langflow-ai/langflow

Review signals: 1 connection review, 1 encoded blob, 1265 hardcoded secret, 116 known vulnerability. 44 static matches retained as context.

Reviewed as expected for a test run: resolver address lookups that send no data.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 28 distinct locations. 32 attributed processes.

Source contains encoded blob; review its purpose. src/frontend/src/utils/styleUtils.ts

Gitleaks found a possible hardcoded secret; value withheld. 68 distinct locations. 1265 findings.

OSV reports a known vulnerability in this dependency version. 29 distinct locations. 110 findings.

44 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Langflow flows are exposed as MCP tools that an MCP client can call: Real input produced the expected result: hello coldpass

  Source: **Deploy as an MCP server** and turn your flows into tools for MCP clients.

  Input: {"tool": "coldpass_probe", "arguments": {"input_value": "hello coldpass"}}

  Expected: tool result echoes the input text

  Command: /tmp/lf-venv/bin/langflow run tools/call {"tool": "coldpass_probe", "arguments": {"input_value": "hello coldpass"}}

  Observed: hello coldpass"}], "isError": false}

Examples

• Install Langflow locally from PyPI (README Quickstart): Not run as an example; the install step was executed directly: uv pip install langflow -U in a fresh venv (/tmp/lf-venv, Python 3.12.3). No documented example command in the README was runnable as a finite example.

  Source: README.md Quickstart > Install locally

  Expected: documented command completes successfully

  Observed: Not run as an example; the install step was executed directly: uv pip install langflow -U in a fresh venv (/tmp/lf-venv, Python 3.12.3). No documented example command in the README was runnable as a finite example.

Local or hosted: local

Install Langflow 1.13.0 from PyPI per the README Quickstart, start the server, create a flow via the REST API, expose it as an MCP tool, and call that tool over streamable HTTP; the tool returned 'hello coldpass'.

