Atlas / MCP servers / langchain-ai / Langchainjs

LangchainjsBLOCK

Name: Langchainjs
Author: langchain-ai

mcp/langchain-ai/langchainjs

MCP server by langchain-ai · Audited 2026-10-12

⚑ Report / re-scan Source ↗

The agent engineering platform

Verdict

BLOCK

Grade

Trust score

39 /100

Exposed tools

200 254r · 28w · 3d

Transport

sse · stdio · streamable-http

License

MIT

Stars

18,258

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The agent engineering platform.

[](https://opensource.org/licenses/MIT) [](https://x.com/langchain_js)

LangChain is a framework for building LLM-powered applications. It helps you chain together interoperable components and third-party integrations to simplify AI application development — all while future-proofing decisions as the underlying technology evolves.

[!TIP] Just getting started? Check out [Deep Agents](http://docs.langchain.com/oss/javascript/deepagents/) — a higher-level package built on LangChain for agents that have built-in capabilities for common usage patterns such as planning, subagents, file system usage, and more.

Documentation: To learn more about LangChain, check out the docs.

If you're looking for more advanced customization or agent orchestration, check out LangGraph.js, our framework for building agents and controllable workflows.

For an equivalent Python library, check out LangChain.

To help you ship LangChain apps to production faster, check out LangSmith, a unified developer platform for building, testing, and monitoring LLM applications.

⚡️ Quick Install

You can use npm, pnpm, or ya

Read from source at commit 6808c2632af1OBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add langchainjs --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} --env AWS_BEARER_TOKEN_BEDROCK=${AWS_BEARER_TOKEN_BEDROCK} --env AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} -- npx -y langchainjs

claude-desktop

{
  "mcpServers": {
    "langchainjs": {
      "command": "npx",
      "args": [
        "-y",
        "langchainjs"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "AWS_ACCESS_KEY_ID": "${AWS_ACCESS_KEY_ID}",
        "AWS_BEARER_TOKEN_BEDROCK": "${AWS_BEARER_TOKEN_BEDROCK}",
        "AWS_SECRET_ACCESS_KEY": "${AWS_SECRET_ACCESS_KEY}"
      }
    }
  }
}

Exposed tools (200)

