c98eab49f361756b0b3c868a15",
"period_end": null,
"retrieved_at": "2026-10-26T12:25:34Z",
"review_reason": "entity 1.00 (index card)",
"reviewer": null,
"scope": "entity",
"source": "csa_star",
"status": "active",
"tier": 1,
"valid_until": null,
"variant": "STAR_LEVEL_1"
},
{
"certificate_id": null,
"covers_resource": "unknown",
"credited": true,
"detail": {
"pages_visited": 5
},
"display": "Vendor-claimed (vendor page, 2026-10-26)",
"evidence_url": "https://docs.langchain.com/",
"framework": "gdpr",
"issued": null,
"issuer": null,
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "0802aaf09bf73613263a7ca394bf4c3c7c583455f741af8bf31a0b698353f51a",
"period_end": null,
"retrieved_at": "2026-10-26T12:29:23Z",
"review_reason": "framework named on the vendor's own page",
"reviewer": null,
"scope": "entity",
"source": "vendor_trust_centers",
"status": "active",
"tier": 4,
"valid_until": null,
"variant": null
},
{
"certificate_id": null,
"covers_resource": "unknown",
"credited": true,
"detail": {
"pages_visited": 5
},
"display": "HIPAA: BAA available (vendor-claimed, 2026-10-26)",
"evidence_url": "https://docs.langchain.com/",
"framework": "hipaa",
"issued": null,
"issuer": null,
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "0802aaf09bf73613263a7ca394bf4c3c7c583455f741af8bf31a0b698353f51a",
"period_end": null,
"retrieved_at": "2026-10-26T12:29:23Z",
"review_reason": "framework named on the vendor's own page",
"reviewer": null,
"scope": "entity",
"source": "vendor_trust_centers",
"status": "active",
"tier": 4,
"valid_until": null,
"variant": null
},
{
"certificate_id": null,
"covers_resource": "unknown",
"credited": true,
"detail": {
"pages_visited": 5
},
"display": "SOC 2 Type II: Vendor-claimed (vendor page, 2026-10-26)",
"evidence_url": "https://docs.langchain.com/",
"framework": "soc2",
"issued": null,
"issuer": null,
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "0802aaf09bf73613263a7ca394bf4c3c7c583455f741af8bf31a0b698353f51a",
"period_end": null,
"retrieved_at": "2026-10-26T12:29:23Z",
"review_reason": "framework named on the vendor's own page",
"reviewer": null,
"scope": "entity",
"source": "vendor_trust_centers",
"status": "active",
"tier": 4,
"valid_until": null,
"variant": "SOC2_TYPE_II"
}
],
"deployment": "GitHub; LangGraph Platform",
"description": "Stateful graph orchestration, durable execution, strong production adoption signals.",
"disclaimer": "Reference implementation by Hemant Naik. Compliance information is compiled from the sources shown as of the date shown. It is not an assessment, certification, legal opinion or recommendation. Confirm current status with the vendor and the issuing body.",
"domains": {
"business": {
"components": {
"adoption": 29.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 16.2,
"health": 20.0,
"trust": 21.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"soc2": 0.15
},
"profile": "general",
"rank": 6,
"recomputed": 95.1,
"score": 90.9,
"score_version": "sar-score-2.0",
"seed_rank": 6,
"seed_score": 95.1,
"source": "seed_xlsx",
"unknown": []
},
"cybersecurity": {
"components": {
"adoption": 29.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 23.0,
"health": 20.0,
"trust": 21.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"soc2": 0.15
},
"profile": "security",
"rank": 20,
"recomputed": 83.1,
"score": 87.6,
"score_version": "sar-score-2.0",
"seed_rank": 20,
"seed_score": 83.1,
"source": "seed_xlsx",
"unknown": []