cd <guest-path> && pwd && ls -la && git -C . rev-parse --is-inside-work-tree 2>&1; python3 --version; id -u; cat /etc/os-release | head -3; ls /inputs 2>&1; ls <guest-path> 2>&1
cd <guest-path> && cat README.md | head -150
which uv; uv --version 2>&1; which pip3 python3.12; grep -m1 '^version' <guest-path>; head -60 <guest-path>; ls <guest-path>
curl -LsSf https://astral.sh/uv/install.sh | sh 2>&1 | tail -5; export PATH="$HOME/.local/bin:$PATH"; uv --version
export PATH="$HOME/.local/bin:$PATH"; mkdir -p /tmp/lf-fresh && cd /tmp/lf-fresh && uv venv /tmp/lf-venv --python 3.12 2>&1 | tail -3 && VIRTUAL_ENV=/tmp/lf-venv uv pip install langflow -U 2>&1 | tail -8; ls /tmp/lf-venv/bin | grep -i langflow
cd /tmp/lf-fresh && /tmp/lf-venv/bin/langflow --version; /tmp/lf-venv/bin/langflow run --help 2>&1 | head -60; grep -rn -i "telemetry\|DO_NOT_TRACK" <guest-path> 2>/dev/null | head -5; grep -rln "DO_NOT_TRACK" <guest-path> 2>/dev/null | head -3
cd <guest-path> && grep -n "DO_NOT_TRACK\|TELEMETRY" src/backend/base/langflow/services/telemetry/service.py | head; grep -rn "LANGFLOW_SUPERUSER_PASSWORD\|AUTO_LOGIN" src/backend/base/langflow/services/settings/base.py | head -6
mkdir -p /tmp/lf-logs && cd /tmp/lf-fresh && export DO_NOT_TRACK=true LANGFLOW_SUPERUSER=langflow LANGFLOW_SUPERUSER_PASSWORD='LfTest-2026-pass' && nohup /tmp/lf-venv/bin/langflow run > /tmp/lf-logs/server.log 2>&1 &
sleep 60; curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:7860/health; curl -s http://127.0.0.1:7860/health_check; echo; tail -5 /tmp/lf-logs/server.log
cd /tmp && /tmp/lf-venv/bin/langflow --help 2>/dev/null | grep -v "^$" | head -30; curl -s -X POST http://127.0.0.1:7860/api/v1/login -H 'Content-Type: application/x-www-form-urlencoded' -d 'username=langflow&password=<secret>' | head -c 400; echo
cd /tmp && TOKEN=<secret> -s -X POST http://127.0.0.1:7860/api/v1/login -H 'Content-Type: application/x-www-form-urlencoded' -d 'username=langflow&password=<secret>' | python3 -c 'import sys,json;print(json.load(sys.stdin)["access_token"])') && echo "$TOKEN" > /tmp/lf-logs/token && curl -s -X POST http://127.0.0.1:7860/api/v1/flows/ -H "Authorization: <secret>" -H 'Content-Type: application/json' -d '{"name":"coldpass-probe-flow","description":"probe","data":{"nodes":[],"edges":[]}}' | head -c 600; echo
cd /tmp && TOKEN=<secret> /tmp/lf-logs/token); FID=b32ad26a-87aa-4e06-8879-41fa27021e75; curl -s http://127.0.0.1:7860/api/v1/flows/$FID -H "Authorization: <secret>" | python3 -c 'import sys,json;d=json.load(sys.stdin);print(d["id"],d["name"],d["description"])'; grep -A5 "\[project.scripts\]" <guest-path>; grep -rn "langflow mcp\|mcp-server\|mcp_server" <guest-path> --include=*.md* -l | head -5
cd <guest-path> && grep -n "stdio\|mcp-proxy\|uvx\|command\|streamable\|/api/v1/mcp" docs/docs/Agents/mcp-server.mdx | head -40; grep -n "langflow_mcp\|\[project.scripts\]" -A4 pyproject.toml | head -20
cd /tmp && TOKEN=<secret> /tmp/lf-logs/token); FOLDER=cc3bdc6e-d539-490a-a3d9-cafbe628b89c; curl -s "http://127.0.0.1:7860/api/v1/mcp/project/$FOLDER" -H "Authorization: <secret>" | head -c 800; echo; echo ---; curl -s -X PATCH "http://127.0.0.1:7860/api/v1/flows/b32ad26a-87aa-4e06-8879-41fa27021e75" -H "Authorization: <secret>" -H 'Content-Type: application/json' -d '{"mcp_enabled":true,"action_name":"coldpass_probe","action_description":"coldpass probe flow"}' | head -c 300; echo
