Middleware integrations

Browse available middleware for different providers or contribute your own to the ecosystem. Learn more about how middleware works in the middleware overview and how to use middleware with Deep Agents in the Deep Agents docs.

Integration components

• Typical retrieval flow: Document loaders → Text splitters → Embedding models → Vector stores → Retrievers → Chat models
• Agent capabilities: Tools, Middleware (this page)
• Execution and state: Sandboxes, Backends, Checkpointers, Stores

Share your middleware

Middleware enables context engineering, harness customization, and runtime safety controls. It is a useful extension point in LangChain and we love highlighting what the community builds with it:

Featured integrations

Provider	Middleware available	Source	Downloads
OpenAI middleware	Content moderation, model routing, and tool-risk gating	langchain-ai/langchain
Anthropic middleware	Prompt caching, bash tool, text editor, memory, and file search	langchain-ai/langchain
AWS middleware	Prompt caching and AgentCore Payments	langchain-ai/langchain-aws, aws/bedrock-agentcore-sdk-python
Microsoft Foundry middleware	Text moderation, image moderation, prompt shield, protected material, and groundedness	langchain-ai/langchain-azure
NVIDIA middleware	Model routing and Nemotron 3 Ultra harness optimization	langchain-ai/langchain-nvidia, langchain-ai/deepagents	N/A

