mirror of
https://github.com/langflow-ai/langflow.git
synced 2026-07-24 03:55:34 +08:00
b3df3a7c35
* feat: Add global variable support for MCP server headers
- Add IOKeyPairInputWithVariables component for header inputs with global variable dropdown
- Integrate global variable selection in MCP Server modal
- Add variable resolution in MCP server headers (_resolve_global_variables_in_headers)
- Add variable loading and decryption in MCP API endpoint and component
- Add unit tests for variable resolution utility function
* test: Add comprehensive unit tests for IOKeyPairInputWithVariables component
- Add 15 test cases covering rendering, user interactions, and edge cases
- Test global variable dropdown functionality and selection
- Test row addition/removal and input validation
- Test duplicate key detection and error handling
- Test initialization from existing values with variable badges
- Addresses CodeRabbit review feedback for frontend test coverage
* [autofix.ci] apply automated fixes
* test: fix frontend Jest tests for IOKeyPairInputWithVariables component
- Added proper mocks for IconComponent, InputComponent, and Input
- Used explicit TypeScript types instead of 'any' for mock props
- Fixed test assertions to match actual component structure (Type key.../Type a value... placeholders)
- All 8 tests now pass without console warnings
- Tests cover: rendering, onChange callbacks, add/delete buttons, global variables toggle
* fix: restore session_scope import to module level for test mocking
The session_scope import was moved inside _process_headers method, which broke
unit tests that mock it at the module level. Restored it to module-level imports
with noqa comment to prevent ruff from removing it, and removed the duplicate
import from inside the method.
Fixes: test_database_config_used_when_no_value_config
* chore: trigger CI rebuild to test for flaky Playwright test
* Update component index
* chore: update Nvidia Remix starter project with session_scope import fix
* perf(mcp): optimize global variable loading to prevent timeouts
Only load global variables from database when headers are actually present
in the MCP server config. This avoids unnecessary database queries for
servers without headers, significantly improving performance and preventing
timeouts in tests that repeatedly connect to MCP servers.
The optimization adds a conditional check before the database query:
- has_headers = server_config.get('headers') and len(server_config.get('headers', {})) > 0
- Only queries database if has_headers is True
This resolves the cumulative delay issue where each MCP connection retry
was performing an expensive database query even when no headers were configured.
* [autofix.ci] apply automated fixes
* fix(test): update Playwright test for new header input component structure
Update MCP server Playwright test to work with the new KeyPairInputWithVariables
component that uses InputComponent with global variable support for header values.
Changes:
- Use getByPlaceholder() instead of getByTestId() for header value fields
- Header value fields now use InputComponent which doesn't expose data-testid
The new component structure wraps the value input in InputComponent to provide
global variable dropdown functionality, requiring a different selector strategy.
* chore: update Nvidia Remix starter project
Update starter project file that was modified by the automated build pipeline.
* Update component index
* fix: replace jose with jwt (#11285)
* replace jose with jwt
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* [autofix.ci] apply automated fixes (attempt 3/3)
* pin to lower pyjwt
* pyjwt version
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* [autofix.ci] apply automated fixes (attempt 3/3)
* [autofix.ci] apply automated fixes
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* Update component index
* Update component index
* [autofix.ci] apply automated fixes
* Update component index
* chore: trigger CI rebuild
* [autofix.ci] apply automated fixes
* refactor: remove langflow imports from lfx MCP component
Separate lfx from langflow by using the service layer pattern:
Changes:
1. Extended VariableServiceProtocol in lfx with get_all_decrypted_variables()
2. Implemented the method in langflow's DatabaseVariableService
3. Updated MCP component to use get_variable_service() instead of direct imports
4. Added comprehensive unit tests for the new service method
Benefits:
- Clean separation between lfx and langflow packages
- Uses existing service architecture pattern
- Maintains performance optimization (only loads variables when needed)
- No breaking changes to functionality
Removed direct langflow imports from mcp_component.py (auth utils, Variable model, settings service, and sqlmodel select).
Files modified:
- src/lfx/src/lfx/services/interfaces.py
- src/backend/base/langflow/services/variable/service.py
- src/lfx/src/lfx/components/models_and_agents/mcp_component.py
- src/backend/tests/unit/services/variable/test_service.py (added 3 new tests)
* fix: Handle global variables correctly for components
- Fix UUID type conversion in variable service to prevent SQLAlchemy errors
- Add type-based decryption: only decrypt CREDENTIAL variables, not GENERIC
- Improve error handling in decrypt_api_key to prevent crashes on second attempt
- Resolves 'str object has no attribute hex' error when loading global variables
This fixes issues with watsonx.ai and MCP components when using global variables.