cd /tmp && TOKEN=<secret> /tmp/lf-logs/token); FOLDER=cc3bdc6e-d539-490a-a3d9-cafbe628b89c; curl -s "http://127.0.0.1:7860/api/v1/mcp/project/$FOLDER" -H "Authorization: <secret>" | head -c 800; echo; curl -s -X POST "http://127.0.0.1:7860/api/v1/mcp/project/$FOLDER/streamable" -H "Authorization: <secret>" -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"probe","version":"0"}}}' | head -c 400; echo
cd /tmp && TOKEN=<secret> /tmp/lf-logs/token); curl -s -X POST http://127.0.0.1:7860/api/v1/api_key/ -H "Authorization: <secret>" -H 'Content-Type: application/json' -d '{"name":"coldpass-probe"}' > /tmp/lf-logs/apikey.json; python3 -c 'import json;d=json.load(open("/tmp/lf-logs/apikey.json"));print(list(d.keys()))'
cd <guest-path> && ls src/backend/base/langflow/initial_setup/starter_projects/ 2>/dev/null; grep -n "Hello\|hello" -i src/backend/base/langflow/initial_setup/starter_projects/*.json 2>/dev/null | head -3
mkdir -p /tmp/lf-logs/scripts && cat > /tmp/lf-logs/scripts/mcp_call.py <<'EOF'
import asyncio, json, sys
from mcp import ClientSession
from mcp.client.streamable_http import streamablehttp_client
URL = "http://127.0.0.1:7860/api/v1/mcp/project/cc3bdc6e-d539-490a-a3d9-cafbe628b89c/streamable"
KEY = json.load(open("/tmp/lf-logs/apikey.json"))["api_key"]
async def main():
    async with streamablehttp_client(URL, headers={"x-api-key": <secret>
        async with ClientSession(r, w) as s:
            await s.initialize()
            tools = await s.list_tools()
            print("TOOLS", [t.name for t in tools.tools])
            res = await s.call_tool("coldpass_probe", {"input_value": "hello coldpass"})
            print("RESULT", res.model_dump_json()[:800])
asyncio.run(main())
EOF
cd /tmp/lf-logs && timeout 120 /tmp/lf-venv/bin/python -I scripts/mcp_call.py 2>&1 | tail -20
cd /tmp/lf-logs && TOKEN=<secret> token); curl -s http://127.0.0.1:7860/api/v1/all -H "Authorization: <secret>" -o all.json; ls -la all.json; python3 -I -c '
import json
d=json.load(open("/tmp/lf-logs/all.json"))
print(list(d.keys())[:20])
for cat,comps in d.items():
    if isinstance(comps,dict) and "ChatInput" in comps:
        c=comps["ChatInput"]; print(cat, list(c.keys())[:20]); print(c.get("display_name"), c.get("outputs") and [o["name"] for o in c["outputs"]]); break
'
cd /tmp/lf-logs && TOKEN=<secret> token) && python3 -I - <<'EOF'
import json, copy, urllib.request
all_ = json.load(open("/tmp/lf-logs/all.json"))
comp = all_["input_output"]["ChatInput"]
node = copy.deepcopy(comp)
nid = "ChatInput-coldp1"
node["template"]["input_value"]["value"] = "hello coldpass"
data = {"nodes":[{"id":nid,"type":"genericNode","position":{"x":100,"y":100},
  "data":{"id":nid,"type":"ChatInput","node":node}}],"edges":[]}
body = json.dumps({"data": data}).encode()
req = urllib.request.Request("http://127.0.0.1:7860/api/v1/flows/b32ad26a-87aa-4e06-8879-41fa27021e75", data=body, method="PATCH",
  headers={"Authorization":"<secret>"+open("/tmp/lf-logs/token").read().strip(),"Content-Type":"application/json"})
r = urllib.request.urlopen(req).read().decode()
print(r[:200])
EOF
timeout 150 /tmp/lf-venv/bin/python -I scripts/mcp_call.py 2>&1 | tail -20
cd /tmp/lf-logs && TOKEN=<secret> token); curl -s -X POST "http://127.0.0.1:7860/api/v1/run/b32ad26a-87aa-4e06-8879-41fa27021e75?stream=false" -H "Authorization: <secret>" -H 'Content-Type: application/json' -d '{"input_value":"hello coldpass","input_type":"chat","output_type":"chat"}' | head -c 1200; echo; echo ---; grep -i "error\|exception" /tmp/lf-logs/server.log | tail -5 | cut -c1-400