All middleware

Provider	Middleware available	Source	Downloads
OpenAI middleware	Content moderation, model routing, and tool-risk gating	langchain-ai/langchain
Anthropic middleware	Prompt caching, bash tool, text editor, memory, and file search	langchain-ai/langchain
AWS middleware	Prompt caching and AgentCore Payments	langchain-ai/langchain-aws, aws/bedrock-agentcore-sdk-python
Microsoft Foundry middleware	Text moderation, image moderation, prompt shield, protected material, and groundedness	langchain-ai/langchain-azure
CopilotKit	CopilotKit middleware and FastAPI bridge for Deep Agents, create_agent graphs, AG-UI, and the React and runtime clients	CopilotKit/CopilotKit
Tenuo	Task-scoped authorization for LangChain agents that limits each task to the tools, argument values and time it needs, enforced before execution, with delegated agents receiving a subset of the parent's permissions.	tenuo-ai/tenuo
ISNAD	Claim-level provenance and trust grading for agent outputs. Grades every transmitter in a claim's chain (source, scraper, model) in a living registry, caps the chain at its weakest link, and quarantines fabricated (mawḍūʿ) chains—with a tamper-evident audit trail.	alizahidraja/isnad
Deep Agents Graph Memory	Graph context middleware and tools for Deep Agents that record and recall workflow findings using embedded LadybugDB.	TahaK29/deepagents-graph-memory
attenu-guard	Per-agent permission enforcement on every tool call and subagent handoff through wrap_tool_call (a subagent's permissions are a computed subset of its parent's), with a hash-chained audit log verified offline	attenu-io/attenu-guard
Highflame	Runtime AI security guardrails (prompt injection, PII/DLP, content safety) applied as middleware via Highflame Shield (OWASP LLM Top 10).	highflame-ai/highflame-sdk
LLMSlimToolOutputMiddleware	Agent middleware that shortens long tool results once, before the model first sees them, so later model calls resend identical bytes. Local, no model call.	Thanatos9404/llmslim
PIIAnonymizationMiddleware	Protect personal data (PII) in prompts, tool calls, and agent conversations. Hides sensitive values from the model, then restores the real values in the reply and at the tool boundary, so tools and the user still get the real data. Pluggable regex, NER, and LLM detectors, thread-consistent tokens, and token-by-token streaming restoration.	Athroniaeth/piighost
TracekitMiddleware	Tracekit asks a separate signer to allow, deny or hold each agent tool call for a person before it runs, and records every call and result in a signed, hash-chained log that can be verified offline.	Cygnux-Labs/Tracekit
Vulnify	Runtime authorization for tool calls with ALLOW, REVIEW, or BLOCK decisions, risk scores, optional human approval, and error ToolMessages for blocked calls.	vulnify/vulnify-sdk-python
Cisco AI Defense	Runtime security inspection	cisco-ai-defense/ai-defense-langchain-middleware
prompt-shield	Runtime prompt-injection firewall. Scans inputs, tool results, and outputs across detectors and output scanners with block, flag, and log modes.	mthamil107/prompt-shield
SRARiskGateMiddleware	Checks stablecoin payment tool calls before they run and holds or rejects those that break spend, recipient, or asset rules.	sriram1983007-dev/langchain-sra-riskgate
xaidr	In-process runtime security sensor for AI agents. LangChain middleware covering input, tool-call, and output boundaries for prompt injection, jailbreak, DLP, and A2A-protocol scanning.	delphisecurity/xaidr
compact-middleware	Claude Code's compaction engine as LangChain middleware. Multi-level context compaction for long-running agents.	emanueleielo/compact-middleware
GoAT	langgraph-goat records candidate plans, scores, and why each was chosen or rejected as a LangGraph agent plans, then renders a natural-language explanation for debugging and end-user transparency.	Samsung/langgraph-goat
NeuralTrust TrustGuard	TrustGuard evaluate middleware. Allow, block, report, or transform agent input, model output, and optional tool traffic.	NeuralTrust/langchain-neuraltrust
OpenBox	Real-time governance for LangGraph and Deep Agents. Policies, guardrails, HITL, OTel hook governance, and behavior rules.	OpenBox-AI/openbox-langgraph-sdk-python
ScaleDown middleware	Conversation summarization, context and tool result compression, and structured extraction	scaledown-team/langchain-scaledown
SeekritCredentials	Scopes secrets per model call and per tool call. Credentials stay as placeholders in agent code and are substituted at the HTTP boundary against a default-deny allowlist, so an unlisted tool cannot reach a credential.	seekritdev/python-sdk
Pydantic Monty Code Interpreter	Provides Code Interpretation inside Pydantic's Monty Runtime	langchain-monty
ProvaredMiddleware	Checks each tool call through wrap_tool_call against a passkey-signed permission, runs the tool only if allowed, and writes a signed, hash-chained receipt that can be verified offline.	provared/provared
SubmilliMiddleware	Code-mode middleware that runs agent-written TypeScript programs on submilli-server under a policy and can call the agent's own tools.	submilli/submilli-python
Nuggets Authority	Pre-execution authority enforcement for tool calls. Verifies a scoped, signed delegation before each tool runs, fails closed on deny, and emits an independently verifiable cryptographic proof of every decision.	NuggetsLtd/langchain-nuggets
