Automation Review: LangGraph

First piece in a new series called Automation Review. Every review treats two axes as first-class: whether the tool is genuinely open source, and whether it ties you to one AI vendor. The series has a deliberate bias toward open-source-powered automation.

TL;DR

Pick LangGraph when you need stateful, multi-step LLM features with explicit structure around model calls. Pydantic AI is the closest peer if you want lighter ceremony; the OpenAI Agents SDK is the choice if you are committed to OpenAI and want fewer moving parts. Skip the whole category if a single LLM call is enough.

The subject: LangGraph. Official runtimes in Python and JavaScript / TypeScript; community-maintained Java port LangGraph4j. Production users and adoption numbers are in Market reach below.

Every review also ships with a full hands-on demo in our companion repo: GoldenPassport/automation-review-examples. This page is the analysis; the Demo tab above has the code.

Go to the demo

Plain-English definitions for any unfamiliar vocabulary are in the Terms reference at the bottom.

What it actually is

LangGraph is a library for declaring how an agent moves through work, not what it should think. Its central abstraction is the StateGraph: a directed graph where each node reads from and writes to a shared, typed state object, and each edge controls what runs next, optionally conditionally.

The LangChain team's own framing is honest: an "agent runtime and low-level orchestration framework" that lets developers "balance agent control with agency." Most agent frameworks tilt toward autonomy ("let the model decide"); LangGraph tilts toward explicit structure ("you decide; the model fills in the gaps inside the structure you set"). It is the framework you reach for when an autonomous loop is too brittle and a fixed pipeline is too rigid.

The framework is open source. Around it, LangChain Inc. has built a commercial platform (LangSmith for observability, LangGraph Platform for deployment) that you can adopt or ignore. The framework runs end-to-end without it.

The problem it solves

LLM applications get complicated quickly. The naive shape is a single prompt with a tool list and a while loop that keeps calling the model until it stops asking for tools. That works for a demo. It breaks down the moment you need any of:

Determinism in production. Stakeholders want to know what an agent will do, not just see a transcript of what it did last time.
Long-running workflows. Some steps require human approval; others span hours. The agent has to checkpoint, sleep, and resume.
Branching and looping with auditability. The agent should follow a documented flow, not improvise. When something goes wrong, you should be able to point at the exact node that failed and replay it.
Streaming and partial results. Users want progress, not silence followed by a wall of text.
Sub-agent composition. A real system has specialists. The orchestrator coordinates them; each one focuses on a narrow capability.

Before LangGraph, teams rolled their own state machine alongside LangChain chains, or stitched together orchestration code that did not survive the third feature request. LangGraph is state-machine thinking embedded directly into an LLM orchestration framework, with first-class support for tool calls, persistence, streaming, human-in-the-loop pauses, and sub-graph composition.

A short history

LangGraph has only been around for just over two years at the time of writing.