cd /tmp/lf-logs && KEY=$(python3 -I -c 'import json;print(json.load(open("/tmp/lf-logs/apikey.json"))["api_key"])'); curl -s -X POST "http://127.0.0.1:7860/api/v1/run/b32ad26a-87aa-4e06-8879-41fa27021e75?stream=false" -H "x-api-key: <secret>" -H 'Content-Type: application/json' -d '{"input_value":"hello coldpass","input_type":"chat","output_type":"chat"}' | head -c 1500; echo
cd <guest-path> && python3 -I -c '
import json
d=json.load(open("Basic Prompting.json"))
e=d["data"]["edges"][0]
print(json.dumps(e,indent=1)[:1500])
'
cd /tmp/lf-logs && python3 -I - <<'EOF'
import json, copy, urllib.request
all_ = json.load(open("/tmp/lf-logs/all.json"))
def node_for(name, nid, value=None):
    node = copy.deepcopy(all_["input_output"][name])
    if value is not None:
        node["template"]["input_value"]["value"] = value
    return {"id":nid,"type":"genericNode","position":{"x":100,"y":100},"data":{"id":nid,"type":name,"node":node}}
ci, co = "ChatInput-coldp1", "ChatOutput-coldp2"
nodes = [node_for("ChatInput", ci, "hello coldpass"), node_for("ChatOutput", co)]
Q = lambda s: s.replace('"', "œ")
src = {"dataType":"ChatInput","id":ci,"name":"message","output_types":["Message"]}
tgt = {"fieldName":"input_value","id":co,"inputTypes":["Message"],"type":"str"}
edge = {"animated":False,"className":"","data":{"sourceHandle":src,"targetHandle":tgt},
  "id":"reactflow__edge-"+ci+Q(json.dumps(src,separators=(",",":")))+"-"+co+Q(json.dumps(tgt,separators=(",",":"))),
  "selected":False,"source":ci,"sourceHandle":Q(json.dumps(src,separators=(", ",": "))),"target":co,"targetHandle":Q(json.dumps(tgt,separators=(", ",": ")))}
data = {"nodes":nodes,"edges":[edge]}
req = urllib.request.Request("http://127.0.0.1:7860/api/v1/flows/b32ad26a-87aa-4e06-8879-41fa27021e75", data=json.dumps({"data":data}).encode(), method="PATCH",
  headers={"Authorization":"<secret>"+open("/tmp/lf-logs/token").read().strip(),"Content-Type":"application/json"})
print(urllib.request.urlopen(req).status)
EOF
KEY=$(python3 -I -c 'import json;print(json.load(open("/tmp/lf-logs/apikey.json"))["api_key"])'); curl -s -X POST "http://127.0.0.1:7860/api/v1/run/b32ad26a-87aa-4e06-8879-41fa27021e75?stream=false" -H "x-api-key: <secret>" -H 'Content-Type: application/json' -d '{"input_value":"hello coldpass","input_type":"chat","output_type":"chat"}' | head -c 1500; echo
cd /tmp/lf-logs && timeout 150 /tmp/lf-venv/bin/python -I scripts/mcp_call.py 2>&1 | tail -5 | cut -c1-700
cd <guest-path> && grep -rln "apscheduler\|crontab\|cron_trigger\|CronTrigger\|--once\|--now" src/backend/base/langflow --include=*.py | head -8; grep -n "listeners" -A6 src/backend/base/langflow/cli/*.py 2>/dev/null | head -20; grep -n "^test\|^unit_tests\|^test_" Makefile | head
cd <guest-path> && grep -rln "def listeners\|listener" src/backend/base/langflow --include=*.py | head -8; grep -rn "def listeners" -A12 src/backend/base/langflow --include=*.py | head -30; /tmp/lf-venv/bin/langflow listeners --help 2>/dev/null | tail -20 | cut -c1-120
cd <guest-path> && grep -c "Deploy as an MCP server\*\* and turn your flows into tools for MCP clients." README.md && mkdir -p .coldpass && python3 -I - <<'EOF'
import json
key = json.load(open("/tmp/lf-logs/apikey.json"))["api_key"]
W = "<guest-path>"
PROJ = "cc3bdc6e-d539-490a-a3d9-cafbe628b89c"
URL = f"http://127.0.0.1:7860/api/v1/mcp/project/{PROJ}/streamable"
ARGV = ["/tmp/lf-venv/bin/langflow", "run"]
ENV = {"DO_NOT_TRACK": "true", "LANGFLOW_SUPERUSER": "langflow", "LANGFLOW_SUPERUSER_PASSWORD": "LfTest-2026-pass"}
ARGS = {"input_value": "hello coldpass"}
probe = {"kind": "mcp_http", "argv": ARGV, "cwd": W, "url": URL, "env": ENV,