},
"data": {
"components": {
"adoption": 29.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 13.0,
"health": 20.0,
"trust": 21.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"soc2": 0.15
},
"profile": "data",
"rank": 27,
"recomputed": 88.6,
"score": 96.0,
"score_version": "sar-score-2.0",
"seed_rank": 27,
"seed_score": 88.6,
"source": "seed_xlsx",
"unknown": []
},
"finance": {
"components": {
"adoption": 29.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 13.0,
"health": 20.0,
"trust": 21.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"soc2": 0.15
},
"profile": "regulated",
"rank": 39,
"recomputed": 77.2,
"score": 82.5,
"score_version": "sar-score-2.0",
"seed_rank": 39,
"seed_score": 77.2,
"source": "seed_xlsx",
"unknown": []
},
"government": {
"components": {
"adoption": 29.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 20.0,
"health": 20.0,
"trust": 21.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5
},
"profile": "regulated",
"rank": 45,
"recomputed": 77.2,
"score": 83.5,
"score_version": "sar-score-2.0",
"seed_rank": 45,
"seed_score": 77.2,
"source": "seed_xlsx",
"unknown": []
},
"healthcare": {
"components": {
"adoption": 29.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 16.0,
"health": 20.0,
"trust": 21.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"hipaa": 0.15,
"soc2": 0.15
},
"profile": "regulated",
"rank": 31,
"recomputed": 77.2,
"score": 82.9,
"score_version": "sar-score-2.0",
"seed_rank": 31,
"seed_score": 77.2,
"source": "seed_xlsx",
"unknown": []
},
"insurance": {
"components": {
"adoption": 29.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 13.3,
"health": 20.0,
"trust": 21.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"hipaa": 0.15,
"soc2": 0.15
},
"profile": "regulated",
"rank": 24,
"recomputed": 77.2,
"score": 82.5,
"score_version": "sar-score-2.0",
"seed_rank": 24,
"seed_score": 77.2,
"source": "seed_xlsx",
"unknown": []
},
"legal": {
"components": {
"adoption": 29.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 13.0,
"health": 20.0,
"trust": 21.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"soc2": 0.15
},
"profile": "regulated",
"rank": 26,
"recomputed": 77.2,
"score": 82.5,
"score_version": "sar-score-2.0",
"seed_rank": 26,
"seed_score": 77.2,
"source": "seed_xlsx",
"unknown": []
},
"regulatory": {
"components": {
"adoption": 29.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 13.0,
"health": 20.0,
"trust": 21.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"soc2": 0.15
},
"profile": "regulated",
"rank": 38,
"recomputed": 77.2,
"score": 82.5,
"score_version": "sar-score-2.0",
"seed_rank": 38,
"seed_score": 77.2,
"source": "seed_xlsx",
"unknown": []
},
"sales": {
"components": {
"adoption": 29.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 16.0,
"health": 20.0,
"trust": 21.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"gdpr": 0.15,
"soc2": 0.15
},
"profile": "commercial",
"rank": 20,
"recomputed": 85.9,
"score": 91.8,
"score_version": "sar-score-2.0",
"seed_rank": 20,
"seed_score": 85.9,
"source": "seed_xlsx",
"unknown": []
},
"supply_chain": {
"components": {
"adoption": 29.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 16.2,
"health": 20.0,
"trust": 21.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"soc2": 0.15
},
"profile": "operations",
"rank": 18,
"recomputed": 82.8,
"score": 91.9,
"score_version": "sar-score-2.0",
"seed_rank": 18,
"seed_score": 82.8,