January
Public launch. Python v0.0.10 ships to PyPI on 9 January; JS v0.0.1 follows on 18 January; LangChain formally announces LangGraph on 22 January. Both releases are spartan: StateGraph, a handful of node helpers, integration with LangChain for prompts and tools. The launch lands in the middle of the industry's shift from "chatbots" to "agents".
March
The Devin moment. Cognition Labs demos Devin, an "AI software engineer", in a viral video. Mainstream attention to agentic frameworks intensifies; LangGraph's "explicit structure for agent loops" positioning starts landing with product teams who had bounced off less-opinionated alternatives.
Mid
Maturing primitives. Stream support, conditional edges, and the first usable checkpointing layer ship. LangGraph appears in the first wave of serious production case studies, including Klarna's customer-service assistant, which LangChain attributes to LangGraph (with LangSmith) specifically rather than the broader stack.
Late
Competition arrives + Studio. Persistence backends (in-memory, Postgres, SQLite), the Send / Map primitives for fan-out, time-travel debugging, and LangGraph Studio ship. Meanwhile, OpenAI open-sources Swarm as an experimental agent-handoff framework, the first clear signal that the dominant model vendor intends to enter the orchestration space directly.
Early
Vendor-official competition. OpenAI ships the Agents SDK as the production-grade successor to Swarm, directly targeting LangGraph's category from the model vendor itself. The LangChain v0.3 release aligns the Python and JS ecosystems and pushes another wave of LangGraph adoption.
Mid
Production adoption ramps. Klarna, Lyft, Cloudflare, The Home Depot, Workday, Nvidia, LinkedIn, and Coinbase appear on LangChain's production-users page. Combined Python + JS downloads are well into seven-figure monthly territory. Regulated-industry conversations centre on agentic + workflow hybrids rather than pure-agent stacks.
22 October
1.0 GA, product rename, and a $1.25B valuation. v1.0 alpha lands in September; v1.0 GA ships on 22 October. The API stabilises; TypeScript types get markedly better. In the same week, TechCrunch reports a fresh $125M round valuing LangChain at $1.25B, a steep climb from the ~$25M Series A (led by Sequoia) that LangChain raised back in 2023. The commercial deployment product also completes its three-rename arc: LangGraph Cloud (June 2024) → LangGraph Platform (October 2024, when self-hosted and bring-your-own-cloud landed) → LangSmith Deployment (October 2025, as part of a broader product-naming cleanup).
November
Security disclosures. CVE-2025-64439: high-severity remote-code-execution in langgraph-checkpoint's JsonPlusSerializer, disclosed 5 November. CVE-2025-67644: SQL-injection in the LangGraph SQLite checkpoint backend follows. Both patched quickly; the pattern is flagged in the gaps section below.
Today
v1.2.2 (Python) and v1.3.2 (JS) are current; ~62M combined monthly downloads across both runtimes.

Architectural inspirations

LangGraph's own documentation acknowledges three intellectual debts. Each one explains a design choice that might otherwise read as quirky.

Google, 2009

Pregel

Vertex-centric Bulk Synchronous Parallel

Google's answer to a problem MapReduce did not fit: graph algorithms like PageRank or shortest-path do not decompose into key-value pairs.

Pregel introduced the BSP model: every vertex runs a function that reads its state and any incoming messages, optionally emits new ones, then the whole graph synchronises at a "superstep" boundary before the next round.

Structurally that is what LangGraph's nodes do. The Pregel lineage is why LangGraph feels deterministic and easy to checkpoint: it is not a free-form async event loop, it is stepping through synchronous supersteps.

Pregel paper →

Google → Apache, 2016

Apache Beam

Compile once, run on many engines

Came from Google's Dataflow SDK donation to Apache. Before Beam, batch and stream frameworks locked you to a specific engine: write for Spark, rewrite for Flink.

Beam introduced a unified programming model with runners that execute the same pipeline against different engines (Flink, Spark, Dataflow, others).

LangGraph follows the same pattern. The same StateGraph compiles to a runnable you can invoke() locally, stream() over HTTP, back with an in-memory checkpointer in tests, or run on LangSmith Deployment with Postgres-backed durability. The graph does not change; the runtime context does.

Beam overview →

Since 2004

NetworkX

The graph builder Python already knows

The Python graph library researchers in mathematics, biology, and social network analysis have used for two decades. Its contribution to LangGraph is API ergonomics.

The NetworkX pattern is G = Graph(); G.add_node(...); G.add_edge(...). LangGraph's API in both Python and JS is a direct lineage: graph.add_node("classify", classify).add_edge("classify", "extract"). The naming is deliberate, and the ramp-up is short for anyone arriving from data-science Python.

NetworkX docs →

Deterministic supersteps from Pregel, compile-once-run-many-runtimes from Beam, the graph builder from NetworkX. None of those choices are accidents.