254 read · 28 write · 3 destructive. Blast radius: 3 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`GenerateUsername`	read	Generate a username based on user characteristics
`GetPopulation`	read	Get the current population in a given location
`GetWeather`	read	Get the current weather in a given location
`GoogleSearch`	read	Search for online trends, news, current events, real-time information, or research topics.
`Weather`	read	Get the weather for a given location
`abortable_tool`	read	A tool that can be aborted
`account`	read
`account_info`	read	Get account information for the current user
`add`	write
`add_history`	write	Add an entry to history
`add_numbers`	write	Add two numbers together
`add_task`	write	Add a task to the list
`add_todo`	write	Add an item to the thread TODO list
`admin_action`	read	An admin-only action
`alpha1`	read	Alpha 1
`analyze`	read	Analyze text
`approve`	read
`ask`	read
`ask_question`	read	Ask user a question and return directly
`async_transfer_to_bob`	write	Transfer to Bob
`audio_tool`	read
`bedrock-tool`	read	A Bedrock tool
`beta1`	read	Beta 1
`beta2`	read	Beta 2
`book_flight`	read	Book commercial flights between cities
`calculate`	read	Calculate the result of an operation
`calculate_power`	read	Calculate base raised to the power of exponent
`calculate_price`	read	Calculate pricing with discounts for product quotes
`calculate_sum`	read	Another dynamically registered tool for calculations
`calculator`	read	Perform simple calculations
`call_geo`	read	Ask the geo sub-agent
`call_la`	read	Ask the LA weather sub-agent
`call_nyc`	read	Ask the NYC weather sub-agent
`call_sf`	read	Ask the SF weather sub-agent
`call_weather`	read	Ask the weather sub-agent
`capital_catalog`	read	Get the capital of a country
`check_account`	read	Check account information or perform account actions
`check_env`	read
`check_headers`	read
`check_inventory`	read	Check current inventory levels for a product
`check_refund_policy`	read	Get current refund policy information
`check_system_status`	read	Check the status of system services
`classify`	read	Classify text into categories
`commandTool`	read	A tool that returns a Command object
`command_tool`	read	A tool that can return commands
`complex_tool`	read	A tool with complex schema
`config_capture_tool`	read	Captures the config for testing
`configure`	read	Configure something
`confirm`	read
`crash_tool`	read	This tool will crash Gemini SDK
`createEvent`	write	Create calendar event
`create_calendar_event`	write	Create a calendar event. Requires exact ISO datetime format.
`create_document`	write	Create a structured document
`create_event`	write	Create calendar event
`create_order`	write	Create an order
`create_task`	write	Create a new project task and update the project state
`create_user`	write	Create a user
`current_weather_tool`	read	Get the current weather for a given location.
`custom_crawl`	read	Custom description
`custom_extract`	read	Custom description
`custom_get_research`	read	Custom description
`custom_map`	read	Custom description
`custom_research`	read	Custom description
`custom_search`	read	Custom description
`custom_tool`	read	A custom tool
`db_query`	write	Run a read-only SQL query against the analytics database.
`deferred_tool`	read	A tool deferred at construction time
`delegate_to_subagent`	read	Delegate analysis/planning to a sub-agent with access to the full thread messages
`delete_file`	destructive	Delete a file at the supplied path.
`delete_shape`	destructive	Delete a shape by its name
`director`	read	The director of the movie
`disconnect`	read
`divide`	read
`do_math`	read	Evaluate a math expression
`draft_email`	read	Drafts an email
`dummy`	read	A dummy tool
`dummy_tool`	read	A dummy tool for testing
`dup`	read	Gamma dup 1
`dynamic_tool`	read	A dynamically registered tool
`echo`	read
`emailUser`	read	Email a user
`error_tool`	read	A tool that throws an error
`escalate_to_human`	read	Escalate the conversation to a human agent
`expensive_operation`	read	An expensive operation
`extract-1`	read	Tool for extracting structured output from the model
`extract-2`	read	Second extract tool
`extractor`	read	Extracts fields from the input.
`failing_tool`	read	A tool that always fails
`fake`	read	fake
`fake_browser_tool`	read	useful for when you need to find something on the web or summarize a webpage.
`faketesttool`	read	A fake test tool
`fetchUser`	read	Fetch a user
`flaky_tool`	read	A flaky tool that fails twice
`fraction`	read
`generate_random_joke`	read	Generate a random joke.
`genre`	read	The genre of the movie
`getEmployee`	read	Get the employee role by name
`getEmployeeDepartment`	read	Get the employee department by name
`getNews`	read	Get the latest news on a topic
`getWeather`	read	Get the current weather for a location
`get_account_info`	read	Get the authenticated user
`get_available_time_slots`	read	Check calendar availability for given attendees on a specific date.
`get_current_time`	read	Get the current time in a given location
`get_current_weather`	read	Get the current weather in a given location
`get_customer`	read	Look up a customer by ID.
`get_detail_by_name`	read	Get details about a shape by its name
`get_ip`	read	Get server IP address
`get_nullish_weather`	read	Get the weather of a specific location and return the temperature in Celsius.