"source": "seed_xlsx",
"unknown": []
},
"technology": {
"components": {
"adoption": 29.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 13.0,
"health": 20.0,
"trust": 21.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"soc2": 0.15
},
"profile": "technology",
"rank": 7,
"recomputed": 98.2,
"score": 95.8,
"score_version": "sar-score-2.0",
"seed_rank": 7,
"seed_score": 98.2,
"source": "seed_xlsx",
"unknown": []
}
},
"external_ids": {
"github": "langchain-ai/langgraph"
},
"first_seen": "2026-10-26T12:11:40Z",
"governance": {
"certification_disclaimer": true,
"claims": [],
"evidence_urls": []
},
"id": "res_c7563a5f79c4e793",
"identity": {
"evidence": [
"standards_metadata_at_publisher_domain"
],
"rules_version": "identity-1.1",
"tier": 2
},
"issues": {
"advisories": 0,
"cves": 18,
"incidents": 0,
"links": [
{
"date": "2025-10-26",
"kind": "cve",
"title": "CVE-2025-8709",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8709"
},
{
"date": "2025-10-29",
"kind": "cve",
"title": "CVE-2025-64104",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64104"
},
{
"date": "2025-11-07",
"kind": "cve",
"title": "CVE-2025-64439",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64439"
},
{
"date": "2025-12-11",
"kind": "cve",
"title": "CVE-2025-67644",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67644"
},
{
"date": "2026-02-20",
"kind": "cve",
"title": "CVE-2026-27022",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27022"
},
{
"date": "2026-02-25",
"kind": "cve",
"title": "CVE-2026-27794",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27794"
},
{
"date": "2026-03-05",
"kind": "cve",
"title": "CVE-2026-28277",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28277"
},
{
"date": "2026-06-16",
"kind": "cve",
"title": "CVE-2026-48775",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48775"
},
{
"date": "2026-06-17",
"kind": "cve",
"title": "CVE-2026-48776",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48776"
},
{
"date": "2026-07-05",
"kind": "cve",
"title": "CVE-2026-14742",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14742"
}
],
"regulator_actions": 0,
"withdrawn_certificates": 0
},
"last_seen": "2026-10-26T12:12:45Z",
"license": "MIT",
"merged_ids": [
"res_a1f4bd50815c179a"
],
"name": "LangGraph",
"news": [
{
"cluster_size": 1,
"date": "2026-10-24T01:08:05Z",
"headline": "langgraph==1.2.17",
"kind": "vendor",
"link_confidence": 1.0,
"outlet": "GitHub releases",
"summary": "Changes since 1.2.16\n\n* release(langgraph): 1.2.17 (#9418)\n* fix(langgraph): apply an explicit recursion_limit equal to the default (#9417)\n* fix(langgraph): keep the caller's namespace in RemoteGraph.stream(subgraphs=True) (#9401)\n* chore(",
"tag": "product_update",
"url": "https://github.com/langchain-ai/langgraph/releases/tag/1.2.17"
},
{
"cluster_size": 1,
"date": "2026-10-23T14:22:29Z",
"headline": "langgraph-cli==0.4.38",
"kind": "vendor",
"link_confidence": 1.0,
"outlet": "GitHub releases",
"summary": "Changes since cli==0.4.37\n\n* release(cli): 0.4.38 (#9411)\n* feat(cli): add the priority section to langgraph.json (#9393)\n* chore(deps): bump uv from 0.11.15 to 0.13.4 in /libs/cli (#9366)\n* chore(deps): bump certifi from 2026.2.25 to 2026.",
"tag": "product_update",
"url": "https://github.com/langchain-ai/langgraph/releases/tag/cli%3D%3D0.4.38"
}
],
"news_checked": true,
"protocols": {
"a2a": {
"card_url": "https://docs.langchain.com/.well-known/agent-card.json",