Who it is for

Pick LangGraph if…	Pick something else if…
You are building stateful, multi-step LLM features in Python or TypeScript.	You are building a single-prompt, single-call feature. LangGraph is overkill.
You want deterministic structure around non-deterministic model calls.	You want agent-decides-everything autonomy. AutoGen leans further that way.
You need the production-concern surface (persistence, streaming, human approval, observability) provided by the framework rather than reinvented.	You will not tolerate the LangChain peer-dependency footprint.
You already use the LangChain ecosystem, or are happy to.	You are in a heavily regulated industry (banking, insurance, healthcare, pharma) under frameworks like SR 11-7, the EU AI Act, or GxP that demand deterministic, audit-proof steps. The LLM call inside any node is not deterministic, so the auditable spine belongs in a BPM or durable workflow engine (Flowable, jBPM, Temporal).

Market reach

Adoption has shifted hardest in the last eighteen months. The ecosystem footprint, as of this week:

LangGraph downloads, last 30 days

~62Mcombined

Python (PyPI): 52.3M (84.4%)
JavaScript (npm): 9.7M (15.6%)

Python ~326M all-time on PyPI; JavaScript ~2.3M weekly on npm.

Python dominates the install base, which you would expect for a framework that grew out of LangChain. The JS port matters disproportionately for teams shipping user-facing web apps, but the centre of gravity is Python.

The named production users on the LangGraph product page (Klarna, Lyft, Cloudflare, The Home Depot, Workday, Nvidia, LinkedIn, Coinbase, others) span buy-now-pay-later, ridesharing, retail, infrastructure, and developer tools. LangChain's 1.0 announcement separately headlines Uber, LinkedIn, and Klarna.

Where it sits in the landscape

LangGraph leads its specific category (typed, graph-based, stateful orchestration with first-class persistence and human-in-the-loop), but the broader agent-framework space is competitive. Most of these tools solve adjacent but distinct problems, so the shape of each alternative matters more than raw download numbers.

Start with the raw adoption picture. Combined Python + JS downloads where applicable, last 30 days:

Monthly downloads, agentic / agent-adjacent frameworks

LangGraph62M
Vercel AI SDK55.4Mdifferent scope
Pydantic AI41M
OpenAI Agents SDK35.5M
CrewAI12.3M
Mastra3.9M
AutoGen0.9M
n8n0.36Mnpm only; mostly self-hosted via Docker

Sources: PyPI and npm 30-day download counts. LangGraph and OpenAI Agents SDK are combined Python + JS; the rest are single-runtime. n8n is a workflow platform distributed mainly as a Docker image, so its npm count understates real usage by a wide margin.

Downloads measure usage; GitHub stars measure mindshare, and the two rank differently. n8n and the older, research-led projects (AutoGen, CrewAI) collect far more stars than their library-download volume would suggest:

GitHub stars

n8n190.1kdifferent scope
AutoGen58.5k
CrewAI52.3k
LangGraph33.2k
OpenAI Agents SDK26.7k
Vercel AI SDK24.5k
Mastra24.4k
Pydantic AI17.4k

Source: each repo's GitHub stargazer count at publication. Stars accumulate over a project's lifetime, so older and broader-scope projects (n8n, AutoGen, CrewAI) tend to lead regardless of current library usage.

Now the shape of each, side by side:

Framework	What it actually is
LangGraph	Stateful graph orchestration; explicit structure with LLM-decided branches
Pydantic AI	Type-first agent loop; lighter ceremony, less graph structure
OpenAI Agents SDK	Vendor-official; leans toward autonomous loops and tool use
CrewAI	Higher-level "crew of role-playing agents" abstraction
Mastra	TS-native, similar graph shape, smaller ecosystem
AutoGen (Microsoft)	Multi-agent conversation framework, research lineage
Vercel AI SDK (`ai`)	Different scope: streaming + UI + lightweight agent calls
n8n	Different scope: a workflow-automation platform "for technical teams"; AI/agent nodes are one capability among hundreds of integrations

