Langflow
Low-code visual builder for agentic and RAG apps supporting any LLM and vector DB, exportable as Python or MCP servers.
Delv Safety Grade: B
Score 72/100 · assessed 2026-04-18
Langflow is an open-source visual builder for AI workflows maintained by Langflow (formerly DataStax Labs). The project has strong transparency with active development, comprehensive documentation, and a clear GitHub presence with 38k+ stars. However, as a no-code platform that generates and executes arbitrary Python code, connects to external LLMs, databases, and APIs, it carries significant permissions risk. Users can build flows that access filesystems, execute shell commands, connect to any external service, and handle sensitive data. The supply chain is reasonable via PyPI distribution, but the broad capability surface means trust depends heavily on what flows you build or import. The freemium model with DataStax-backed hosting adds legitimacy, but self-hosted instances require careful sandboxing. No known security incidents, but the platform's flexibility inherently creates attack surface through user-generated flows.
Green flags
- Open source with 38k+ GitHub stars and active community
- Backed by DataStax with professional development team
- Comprehensive documentation and transparent development
- Available via standard PyPI distribution with versioning
- No known security incidents or CVEs in public record
Red flags
- Executes arbitrary user-generated Python code without inherent sandboxing
- Can connect to any external API, LLM, or database based on flow design
- Imported flows from untrusted sources could contain malicious logic
- Filesystem and shell access possible depending on components used
- Broad capability surface makes security dependent on user configuration
Permissions requested
Pricing
Platforms
Review
Pay for the hosted version if you are prototyping agentic workflows with a mixed team and need to move fast. Skip it if you are comfortable with LangChain or LlamaIndex code, or if you need production-grade performance without the hassle of self-hosting.
Good at
- Visual debugging makes it easy to see where multi-step flows break
- Export to Python or MCP servers means prototypes are not throwaway work
- Supports most LLMs and vector databases without vendor lock-in
- Faster than writing code for initial concept validation
- Open-source version available for self-hosting
Watch out
- Abstraction overhead makes flows slower than hand-coded equivalents
- Complex conditional logic becomes unreadable spaghetti diagrams
- Hosted version pricing is steep for production workloads
- Self-hosting the open-source version requires infrastructure management
- Not actually autonomous - you are building the agent, not using one
Use cases
- agent prototyping
- RAG flows
- MCP servers