"checked_at": "2026-10-26T12:22:35Z",
"parser_version": "a2a-0.3+1.0",
"protocol_version": "0.3",
"signed": false,
"skills": [
"langchain"
],
"status": "verified",
"version": "1.0.0"
},
"ard": {
"checked_at": "2026-10-26T12:22:33Z",
"parser_version": "ard-0.91",
"status": "not_found"
},
"mcp": {
"card_url": "https://docs.langchain.com/.well-known/mcp.json",
"checked_at": "2026-10-26T12:22:35Z",
"parser_version": "mcp-2025-06-18",
"remotes": [
{
"type": "http",
"url": "https://docs.langchain.com/mcp"
}
],
"status": "invalid"
}
},
"publisher_domain": "docs.langchain.com",
"resource_type": "framework",
"scope": "public",
"security": {
"advisories": 0,
"checked_at": "2026-10-26T12:31:33Z",
"cves": 18,
"source": "nvd",
"tier": 1
},
"seed": {
"last_verified": "2026-09-25",
"snapshot_date": "2026-09-25"
},
"seed_components": {
"adoption": 29.0,
"docs": 10.0,
"domain_fit": 100.0,
"ecosystem": 15.0,
"governance": 45.0,
"health": 20.0,
"trust": 24.0
},
"signals": {
"github_archived": false,
"github_created_at": "2023-08-09T18:33:12Z",
"github_forks": 7547,
"github_language": "Python",
"github_open_issues": 516,
"github_pushed_at": "2026-10-26T05:20:08Z",
"github_stars": 43924,
"github_topic": "ai-agents",
"homepage": "https://docs.langchain.com/oss/python/langgraph/",
"observed_popularity": "~40k+",
"seed_enrich": {
"changed": [
"publisher_domain",
"tags"
],
"repo": "langchain-ai/langgraph"
}
},
"slug": "langchain-langgraph",
"sources": [
{
"payload_hash": "c2428981495d3394198fe53d3559d94718bb4596eae6a1079c5349430cbde0b8",
"retrieved_at": "2026-10-26T12:11:40Z",
"system": "seed_xlsx",
"url": "https://github.com/langchain-ai/langgraph"
},
{
"payload_hash": "dcf9ecdde80ebf86aa81a99729d666b5b858d4e062bac229e5ac76bf5529d6bf",
"retrieved_at": "2026-10-26T12:12:45Z",
"system": "github",
"url": "https://github.com/langchain-ai/langgraph"
}
],
"tags": [
"agents",
"ai",
"ai-agents",
"chatgpt",
"deepagents",
"enterprise",
"framework",
"gemini",
"generative-ai",
"langchain",
"langgraph",
"llm",
"multiagent",
"open-source",
"openai",
"pydantic",
"python",
"rag"
],
"tenant": null,
"traces": [
{
"agent_version": null,
"bundle": "bundles/tr_st_c7563a5f79c4e793_4beb7da6",
"checked_on": null,
"date": "2026-10-11",
"format": "bundle",
"harness_version": "probe-1.0",
"id": "tr_st_c7563a5f79c4e793_4beb7da6",
"kind": "self_test",
"notes": "Produced automatically on every refresh; a new bundle is written only when the observation changes",
"observed": {
"actions": [
"served Agent2Agent (A2A) document",
"served Model Context Protocol (MCP) document"
],
"approval": null,
"egress": false,
"entry": "GET on the publisher's well-known discovery paths",
"outcome": "A2A verified (unsigned); MCP invalid",
"refused": null,
"secrets_touched": false
},
"reviewer": null,
"scenario": "Fetch and validate the ARD manifest, A2A agent card and MCP server card at the publisher's well-known paths",
"scope": "product",
"sha256": "sha256:98d96c6032d0bde8abd447cdf386c5da781378c071fc09fd4f0dcc4fad42ff53",
"source": "AgentDossier refresh",
"tier": 1,
"title": "Registry probe of LangGraph's discovery endpoints",
"url": "https://sushegaad.github.io/AgentDossier/traces/tr_st_c7563a5f79c4e793_4beb7da6/",
"vendor_response": null
}
],
"trust": {
"compliance": 5,
"identity": 2,
"issues": 3,
"protocols": 1,
"security": 1,
"traces": 1,
"vendor_compliance": 1
},
"url": "https://github.com/langchain-ai/langgraph",
"vendor": "LangChain"
}