@langchain/langgraph-cli@1.5.7
The official command-line interface for LangGraph.js, providing tools to create, develop, and deploy LangGraph.js applications.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe deploy credential finding is not supported: the key is used for the LangSmith backend, and the saved value is the deployment name. However, CLI commands send runtime telemetry by default, including the OS release, without disclosure in the reviewed source, so this warrants a warning.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Invoking a CLI command with analytics enabled by default.
Impact
Shares machine and command metadata with the endpoint; the inspected payload does not include credentials or free-form command input.
Mechanism
The command records platform, OS release, Node and CLI versions, command name, and selected options, then POSTs them to a fixed Supabase endpoint. LANGGRAPH_CLI_NO_ANALYTICS=1 disables it.
AI rationale
The deploy credential finding is not supported: the key is used for the LangSmith backend, and the saved value is the deployment name. However, CLI commands send runtime telemetry by default, including the OS release, without disclosure in the reviewed source, so this warrants a warning.
Evidence
dist/cli/utils/analytics.mjsdist/cli/deploy.mjsdist/cli/cli.mjs
Network endpoints1
kzrlppojinpcyyaipxnb.supabase.co/rest/v1/js_logs
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- CLI command analytics posts events to a fixed Supabase endpoint.
- Events include OS release, runtime and CLI versions, command name, and selected command options.
- Analytics runs in a command’s preAction hook and is flushed when the CLI exits.
- An opt-out exists through LANGGRAPH_CLI_NO_ANALYTICS=1, but the reviewed source does not disclose the telemetry.
Evidence against
- The deploy command prompts for a LangSmith API key only when one is not already configured.
- The deployment client defaults to api.host.langchain.com; the host URL is also a command option.
- The deploy path persists the deployment name, not the API key.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/cli/deploy.mjsView file
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli/deploy.mjs:
import readline from "node:readline";
import { API_KEY_ENV_NAMES, DEFAULT_HOST_URL, DEPLOYMENT_NAME_ENV, TERMINAL_STATUSES, envWithoutDeploymentName, findDeploymentIdByName, formatDeploymentsTable, formatLogEntry, form...
const rl = readline.createInterface({
const rl = readline.createInterface({
await fs.writeFile(envPath, out);
throw new Error("No LangSmith API key found. Set LANGSMITH_API_KEY in the environment or .env file.");
process.stdout.write(paint("No LangSmith API key found. Create one at Settings > API Keys in LangSmith.\n", "yellow"));
resolvedApiKey = await promptHidden("Enter LangSmith API key");
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/cli/deploy.mjsView on unpkg•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 5
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist/cli/deploy.mjsView on unpkgFindings
3 High5 Medium4 Low
HighCredential Redirect Persistencedist/cli/deploy.mjs
HighSemantic Analysis Limiteddist/cli/deploy.mjs
HighPrevious Version Dangerous Deltadist/cli/dev.python.mjs
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencedist/cli/utils/analytics.mjs
MediumAi Review Evidencedist/cli/utils/analytics.mjs
MediumAi Review Evidencedist/cli/deploy.mjs
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @langchain/langgraph-cli@1.5.7.
See all versions of @langchain/langgraph-cli for other recorded verdicts.
- Review the evidence and your use of @langchain/langgraph-cli@1.5.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.