LangChain Security Scan

Defensive scan for LangChain / LangGraph applications. Reports findings using the shared scoring schema.

Scope

• Files importing langchain*, langgraph, langchain_community, langchain_openai, langchain_anthropic
• Agent / tool / retriever / chain construction
• Custom BaseCallbackHandler implementations

Out of scope: model-specific issues (covered by per-SDK skills), vector DB infra hardening.

Procedure

1. Locate every Tool, BaseTool, @tool, agent constructor (create_react_agent, AgentExecutor, create_openai_functions_agent, LangGraph ToolNode).
2. Locate every retriever (as_retriever, MultiQueryRetriever, etc.) and trace what populates the underlying store.
3. Locate every OutputParser.
4. Apply rules below.