Skip to content
ReviewRamble

LangChain

Python and TypeScript framework for building LLM agents, with a standard agent loop, middleware and hundreds of model integrations.

Reviewed by Sheela · Updated

View on GitHub Open source

Our rating

4.2/5

Still the widest integration library for LLM apps, much tidier since 1.0, and no longer the automatic default it once was.

What it is

LangChain is the best-known open-source framework for building applications on top of language models. Since version 1.0 (October 2025) the core package centres on create_agent, a standard tool-calling agent loop that runs on LangGraph underneath.

Behaviour is customised with middleware, small hooks that run before or after model calls and tool calls. Built-in middleware covers human approval of tool calls, summarising long conversations and redacting personal data. Older AgentExecutor-style agents are deprecated.

Its other big asset is integrations: standard interfaces for chat models, embeddings, vector stores and tools from most providers, released as separate packages. As of 22 October 2026 the current versions were langchain 1.4.7 and langchain-core 1.7.0. The company behind it sells LangSmith for tracing, evaluation and deployment.

Our review

LangChain remains the safest bet when an application has to talk to many model providers, vector stores and tools, and an overweight one when it does not. It has about 148,000 GitHub stars and ships almost daily; langchain 1.4.7 and langchain-core 1.7.0 came out on consecutive days in October 2026.

The 1.0 rewrite shrank the package to one agent loop, and the middleware design is the best part. Human approval, conversation summarisation and PII redaction are entries in a list passed to create_agent, not custom code, and because the loop runs on LangGraph a team can drop to a full graph when the prebuilt loop stops fitting.

The security record is the part buyers should read. Nine advisories have been published against the repository since November 2025, including a critical serialisation flaw that let attackers extract secrets through dumps and loads, and high-severity issues in prompt template handling and legacy load_prompt path handling. Most sit in older loading and templating APIs, so keeping langchain-core current and avoiding deserialising untrusted objects removes much of the exposure.

Many tutorials still predate 1.0, and lighter SDKs such as Pydantic AI do a single-provider agent with less to learn. The commercial pull is towards LangSmith: Plus costs $39 per seat a month with 10,000 base traces, base traces are kept for 14 days, and self-hosting is Enterprise only, so the free library's best debugging experience is a paid one.

Where it earns its place

  • A product team at a SaaS company that must support customer-chosen LLMs

    Let each enterprise customer bring OpenAI, Anthropic, Bedrock or Azure

    Standard chat model interfaces mean one agent definition runs against any supported provider by swapping the integration package. The library is free; cost is testing every provider path and keeping packages patched.

  • A compliance-minded engineer at a bank building an internal assistant

    Redact personal data and require approval before tools write anywhere

    PII redaction and human-in-the-loop middleware are configuration on create_agent. Pin and patch langchain-core promptly, given the advisories against its serialisation and template code.

  • An engineering lead budgeting observability for a 10-person AI team

    Trace and evaluate agents without building tooling in-house

    LangSmith Plus at $39 per seat is about $390 a month for ten engineers before pay-as-you-go traces beyond 10,000. LangSmith says it does not train on customer data; self-hosting it needs an Enterprise contract.

Before you commit

Setup
pip install -U langchain plus a provider package such as langchain-openai, on Python 3.10 or newer; a create_agent quickstart runs in minutes. A separate TypeScript package exists.
Integrations
Separate packages for most chat model, embedding and vector store providers; tools and MCP; LangGraph underneath; LangSmith for tracing and evaluation.
Data and privacy
MIT licence. The library sends nothing unless you enable LangSmith tracing; LangSmith Developer and Plus data sits in LangChain's US or EU cloud and is not used for training. Nine GitHub advisories, one critical and three high.
Cost at scale
The library is free. LangSmith Plus is $39 per seat a month with 10,000 base traces, then pay-as-you-go; base traces are kept 14 days and extended traces 180 days; Enterprise is custom.
Limits
665 open issues and pull requests; near-daily releases across many packages; legacy chains and AgentExecutor are deprecated, so pre-1.0 code needs migrating.

What's good

  • Largest set of model, vector store and tool integrations
  • Middleware covers approvals, summarisation and PII redaction
  • Runs on LangGraph, so you can drop down to custom graphs
  • Python and TypeScript versions

What's not

  • Nine security advisories since late 2025, one critical
  • Older tutorials and APIs are out of date after 1.0
  • Near-daily releases across many packages to track
  • Best tracing and debugging is in paid LangSmith

Best for

Teams building agents that need many provider and data integrations and may grow into custom LangGraph workflows.

Alternatives

LangGraph

Agent frameworksPython44k stars

4.6/5

Low-level framework for building stateful agents as graphs, with durable execution, memory, streaming and human-in-the-loop.

Pydantic AI

Agent frameworksPython21k stars

4.5/5

Type-safe Python agent framework from the Pydantic team, with composable capabilities, durable execution and Logfire tracing.

OpenAI Agents SDK

Agent frameworksPython30k stars

4.4/5

OpenAI's lightweight Python framework for agents with tools, handoffs, guardrails, sessions and sandboxed workspaces.

LlamaIndex

RAG & dataPython53k stars

4.3/5

Python framework for connecting LLMs to your documents, with ingestion, indexing, retrieval and event-driven agent Workflows.

LangChain: common questions

Is LangChain worth it?
Still the widest integration library for LLM apps, much tidier since 1.0, and no longer the automatic default it once was. We rate it 4.2 out of 5.
How much does LangChain cost?
Free and open source under the MIT licence. LangSmith is separate: Developer free for one seat, Plus $39/seat/month, Enterprise custom.
What are the downsides of LangChain?
Nine security advisories since late 2025, one critical; older tutorials and APIs are out of date after 1.0; near-daily releases across many packages to track; best tracing and debugging is in paid LangSmith.
Who is LangChain best for?
Teams building agents that need many provider and data integrations and may grow into custom LangGraph workflows.
How much does LangChain cost for a team or in production?
The library is free. LangSmith Plus is $39 per seat a month with 10,000 base traces, then pay-as-you-go; base traces are kept 14 days and extended traces 180 days; Enterprise is custom.
Is LangChain safe for company data?
MIT licence. The library sends nothing unless you enable LangSmith tracing; LangSmith Developer and Plus data sits in LangChain's US or EU cloud and is not used for training. Nine GitHub advisories, one critical and three high.
What are the best LangChain alternatives?
The closest alternatives we have reviewed are LangGraph, Pydantic AI, OpenAI Agents SDK and LlamaIndex.

Answers checked Oct 23, 2026.

Make LangChain? Show this rating on your siteLangChain rated 4.2 out of 5 on ReviewRamble