LangGraph: Build Stateful, Long-Running AI Agents (GitHub, Scanned)

LangGraph is a Python framework for building AI agents as graphs: each step is a node, edges decide what runs next, and a shared state object carries the work through. That structure gives you things simple agent loops lack: durable execution that resumes exactly where it stopped after a crash, checkpoints you can inspect and rewind, human approval at any point, and short-term and long-term memory.

It is from LangChain Inc. but works without LangChain, and it is the engine under many production agents; the README names Klarna, Replit and Elastic. Checkpoints can live in memory, SQLite or Postgres, a CLI runs a local development server, and LangSmith adds tracing and hosted deployment if you want them. For a higher-level starting point, the same team's Deep Agents package is built on LangGraph.

It is MIT-licensed, with about 43,900 stars and 292 contributors, at 1.2.17 when scanned. It is deliberately low level, so expect to write more code than with an all-in-one agent builder, and a JavaScript version lives in a separate repository.

• Repository: github.com/langchain-ai/langgraph
• Licence: MIT (MIT License)
• Language: Python. Stars: 43.9K. Forks: 7,547. Last push: Oct 26, 2026.
• Scan: safe, Oct 26, 2026, commit a25bfaf

Who it is for

Python developers building agents that must run for a long time, survive failures or wait for a person to approve a step, and teams moving an agent prototype into production.

Getting started

1. Install the library

pip install -U langgraph

2. Install the CLI for a local development server

pip install -U "langgraph-cli[inmem]"

3. Start the server in your project

langgraph dev

You also need a model provider package and key, for example langchain-openai or langchain-anthropic, or a local model. The quickstart at docs.langchain.com walks through a first agent.

Safety scan

We cloned langchain-ai/langgraph at commit a25bfaf on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• No secrets, no suspicious patterns, no install hooks and no committed binaries across 698 files and about 222,000 lines of Python.
• 14 known advisories (7 high), none critical. Most are in the CLI's example projects (libs/cli/js-examples and uv-examples); the rest are development pins in uv.lock files, such as langsmith and picomatch. pip installs current releases, and LangSmith tracing is off unless you turn it on.
• Two of 17 workflows use pull_request_target: one checks that a PR links an issue and one labels external PRs. Both only call the GitHub API, and require_issue_link.yml carries a comment forbidding checkout of PR code.
• All 12 third-party actions are pinned to commits and Dependabot is on. No security policy file in this repository.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: Python 202.7K, Jupyter 9,057, JSON 3,542, YAML 3,160, Markdown 2,021, TOML 1,040.

Questions

Is LangGraph free?

Yes. LangGraph is MIT-licensed and free, and runs anywhere Python does. LangSmith, the company's tracing and deployment platform, is a separate product with free and paid plans, and LangGraph does not need it.

Do I need LangChain to use LangGraph?

No. LangGraph works on its own with any model client. LangChain's integrations make it quicker to plug in models and tools, but they are optional.

LangGraph or Deep Agents?

Start with Deep Agents if you want an agent that can plan, use sub-agents and work with files right away. Use LangGraph directly when you need full control over each step, state and approval point.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.