         "headers": {"x-api-key": <secret>"tool": "coldpass_probe", "arguments": ARGS,
         "expected_text": "hello coldpass"}
claim = {"kind": "claim", "claim": "Langflow flows are exposed as MCP tools that an MCP client can call",
         "source": "**Deploy as an MCP server** and turn your flows into tools for MCP clients.",
         "input": "input_value=hello coldpass", "expected": "tool result echoes the input text",
         "probe_kind": "mcp_http", "argv": ARGV, "cwd": W, "url": URL, "env": ENV,
         "headers": {"x-api-key": <secret>"tool": "coldpass_probe", "arguments": ARGS,
         "expected_text": "hello coldpass"}
examples = [{"kind": "example", "claim": "Install Langflow locally from PyPI (README Quickstart)",
             "source": "README.md Quickstart > Install locally",
             "reason": "Not run as an example; the install step was executed directly: uv pip install langflow -U in a fresh venv (/tmp/lf-venv, Python 3.12.3). No documented example command in the README was runnable as a finite example."}]
cycles = {"detected": False,
          "reason": "Entry points inspected: no cron, scheduler, --once or --now in src/backend/base/langflow; the only long-running loop is 'langflow listeners', which holds external provider connections (Slack Socket Mode, Microsoft Graph polling, Gmail Pub/Sub) and needs real provider credentials, so it was not exercised. The product webhook endpoints need external callers.",
          "checks": []}
json.dump(probe, open(W+"/.coldpass/probe.json","w"), indent=2)
json.dump([claim], open(W+"/.coldpass/claims.json","w"), indent=2)
json.dump(examples, open(W+"/.coldpass/examples.json","w"), indent=2)
json.dump(cycles, open(W+"/.coldpass/cycles.json","w"), indent=2)
print("written")
EOF
ls -la .coldpass; pkill -f "langflow run" ; sleep 3; curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:7860/health || echo "port free"
cd <guest-path> && grep -nF "Deploy as an MCP server** and turn your flows into tools for MCP clients." README.md; echo "rc=$?"; ls -la .coldpass
ps -eo pid,args | grep "[l]angflow" | cut -c1-150; for p in $(ps -eo pid,args | grep "[/]tmp/lf-venv/bin/langflow run" | awk '{print $1}'); do kill $p; done; sleep 5; curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:7860/health_check || echo "port 7860 free"
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -60 | cut -c1-600
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > /tmp/lf-logs/validate.json 2>/tmp/lf-logs/validate.err; echo rc=$?; python3 -I -c '
import json
d=json.load(open("/tmp/lf-logs/validate.json"))
print("valid", d.get("valid"), "problems", d.get("problems"))
r=d.get("replay",{})
print("replay status", r.get("status"))
for k,v in r.get("details",{}).items():
    if k in ("claims","examples","cycles","checks"): print(k, json.dumps(v)[:500])
print(sorted(d.keys()))
'; tail -3 /tmp/lf-logs/validate.err; ps -eo pid,args | grep "[/]tmp/lf-venv/bin/langflow" | head -2
python3 -I -c '
import json
d=json.load(open("/tmp/lf-logs/validate.json"))
r=d["replay"]; print(sorted(r.keys())); det=r.get("details",{}); print(sorted(det.keys()))
for k in det:
    if isinstance(det[k],(list,dict)) and k not in ("tool_result",): print(k, json.dumps(det[k])[:300])
'
python3 -I -c '
import json
r=json.load(open("/tmp/lf-logs/validate.json"))["replay"]
for k in ("claims","cycle_checks","example_checks","evidence_strength"):
    print(k, json.dumps(r.get(k))[:600])
'
mkdir -p <guest-path> && python3 -I - <<'EOF'
import json
report = {
 "outcome": "working",
 "fault_owner": None,