Two patterns before the takeaways:

Almost all are true open source. Every framework above is MIT or Apache 2.0, with one exception: n8n ships under the Sustainable Use License, a "fair-code" source-available licence. It lets you use n8n free for internal business purposes and personal projects, but bars you from reselling it as a hosted service or white-labelling it, and certain features sit behind the separate n8n Enterprise Licence. So it is free for most teams to self-host, but it is not OSI-approved open source. Where licences differ for the rest is in the platform around the framework: LangGraph Platform, LangSmith, and similar commercial offerings are separate paid products. Adopting a framework does not commit you to its parent's paid plan.
Almost all are AI-vendor agnostic. The exception is the OpenAI Agents SDK, which is OpenAI-first by design. You can use it with "OpenAI-compatible" endpoints, but the defaults and examples assume OpenAI. If keeping the model vendor open matters, that pulls you toward any of the other seven.

A few takeaways:

Pydantic AI is the closest peer in scope, doing about 80% of LangGraph's Python volume. If you prefer typed Python ergonomics and a lighter abstraction, it is a genuine alternative, not a long shot.
The OpenAI Agents SDK is the official-from-the-model-vendor option. If you are OpenAI-only and want the fewest moving parts, it is hard to argue against. Trade-off: more autonomous loops, less explicit structure.
Vercel AI SDK's ~55M monthly JS downloads mostly go to a different job (streaming chat UIs, simple tool-use). Most teams that adopt LangGraph use Vercel AI SDK at the edge, not instead of it.
AutoGen has a strong research reputation but limited production volume. More common in research labs than product engineering.
CrewAI is a higher-level abstraction. Want the framework to do more of the thinking about agent roles and delegation, you trade some of the explicit control LangGraph gives.
n8n is the odd one out, and not really a peer. It positions itself as "workflow automation for technical teams": a visual canvas you can drop JavaScript or Python into, self-host, and version, with AI and agent nodes as one capability among hundreds of integrations. That is a different altitude from a code-first orchestration library. n8n is where you automate a whole business process; LangGraph is where you build a single agent's control flow. The fairer comparison is to LangChain's own platform layer (LangGraph Platform, LangSmith), a deliberate and central part of its commercial story. The tiny npm figure reflects distribution (Docker and n8n Cloud, not npm install), not reach.

What is good

The right primitive at the right level. A typed StateGraph is not a magical abstraction. It is what you would have built yourself with worse types and worse tests. Having it as a library means you do not have to.
The production extras are first-class and free. Streaming, checkpointing, and human-in-the-loop are not paid add-ons. They live in the MIT-licensed framework alongside the StateGraph primitives, with self-hostable checkpointers (in-memory, SQLite, Postgres) for persistence. You can run the whole stack end-to-end without touching any commercial LangChain product.
Cross-runtime API parity. A Python team and a JS team can collaborate on the same graph design because the abstractions match. The community LangGraph4j project carries the same shape to the JVM for teams that need it, also open source.
Vendor neutrality at the model layer. Tools and models plug in through the broader LangChain ecosystem, so you can swap OpenAI for Anthropic for a self-hosted model with one line. The framework itself takes no opinion on which provider you use.

Where the gaps are

The balanced part of this review.