* [autofix.ci] apply automated fixes
* Update component index
* Consider other failed decryption cases
* fix(variable-service): Fix UUID conversion and type-based variable decryption
- Convert string to UUID in get_all_decrypted_variables() to prevent SQLAlchemy errors
- Implement type-based decryption: only decrypt CREDENTIAL variables, not GENERIC
- Simplify get_all() to return stored values directly for both variable types
- Fixes watsonx component update error (400 status) when editing values
Resolves issue where editing watsonx.ai component values caused:
'Error while updating the Component' with 400 client error
* [autofix.ci] apply automated fixes
* chore: update starter project files
* fix: remove explicit value assignment to allow credential redaction
* fix: handle credential redaction in frontend and fix Playwright test hangs
- Update GlobalVariableModal to handle None credential values
- Allow credential updates without re-entering value
- Fix userSettings test by using dispatchEvent for clicks
- Add waitForTimeout after clicks to prevent hangs
- Use .first() for Fields selectors to avoid strict mode violations
* [autofix.ci] apply automated fixes
* Update component index
* [autofix.ci] apply automated fixes
* fix: improve error handling and logging for variable decryption
Address code review feedback:
1. Increase log level from debug to warning when decryption fails in
auth/utils.py. Returning empty string silently could cause issues,
so warning level makes failures more visible.
2. Follow established pattern in mcp.py for variable decryption:
- Only decrypt CREDENTIAL type variables (encrypted in storage)
- Use GENERIC type variables as-is (stored as plaintext)
- Change from silent fallback (adebug) to explicit error (aerror)
- This matches the pattern in get_all_decrypted_variables()
These changes make error handling more explicit and consistent across
the codebase.
* Update component index
* Update component index
* [autofix.ci] apply automated fixes
* chore: trigger CI rebuild
* [autofix.ci] apply automated fixes
* Updates to ensure backwards compatibility for encrypted generic variables
* Skip failed decryption
* Fix test
* ruff
* update starter projects
* ruff
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* comp index
* [autofix.ci] apply automated fixes
* remove unnecessary step in pandas series conversion
---------
Co-authored-by: Steve Haertel <shaertel@ca.ibm.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Himavarsha <40851462+HimavarshaVS@users.noreply.github.com>
Co-authored-by: Jordan Frazier <jordan.frazier@datastax.com>
Langflow is a powerful platform for building and deploying AI-powered agents and workflows. It provides developers with both a visual authoring experience and built-in API and MCP servers that turn every workflow into a tool that can be integrated into applications built on any framework or stack. Langflow comes with batteries included and supports all major LLMs, vector databases and a growing library of AI tools.
✨ Highlight features
- Visual builder interface to quickly get started and iterate.
- Source code access lets you customize any component using Python.
- Interactive playground to immediately test and refine your flows with step-by-step control.
- Multi-agent orchestration with conversation management and retrieval.
- Deploy as an API or export as JSON for Python apps.
- Deploy as an MCP server and turn your flows into tools for MCP clients.
- Observability with LangSmith, LangFuse and other integrations.
- Enterprise-ready security and scalability.
🖥️ Langflow Desktop
Langflow Desktop is the easiest way to get started with Langflow. All dependencies are included, so you don't need to manage Python environments or install packages manually. Available for Windows and macOS.
⚡️ Quickstart
Install locally (recommended)
Requires Python 3.10–3.13 and uv (recommended package manager).
Install
From a fresh directory, run:
uv pip install langflow -U
The latest Langflow package is installed. For more information, see Install and run the Langflow OSS Python package.
Run
To start Langflow, run:
uv run langflow run
Langflow starts at http://127.0.0.1:7860.
That's it! You're ready to build with Langflow! 🎉
📦 Other install options
Run from source
If you've cloned this repository and want to contribute, run this command from the repository root:
make run_cli
For more information, see DEVELOPMENT.md.
Docker
Start a Langflow container with default settings:
docker run -p 7860:7860 langflowai/langflow:latest
Langflow is available at http://localhost:7860/. For configuration options, see the Docker deployment guide.
Caution
- Users must update to Langflow >= 1.7.1 to protect against CVE-2025-68477 and CVE-2025-68478.
- Langflow version 1.7.0 has a critical bug where persisted state (flows, projects, and global variables) cannot be found when upgrading. Version 1.7.0 was yanked and replaced with version 1.7.1, which includes a fix for this bug. DO NOT upgrade to version 1.7.0. Instead, upgrade directly to version 1.7.1.
- Langflow versions 1.6.0 through 1.6.3 have a critical bug where
.envfiles are not read, potentially causing security vulnerabilities. DO NOT upgrade to these versions if you use.envfiles for configuration. Instead, upgrade to 1.6.4, which includes a fix for this bug.- Windows users of Langflow Desktop should not use the in-app update feature to upgrade to Langflow version 1.6.0. For upgrade instructions, see Windows Desktop update issue.
- Users must update to Langflow >= 1.3 to protect against CVE-2025-3248
- Users must update to Langflow >= 1.5.1 to protect against CVE-2025-57760
For security information, see our Security Policy and Security Advisories.
🚀 Deployment
Langflow is completely open source and you can deploy it to all major deployment clouds. To learn how to deploy Langflow, see our Langflow deployment guides.
⭐ Stay up-to-date
Star Langflow on GitHub to be instantly notified of new releases.
👋 Contribute
We welcome contributions from developers of all levels. If you'd like to contribute, please check our contributing guidelines and help make Langflow more accessible.