Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo
67 of your 84 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

langflow-ai/langflow

https://github.com/langflow-ai/langflow · scanned 2026-06-05 04:43 UTC (10 hours, 24 minutes ago) · 10 languages

2202 findings (78 legacy + 2124 scanner) 11/13 scanners ran 75th percentile · Javascript · small (2-20K LoC) Scanner says 61 (higher by 21)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 10 hours, 24 minutes ago · v2 · 1140 findings from 2 sources. Findings combine the legacy security pipeline AND the multi-layer engine (atlas, wiring, flows, ranked) AND verified AI agent contributions.

JSON
Combined
75.1
/100
Repobility
89
78 legacy
9-layer
61
100.0% cov · 1062 gaps
Critical
27
click to filter
Agents
6
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 85.0 0.15 12.75
security_score 100.0 0.25 25.00
testing_score 70.0 0.20 14.00
documentation_score 60.0 0.15 9.00
practices_score 87.0 0.15 13.05
code_quality 80.0 0.10 8.00
Overall 1.00 81.8
security_score may be inflated — optional security scanners were skipped on this fast scan
Severity distribution — click a segment to filter
Active filters: layer: api × excluding tests × Reset all
Severity: Critical 27 High 137 Medium 181 Low 603 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Legacy 78 9-layer 1062 Crowd 0 Layer: Quality 312 Security 109 Software 125 Frontend 258 Network 4 Hardware 6 Cicd 274 Api 52
Scan summary Repository scanned at 61.2/100 with 100.0% coverage. It contains 33357 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 1062 findings — concentrated in quality (291), cicd (274), frontend (258). Risk profile is high: 5 critical, 106 high, 178 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 52 of 1140 findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high 9-layer api wiring conf 1.00 Dangling fetch: POST /api/v1/flows/${fid}/events (src/frontend/tests/core/features/flow-agent-events.spec.ts:27)
`src/frontend/tests/core/features/flow-agent-events.spec.ts:27` calls `POST /api/v1/flows/${fid}/events` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/v1/flows/<p>/events` If this points at an external API, prefix …
wiringdangling-fetchfetch
high 9-layer api wiring conf 1.00 Dangling fetch: POST /api/v1/flows/${fid}/events (src/frontend/tests/core/features/flow-agent-events.spec.ts:44)
`src/frontend/tests/core/features/flow-agent-events.spec.ts:44` calls `POST /api/v1/flows/${fid}/events` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/v1/flows/<p>/events` If this points at an external API, prefix …
wiringdangling-fetchfetch
low 9-layer api wiring conf 1.00 Unused endpoint: ANY /streamable
`src/backend/base/langflow/api/v1/mcp.py` declares `ANY /streamable` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: DELETE /
`src/backend/base/langflow/api/v2/files.py` declares `DELETE /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: DELETE /batch/
`src/backend/base/langflow/api/v2/files.py` declares `DELETE /batch/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: DELETE /providers/{provider_id}
`src/backend/base/langflow/api/v1/deployments.py` declares `DELETE /providers/{provider_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting wh…
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: DELETE /servers/{server_name}
`src/backend/base/langflow/api/v2/mcp.py` declares `DELETE /servers/{server_name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes…
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: DELETE /{deployment_id}
`src/backend/base/langflow/api/v1/deployments.py` declares `DELETE /{deployment_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consum…
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: DELETE /{file_id}
`src/backend/base/langflow/api/v2/files.py` declares `DELETE /{file_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: DELETE /{project_id}
`src/backend/base/langflow/api/v1/projects.py` declares `DELETE /{project_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: GET /
`src/backend/base/langflow/api/v2/workflow.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: GET /check-config
`src/backend/base/langflow/agentic/api/router.py` declares `GET /check-config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: GET /configs
`src/backend/base/langflow/api/v1/deployments.py` declares `GET /configs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: GET /download/{project_id}
`src/backend/base/langflow/api/v1/projects.py` declares `GET /download/{project_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consum…
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: GET /elevenlabs/voice_ids
`src/backend/base/langflow/api/v1/voice_mode.py` declares `GET /elevenlabs/voice_ids` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consu…
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: GET /flows
`src/lfx/src/lfx/cli/serve_app.py` declares `GET /flows` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: GET /llms
`src/backend/base/langflow/api/v1/deployments.py` declares `GET /llms` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: GET /logs
`src/backend/base/langflow/api/log_router.py` declares `GET /logs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: GET /logs-stream
`src/backend/base/langflow/api/log_router.py` declares `GET /logs-stream` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: GET /providers
`src/backend/base/langflow/api/v1/deployments.py` declares `GET /providers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: GET /providers/{provider_id}
`src/backend/base/langflow/api/v1/deployments.py` declares `GET /providers/{provider_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who c…