`get_output`	read	Get output for user
`get_page`	read	Get a specific Notion page by ID.
`get_person_details`	read	Get details about a person
`get_population`	read	Get the population of a city
`get_private_data`	read	Get private data
`get_procedural_memory`	read	Get user
`get_public_data`	read	Get public data
`get_screenshot`	read	Get a screenshot of the current screen.
`get_stock_price`	read	Get the current stock price for a given symbol
`get_thread`	read	Get a specific Slack thread.
`get_time`	read	Get the current time in a timezone.
`get_user_info`	read	Look up user info.
`get_user_purchases`	read	Get the authenticated user
`get_video_captions`	read	Get captions for a video.
`get_weather`	read	Get current weather information for a location
`get_weather_ant`	read	Get the weather of a specific location.
`get_weather_lc`	read	Get the weather of a specific location.
`get_weather_oai`	read	Get the weather of a specific location.
`github_create_issue`	write	Create an issue in a GitHub repository
`gitlab_create_issue`	write	Create an issue in a GitLab project
`greet`	read	Greet someone
`greetUser`	read	Greet a user
`greet_tool`	read	Greets a person
`http_400_tool`	read	Tool that raises 400 error
`http_500_tool`	read	Tool that raises 500 error
`image_tool`	read
`information_extraction`	read	Extracts the relevant information from the passage.
`inner_interrupt`	read	Inner tool that interrupts
`inspect`	read
`interrupt_tool`	read	Tool that interrupts
`invalid_composition_tool`	read	This tool has an unsupported root schema composition.
`invalid_header`	read
`invalid_tool`	read	Uses unsupported root composition.
`inventory_management`	read	Database schema and business logic for inventory tracking including products, warehouses, and stock levels.
`isReleased`	read	Whether the movie has been released
`joke`	read	A joke
`jsonSchemaTool`	read	A tool with JSON schema
`knowledge_retrieval`	read	Retrieve relevant information from long-term memory based on user query and preferences
`langchain-1`	read	First LangChain tool
`langchain-2`	read	Second LangChain tool
`legacy_result`	read
`length`	read	The length of the movie in minutes
`list_files`	read	List the available files in the project.
`list_items`	read	List available items
`load_skill`	read	Load the full content of a skill into the agent
`local_weather`	read	Get current weather and short-term forecast for a city
`lookup_order_status`	write	Look up the current delivery status of a customer order by ID
`lookup_visa_requirements`	read	Check visa requirements and documentation by destination country
`magic_function`	read	Applies a magic function to an input.
`manage_email`	write	Send emails using natural language. Use this when the user wants to send notifications, reminders, or any email communication. Handles recipient extraction, subject generation, and email composition. Input: Natural language email request (e.g.,
`mcpLikeTool`	read	Tool similar to MCP tools
`metadata_capture_tool`	read	Captures the metadata for testing
`middleware_tool`	read	Tool from middleware
`minus`	read	Subtracts two numbers
`modern_echo`	read
`multiply`	read
`mySpecificTool`	read	A tool with a specific name
`my_tool`	read	A custom tool
`name_generator`	read	Generates a random name
`network_tool`	read	Tool that raises NetworkError
`normalTool`	read	A normal tool that returns a string
`normal_tool`	read	A normal tool without returnDirect
`ok_tool`	read	a tool
`open-ai-product-endpoint`	read	Open AI Product Endpoint. Query for products.
`openai-1`	read	First OpenAI tool
`openai-2`	read	Second OpenAI tool
`outputFormatter`	read	Output formatter. Should always be used to format your response to the user
`output_formatter`	read	Should always be used to properly format output
`parameterless`	read	A tool that does nothing
`person`	read	A person
`pet_info_retriever`	read	Get information about pets.
`pollJob`	read	Check the status of a long-running job. Returns { status:
`predictNextUserMessage`	read	Predicts the next user message, along with insights.
`predictionViolations`	read	Generates violations, errors and differences between the predicted user response, and the actual response.
`preference_learning`	read	Learn and store user preferences or context in long-term memory
`process_payment`	read	Process a payment
`progress`	read
`project_overview`	read	Get a comprehensive overview of the current project state
`provide_solution`	read	Provide a solution to the customer
`query`	write	use this tool to generate and execute a query from a question using the index.
`query_data`	read	Query tool that returns nested response
`random_tool_call`	read	A tool that returns a random result
`rating`	read	The rating of the movie (1-10)
`raw`	read
`read_document_pages`	read	Read pages of a document.
`read_file`	read	Read a file by exact name (see list_files for options).
`recommend_products`	read	Provide personalized product recommendations based on stored customer preferences
`record_issue_type`	read	Record the type of issue and transition to resolution specialist.
`record_market_insight`	read	Record market insights and trends for future reference and pattern analysis
`record_warranty_status`	read	Record the customer
`regularTool`	read	A regular tool
`remove_todo`	destructive	Remove an item from the thread TODO list