Security posture needs active management. 2025 and early 2026 saw multiple disclosed vulnerabilities affecting LangGraph itself, including a high-severity RCE in langgraph-checkpoint (CVE-2025-64439) and a SQL-injection in the SQLite checkpoint backend (CVE-2025-67644), alongside related LangChain core issues. Fixes shipped quickly, but the pattern is what any sufficiently broad framework produces: many checkpointers, many model clients, many tool connectors. Production teams should pin versions, subscribe to security advisories, treat tool inputs and outputs as untrusted, and be deliberate about filesystem, database, and checkpoint access.
Documentation has caught up but is not uniform. Python docs are deeper, JS is good and improving, LangGraph4j has its own (sparser) docs. Translating a Python sample to JS is sometimes a five-minute job, sometimes a half-day puzzle.
LangChain peer-dependency pulls you in. ("Peer dependencies" are packages a library expects you to install alongside it.) You can use LangGraph without the rest of LangChain, but the path of least resistance leads through @langchain/core and the model adapter packages. If you prefer thinner installs, plan that boundary deliberately.
Conditional-edge ergonomics are a little verbose compared with what you would write by hand. The library trades terseness for explicitness, which is right for production but reads as ceremonial on first encounter.
Versioning has been spiky. Pre-1.0 moved fast. The 1.x line is stabilising, but projects on 0.2.x or earlier should budget time for an upgrade pass.

Verdict

The poster carries the headline. What the verdict should add to it:

The same pace that delivers feature velocity also produces a steady trickle of security disclosures, including the 2025 issues flagged above. That is normal for a framework of this scope, but it does mean LangGraph is not a "set it up and forget it" dependency. Plan for ongoing patch hygiene the way you would for any other production-critical library.

The reasons to choose it: you want explicit structure, you need the production extras (streaming, checkpoints, human-in-the-loop) without rebuilding them, and you are comfortable with the LangChain ecosystem.

The reasons to pass: you only need a single LLM call, you want a framework that decides everything autonomously, or you are committed to staying outside the LangChain dependency tree.

For business-centric automation work that needs explicit structure next to human-approval gates, LangGraph is a better starting point than any of the autonomous-agent frameworks. The deepest regulated work is the exception flagged in "Who it is for".

Want to see the framework in code?

Go to the demo

Suggest a review

If there is a tool or concept you would like reviewed next in this format, drop me a message. The series runs on what readers actually want covered.

Terms

Plain-English definitions for the agentic-AI and graph vocabulary used in this review, listed alphabetically.

Agent. An LLM-powered program that reads context, decides what to do next, and can call external tools (search, code, APIs) on its own. Distinct from a static chatbot that just answers questions.

Agentic AI. The category of software where the agent above is the central control flow. Also called "AI agents". The "agentic" qualifier just means "behaving like an agent".

BPM (Business Process Management). A long-standing category of software for modelling, executing, and auditing business processes step-by-step. Open-source BPM tools (Flowable, jBPM, Camunda 7) predate agentic AI by two decades and are what most regulated organisations already use for workflows that need compliance sign-off. Referenced in "Who it is for" as the auditable spine for heavily regulated work.

Checkpoint / checkpointer. A snapshot of the graph's state at a particular superstep. The checkpointer persists state to memory, SQLite, or Postgres, so a paused or crashed graph can resume from where it stopped without restarting.

Conditional edge. An edge whose target depends on the current state. Used to route a workflow into different paths at runtime, for example: valid claim goes to auto-process, malformed claim goes to human review.

"Crew" (CrewAI). CrewAI's term for a group of agents that play distinct roles (Researcher, Writer, Reviewer) and delegate work to each other. A higher-level abstraction than "set of nodes in a graph".

Edge. A connection between two nodes that says "after this node finishes, the next one runs". Edges can be fixed (always go from A to B) or conditional (pick the next node based on the current state).

Graph. In computing, a structure made of nodes (the formal graph-theory term is "vertex"; LangGraph and most everyday usage say "node") connected by edges. Each edge represents a possible step or relationship between two nodes. LangGraph uses graphs to describe the shape of agent workflows: nodes do the work, edges decide what runs next.

Human-in-the-loop. A workflow that pauses for a real person to approve, reject, or correct something before continuing. The framework has to be able to persist its state and resume after the pause.

MapReduce. Google's earlier framework for processing huge datasets by splitting work into many small "map" tasks that emit key-value pairs, then "reduce" tasks that combine them. The thing Pregel was designed not to be.