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: GET /servers
`src/backend/base/langflow/api/v2/mcp.py` declares `GET /servers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: GET /servers/{server_name}
`src/backend/base/langflow/api/v2/mcp.py` declares `GET /servers/{server_name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: GET /snapshots
`src/backend/base/langflow/api/v1/deployments.py` declares `GET /snapshots` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: GET /sse
`src/backend/base/langflow/api/v1/mcp.py` declares `GET /sse` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: GET /types
`src/backend/base/langflow/api/v1/deployments.py` declares `GET /types` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: GET /{deployment_id}
`src/backend/base/langflow/api/v1/deployments.py` declares `GET /{deployment_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes …
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: GET /{deployment_id}/flows
`src/backend/base/langflow/api/v1/deployments.py` declares `GET /{deployment_id}/flows` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who con…
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: GET /{deployment_id}/runs/{run_id}
`src/backend/base/langflow/api/v1/deployments.py` declares `GET /{deployment_id}/runs/{run_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting…
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: GET /{deployment_id}/status
`src/backend/base/langflow/api/v1/deployments.py` declares `GET /{deployment_id}/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who co…
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: GET /{file_id}
`src/backend/base/langflow/api/v2/files.py` declares `GET /{file_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: GET /{project_id}
`src/backend/base/langflow/api/v1/projects.py` declares `GET /{project_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: PATCH /providers/{provider_id}
`src/backend/base/langflow/api/v1/deployments.py` declares `PATCH /providers/{provider_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who…
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: PATCH /servers/{server_name}
`src/backend/base/langflow/api/v2/mcp.py` declares `PATCH /servers/{server_name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes …
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: PATCH /snapshots/{provider_snapshot_id}
`src/backend/base/langflow/api/v1/deployments.py` declares `PATCH /snapshots/{provider_snapshot_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or docume…
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: PATCH /{deployment_id}
`src/backend/base/langflow/api/v1/deployments.py` declares `PATCH /{deployment_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consume…
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: PATCH /{project_id}
`src/backend/base/langflow/api/v1/projects.py` declares `PATCH /{project_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: POST /
`src/backend/base/langflow/api/v2/workflow.py` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: POST /assist
`src/backend/base/langflow/agentic/api/router.py` declares `POST /assist` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: POST /assist/stream
`src/backend/base/langflow/agentic/api/router.py` declares `POST /assist/stream` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes i…
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: POST /batch/
`src/backend/base/langflow/api/v2/files.py` declares `POST /batch/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: POST /code
`src/backend/base/langflow/api/v1/validate.py` declares `POST /code` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: POST /execute/{flow_name}
`src/backend/base/langflow/agentic/api/router.py` declares `POST /execute/{flow_name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who cons…
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: POST /prompt
`src/backend/base/langflow/api/v1/validate.py` declares `POST /prompt` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: POST /providers
`src/backend/base/langflow/api/v1/deployments.py` declares `POST /providers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: POST /run
`src/lfx/src/lfx/cli/serve_app.py` declares `POST /run` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: POST /servers/{server_name}
`src/backend/base/langflow/api/v2/mcp.py` declares `POST /servers/{server_name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes i…
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: POST /stop
`src/backend/base/langflow/api/v2/workflow.py` declares `POST /stop` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: POST /stream
`src/lfx/src/lfx/cli/serve_app.py` declares `POST /stream` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: POST /upload/
`src/backend/base/langflow/api/v1/projects.py` declares `POST /upload/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: POST /{deployment_id}/runs
`src/backend/base/langflow/api/v1/deployments.py` declares `POST /{deployment_id}/runs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who con…
wiringunused-endpoint
low 9-layer api wiring conf 1.00 Unused endpoint: PUT /{file_id}
`src/backend/base/langflow/api/v2/files.py` declares `PUT /{file_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
wiringunused-endpoint
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/21f5a3bf-888a-438b-82df-af3a9dc3f48f/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/21f5a3bf-888a-438b-82df-af3a9dc3f48f/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.