Trust audit

BLOCKgrade F · trust 39/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (9 observation(s))
Network: declared (3 observation(s))
Shell: declared (6 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

CRITICALHard-coded secrets · secret.private_key · CWE-798, CWE-321

libs/providers/langchain-google/src/clients/index.ts:141

*     private_key: "-----BEGIN PRIVATE KEY-----\n...",

CRITICALHard-coded secrets · secret.private_key · CWE-798, CWE-321

libs/providers/langchain-google/src/clients/node.ts:112

*     private_key: "-----BEGIN PRIVATE KEY-----\n...",

HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95

libs/langchain-classic/src/util/openapi.ts:240

document = yaml.load(rawString);

Why it matters. deserialises untrusted bytes into live objects

Fix. use json or yaml.safe_load

HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319

libs/langchain-core/src/utils/ssrf.ts:17

"169.254.169.254",

Why it matters. cloud metadata endpoint: the classic SSRF credential grab

HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319

libs/langchain-core/src/utils/ssrf.ts:24

"metadata.google.internal",

Why it matters. cloud metadata endpoint: the classic SSRF credential grab

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532

environment_tests/test-exports-vercel/src/pages/index.tsx:24

console.log("handleLLMNewToken", token),

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

libs/langchain-core/src/runnables/tests/config.test.ts:78

api_key: "should-not-propagate",

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

libs/langchain-core/src/runnables/tests/config.test.ts:105

api_key: "should-not-propagate",

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

libs/langchain-core/src/runnables/tests/runnable_stream_events_v2.test.ts:102

api_key: "should-not-propagate",

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

libs/providers/langchain-typesafe/src/tests/classifier.test.ts:523

apiKey: "sk-SUPER-SECRET-12345",

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

delete_file, delete_shape, remove_todo

Why it matters. 3 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.binary · CWE-1104

libs/providers/langchain-google-genai/src/tests/data/gettysburg10.wav

gettysburg10.wav

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInventory / provenance · inv.binary · CWE-1104

libs/providers/langchain-google/src/chat_models/tests/data/gettysburg10.wav

gettysburg10.wav

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInventory / provenance · inv.hidden_file · CWE-1104

.oxfmtrc.jsonc

.oxfmtrc.jsonc

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.oxlintrc.jsonc

.oxlintrc.jsonc

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.pnpmrc

.pnpmrc

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

libs/create-langchain-integration/template/.release-it.json

.release-it.json

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

libs/langchain/src/agents/tests/returnDirectMiddleware.int.test.ts:64

const result = eval(input.expression);

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

libs/providers/langchain-google/src/chat_models/tests/index.int.test.ts:372

exec(`afplay "${filePath}"`);

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

libs/providers/langchain-google/src/chat_models/tests/index.int.test.ts:374

exec(`open "${filePath}"`);

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWInformation disclosure · disclose.log_secret · CWE-209, CWE-532

examples/src/langchain-classic/chains/summarization_separate_output_llm.ts:17

console.log("token", token);

LOWInformation disclosure · disclose.log_secret · CWE-209, CWE-532

examples/src/langchain-classic/models/chat/chat_streaming.ts:14

console.log({ token });

LOWInformation disclosure · disclose.log_secret · CWE-209, CWE-532

examples/src/langchain-classic/models/llm/llm_streaming.ts:14

console.log({ token });

LOWInformation disclosure · disclose.log_secret · CWE-209, CWE-532

libs/providers/langchain-cloudflare/src/tests/llms.int.test.ts:31

// console.log(token);

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

dependency_range_tests/scripts/create-mock-tsconfigs.sh:51

package_extends_path="../../../internal/tsconfig/base.json"

Gates applied: critical_finding, no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha 6808c2632af1full audit observations/trust-audit/mcp-server/langchain-ai__langchainjs.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-10-12	`6808c2632af1`	BLOCK	F	39	first audit

Questions

What is the @langchain/mcp-adapters MCP server?

The agent engineering platform

What tools does @langchain/mcp-adapters expose?

200 in total: 254 read-only, 28 that write, and 3 that can delete or overwrite (delete_file, delete_shape, remove_todo). Every one is listed on this page with its risk.

Is @langchain/mcp-adapters safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (39/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 3 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does @langchain/mcp-adapters need?

It reads ANTHROPIC_API_KEY, AWS_ACCESS_KEY_ID, AWS_BEARER_TOKEN_BEDROCK, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, AZURE_OPENAI_API_KEY, BEDROCK_AWS_ACCESS_KEY_ID, BEDROCK_AWS_SECRET_ACCESS_KEY, BEDROCK_AWS_SESSION_TOKEN, CLOUDFLARE_API_TOKEN, COHERE_API_KEY and DEEPSEEK_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does @langchain/mcp-adapters run?

It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as langchainjs.

How current is this page?

The grade is for one exact copy of the source (6808c2632af1), read on 2026-10-12. The repository is watched and re-audited when it changes.

Source	langchain-ai/langchainjs
npm	`langchainjs`
Transports	sse · stdio · streamable-http
Credentials it reads	`ANTHROPIC_API_KEYAWS_ACCESS_KEY_IDAWS_BEARER_TOKEN_BEDROCKAWS_SECRET_ACCESS_KEYAWS_SESSION_TOKENAZURE_OPENAI_API_KEYBEDROCK_AWS_ACCESS_KEY_IDBEDROCK_AWS_SECRET_ACCESS_KEYBEDROCK_AWS_SESSION_TOKENCLOUDFLARE_API_TOKENCOHERE_API_KEYDEEPSEEK_API_KEY`
License	MIT
Activity	pushed 0d ago