Node. A single unit of work in a graph. In LangGraph, a node is a function that reads from and writes to the shared state. Each node typically does one thing well (classify the input, extract fields, validate against rules, decide what to do next).

Peer dependencies. Packages a library expects you to install alongside it, separate from its own bundled dependencies. LangGraph expects @langchain/core (or its Python equivalent) as a peer.

Pregel. Google's 2009 graph-processing system. Introduced the vertex-centric Bulk Synchronous Parallel model that LangGraph applies for its deterministic superstep execution.

State. The shared data structure that flows through every node in the graph. In LangGraph the state is typed; every node receives it as input and returns a partial update. The framework merges updates between supersteps (defined under Pregel above).

StateGraph. LangGraph's central abstraction: a typed graph where nodes are functions that operate on the shared state and edges (including conditional ones) define the flow.

Streaming. The model emits tokens as it generates them, rather than waiting until the full answer is ready. Users see progress; UIs feel responsive.

Tool use / tool calling. When the LLM decides which function to call from a list you provide, and with what arguments. The function runs, the result goes back to the model, the loop continues. Tools are how an agent does anything beyond producing text.

Type-first (Pydantic AI). Frameworks that lean on the language's type system (Pydantic in Python; TypeScript types in JS) to validate inputs and outputs of model calls automatically. Less ceremony, fewer runtime surprises.

Vendor-official. A framework published by the organisation that makes the underlying model, e.g. OpenAI's Agents SDK for OpenAI models. Easy to start with; tighter coupling to one vendor.

References

External links cited in this review, grouped for easy lookup.

LangGraph itself

Design inspirations

Notable alternatives discussed in the landscape section

Download figures (poster and landscape charts)

All download numbers are 30-day rolling counts as of publication, rounded; GitHub stars are likewise point-in-time. A framework's download total sums its Python (PyPI) and JavaScript (npm) packages where it ships both; single-runtime frameworks are counted once.

Framework	Downloads (30d)	How it is counted	Stars
LangGraph	~62M	~52.3M `langgraph` (PyPI) + ~9.7M `@langchain/langgraph` (npm)	33.2k
Vercel AI SDK	~55.4M	`ai` (npm, JS only)	24.5k
Pydantic AI	~41M	`pydantic-ai` (PyPI, Python only)	17.4k
OpenAI Agents SDK	~35.5M	~32.2M `openai-agents` (PyPI) + ~3.4M `@openai/agents` (npm)	26.7k
CrewAI	~12.3M	`crewai` (PyPI, Python only)	52.3k
Mastra	~3.9M	`@mastra/core` (npm, JS only)	24.4k
AutoGen	~0.9M	`pyautogen` (PyPI, Python only)	58.5k
n8n	~0.36M	`n8n` (npm, JS only)	190.1k

n8n's download figure understates real usage heavily: it is run mostly as a self-hosted Docker image or via n8n Cloud, neither of which shows up in npm download counts. Its star count (190.1k) is a better proxy for its reach.

Sources:

langgraph on pypistats.org
pydantic-ai on pypistats.org
openai-agents on pypistats.org
crewai on pypistats.org
pyautogen on pypistats.org
@langchain/langgraph on npm, ai on npm, @openai/agents on npm, @mastra/core on npm, n8n on npm (npm reports weekly downloads; the monthly figure is the npm registry's 30-day last-month range)
GitHub stars are each repo's stargazers_count at publication: LangGraph, Vercel AI SDK, Pydantic AI, OpenAI Agents SDK, CrewAI, Mastra, AutoGen, n8n

Download counts and star counts move daily, so treat these as a point-in-time snapshot rather than live figures.

Security disclosures referenced

CVE-2025-64439: remote-code-execution in langgraph-checkpoint's JsonPlusSerializer "json" mode, disclosed 5 November 2025
CVE-2025-67644: SQL-injection in the LangGraph SQLite checkpoint backend

Companion demo

GoldenPassport/automation-review-examples (runnable hands-on code for every review in the series)