 "operation": "Install Langflow 1.13.0 from PyPI per the README Quickstart, start the server, create a flow via the REST API, expose it as an MCP tool, and call that tool over streamable HTTP; the tool returned 'hello coldpass'.",
 "operation_scope": "Local Linux guest (Ubuntu 24.04, Python 3.12.3, uv 0.13.5), no browser, no external providers. Auth: <secret>",
 "steps": [
   "curl -LsSf https://astral.sh/uv/install.sh | sh",
   "uv venv /tmp/lf-venv --python 3.12  (run from fresh dir /tmp/lf-fresh)",
   "uv pip install langflow -U  (README: 'uv pip install langflow -U', run in a fresh directory)",
   "langflow run  (README: 'uv run langflow run'; started as /tmp/lf-venv/bin/langflow run with DO_NOT_TRACK=true and LANGFLOW_SUPERUSER_PASSWORD set)",
   "POST /api/v1/login, POST /api/v1/flows/, PATCH /api/v1/flows/{id} (mcp_enabled=true), POST /api/v1/api_key/",
   "POST /api/v1/run/{flow_id} echoed 'hello coldpass' through ChatInput->ChatOutput",
   "MCP streamable HTTP initialize, tools/list (coldpass_probe), tools/call -> 'hello coldpass'",
   "python3 -I <guest-path> --validate --replay -> valid, replay PASS"
 ],
 "deviations": [
   "uv was not preinstalled; installed with the official uv install.sh (curl|sh) into ~/.local.",
   "README 'uv run langflow run' was not used from the checkout; the PyPI package was installed in a venv per the README install step and run via the absolute path /tmp/lf-venv/bin/langflow run. The checkout source (also version 1.13.0) was not built or run.",
   "Release packages disable auto login, so LANGFLOW_SUPERUSER_PASSWORD was set to a throwaway local value in the guest.",
   "The project MCP endpoint rejected the Bearer JWT and required an x-api-key header, so the probe passes x-api-key instead of Authorization.",
   "The empty flow returned no MCP content; a ChatInput node built from the product's own component catalog (/api/v1/all) and an edge to a ChatOutput node were added before the tool call returned text.",
   "The README has no runnable example or test command for the quickstart; the example entry is recorded with reason. The Makefile unit test suite was not run.",
   "The checker path /inputs/coldpass-preflight.py does not exist in this guest; the checker at <guest-path> was used instead.",
   "Git init/fetch was not performed; the workspace is not a git repository and the checker ran without it.",
   "A broad pkill matched my own shell command once; the server was then stopped by PID and port 7860 confirmed free before replay."
 ],
 "stuck_step": None,
 "main_blocker": None,
 "plain_failure": None,
 "suggested_fix": "None for the tested path. Optional: the checkout's own source run path (make run_cli / uv run langflow run from the repo) was not exercised."
}
json.dump(report, open("<guest-path>","w"), indent=2)
print("ok")
EOF
<env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > /tmp/lf-logs/validate2.json 2>&1; echo rc=$?; python3 -I -c 'import json;d=json.load(open("/tmp/lf-logs/validate2.json"));print(d["valid"],d["problems"],d["replay"]["status"])' 2>/dev/null || tail -c 600 /tmp/lf-logs/validate2.json; ps -eo pid,args | grep "[/]tmp/lf-venv/bin/langflow" | wc -l
ps -eo pid,ppid,etime,args | grep "[/]tmp/lf-venv/bin/langflow" | cut -c1-160; curl -s -o /dev/null -w "7860:%{http_code}\n" http://127.0.0.1:7860/health_check
cd <guest-path> && ls -la .coldpass && ls report.json 2>&1 | head -1; python3 -I -c 'import json;[json.load(open("<guest-path>"+f)) for f in ["report.json","probe.json","claims.json","examples.json","cycles.json"]];print("all JSON parse")'