LangChain: The Standard Kit for LLM Apps (GitHub, Scanned)

LangChain is a Python library for building applications and agents on top of language models. Its core is a set of standard interfaces: a chat model, an embedding model, a vector store, a retriever, a tool, so that switching from OpenAI to Anthropic to a local Ollama model is a one-line change (init_chat_model("provider:model")). Around that sit a create_agent helper, middleware, structured output, and separate partner packages for each provider that are released on their own schedule.

It earns its place as the reference point everything else is measured against: most tutorials, most agent frameworks and many of the tools on this list either use LangChain or explain how they differ from it. The repository is a monorepo of the core, the main langchain package, text splitters, a shared test suite and more than a dozen partner integrations. It is MIT-licensed, built by LangChain Inc. with more than 3,700 contributors, and sits next to LangGraph (low-level agent orchestration) and LangSmith (paid tracing and evaluation).

• Repository: github.com/langchain-ai/langchain
• Licence: MIT (MIT License)
• Language: Python. Stars: 147.1K. Forks: 24.6K. Last push: Sep 26, 2026.
• Scan: safe, Sep 25, 2026, commit 80b7409

Who it is for

Python developers building LLM features who want to stay free to swap models, teams standardizing how several apps call models and tools, and anyone following a tutorial that assumes it.

Getting started

1. Add LangChain to a project (pip install langchain also works)

uv add langchain

2. Add the provider package for the model you will call, OpenAI here

uv add langchain-openai

3. Call a model through the common interface (set OPENAI_API_KEY first)

uv run python -c "from langchain.chat_models import init_chat_model; print(init_chat_model('openai:gpt-5.5').invoke('Hello, world!').content)"

Safety scan

We cloned langchain-ai/langchain at commit 80b7409 on Sep 25, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• One secret-shaped string, a placeholder Slack webhook (XXX in place of the token) in the SSRF-protection tests. No self-decoding code and no bare-IP URLs.
• Three pattern hits, all tests: webhook.site URLs used to check that outbound requests are validated, and a long recorded response in the Anthropic integration tests.
• No install hooks, no installer scripts. The one binary is fake.odt, an 8.9 KB OpenDocument file used as a test input for a document loader; the scanner calls it a JAR because both are zip archives.
• Known advisories: 8 across 677 packages in 22 lockfiles, which pin each package's development environment. The two criticals and two of the highs are chromadb in the Chroma partner package, and they concern Chroma's HTTP server, which you only run if you choose Chroma and host it yourself. Core has one high.
• 27 workflows, all 14 third-party actions pinned to a commit. Three use pull_request_target (fork guard, labeler, issue-link check) and none checks out the pull request. Dependabot on; no security policy file or CodeQL in the repository. OpenSSF Scorecard 5.6 of 10.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: Python 416.2K, Markdown 14.8K, JSON 10.6K, YAML 6,891, TOML 3,417, Shell 595.

Questions

Is LangChain free?

Yes. LangChain is MIT-licensed and free for any use, including commercial products. The company's paid products sit beside it rather than inside it: LangSmith for tracing, evaluation and deployment. Nothing in the library requires a LangSmith account, and tracing stays off unless you set its environment variables.

What is the difference between LangChain and LangGraph?

LangChain gives you the building blocks and a ready-made agent loop; LangGraph is the lower-level runtime for agents as explicit graphs, with durable state, branching, human approval steps and resumable runs. LangChain's create_agent is built on LangGraph, so you can start with LangChain and drop down to LangGraph when you need precise control.

Does LangChain work with local models?

Yes. The langchain-ollama partner package lives in this repository, and any OpenAI-compatible server (llama.cpp, vLLM, LM Studio) works through langchain-openai with a custom base URL. The same agent code then runs against a local or hosted model by changing only the model string.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.