langchain-runcycles	Pre-execution budget authority for model calls, tool calls, and agent loops	runcycles/langchain-runcycles
ACGSMiddleware	Checks each agent tool call against ACGS constitution rules before it runs; blocked calls are denied, and review rules pause the agent.	acgs-ai/langchain-acgs
PromptFirewallHandler	Sub-millisecond PII detection and prompt injection firewall for LangChain. Zero network, zero GPU, pure Rust core via PyO3.	TimurRakhmatullin86/langchain-promptfirewall
langchain-router	Phase-based model routing. Routes execution turns to a fast model, keeps the primary for planning and recovery.	johanity/langchain-router
TealTiger	Deterministic governance middleware. Policy enforcement, cost limits, tool allowlisting, FREEZE rules, and SARIF audit evidence with no LLM in the governance path.	agentguard-ai/tealtiger
langchain-task-steering	Implicit state-machine middleware for ordered task pipelines with per-task tool scoping, dynamic prompt injection, and composable completion validation.	edvinhallvaxhiu/langchain-task-steering
MeragptDecider	Typed decisions (yes/no, choice, score) with calibrated probabilities from meraGPT Decider 1, as a Runnable, a tool, and agent middleware.	Sandeep85Das/langchain-meragpt
BastionGuardrailMiddleware	Prompt-injection and jailbreak detection. Screens user input and tool results, including indirect injection through retrieved content, before the model runs. Runs locally on your own hardware.	bastion-soft/bastion-prompt-protection
TurnWindowMiddleware	Cross-provider LangChain agent middleware that retains the most recent human-anchored conversation turns before each model call while keeping tool-call and tool-result messages together.	bharatkhanna-dev/langchain-turn-window
Wity	Fixed-option questions about text in one pass, with a probability per option, for model routing, tool-risk checks, and classification.	info-alphanimble/langchain-wity
advisor-middleware	Claude Code's advisor pattern as LangChain middleware. Pairs a fast executor model with a powerful advisor model that intervenes only on critical decisions.	emanueleielo/advisor-middleware
DynamicToolSelectorMiddleware	Drop-in agent middleware providing sub-100ms hybrid dense and sparse vector tool retrieval over zvec. Eliminates prompt token overhead by >80% and outperforms LLM-based tool selection on Berkeley Function Calling Leaderboard (BFCL) benchmarks.	RauhanAhmed/langchain-dynamic-tools-middleware
ATLTaskMiddleware	Automatic task-time routing to executable MCP and provider capabilities, with failure redecision and outcome reporting.	wenhua6666668-oss/langchain-agenttrafficlab
LoopGrid	Native LangChain AgentMiddleware for signed decision evidence, policy enforcement, human approval, and guarded tool execution through LoopGrid Core.	loopgridio/loopgrid-langchain
RecallChatMessageHistory	Chat message history stored in a Recall session, so Recall also learns about the user from it.	recallmem/recall
RecallMiddleware	Long-term memory for create_agent agents: adds what Recall learned about the user to the system prompt and records each exchange.	recallmem/recall
langchain-collapse	Preventive context management. Collapses consecutive tool-call groups before they fill the context window.	johanity/langchain-collapse
RelayShield	Mandatory pre-execution gate that blocks connect_mcp_server and install_mcp_package tool calls when RelayShield reports risk.	nzdsf2-gif/langchain-relayshield
Tessera	Signed trust labels and taint-tracking that gate tool calls when context contains untrusted segments.	kenithphilip/Tessera
MaskflowReversibleAnonymizer	Reversible PII anonymizer / deanonymizer, a drop-in for langchain-experimental's Presidio anonymizer (same .anonymize / .deanonymize / .deanonymizer_mapping and JSON/YAML save-load). Adds the Indian identifiers most tools miss (Aadhaar, PAN, GSTIN, UPI, IFSC, ABHA, names, addresses), a streaming-aware deanonymizer Runnable, and an optional leak-guard callback that fails a call closed if PII reaches the model.	maskflow/maskflow
CTRLRunMiddleware	Policy-gated tool calls through wrap_tool_call: a refused call never reaches the tool and the model is told which rule refused it; an effect key executes at most once across processes sharing a store; a tool that raises leaves the effect unresolved rather than retried; an approve decision holds the call for a person; a receipt for every decision, refusals included.	CTRLRun/ctrlrun
DeepKeep middleware	DeepKeep AI Firewall pre-moderation and post-moderation for LangChain agents.
AxioRank	Security gateway for AI agents: score tool calls and model turns against policy with allow, deny, and redact.	AxioRank/langchain-axiorank
langchain-pop	Portable persona loading, legacy migration, and boundary-aware tool filtering for LangChain agents.	joy7758/persona-object-protocol
langchain-distil	Reversible, certified context compression. Digests large tool outputs and message history before the model call (tool and function messages reversibly, human and system losslessly, the model messages never rewritten), with byte-exact recovery of every digest. Decision-equivalence between compressed and full context is certified offline by a statistical non-inferiority gate.	dshakes/distil
OWASP Agent Memory Guard	Runtime defense against AI agent memory poisoning (OWASP ASI06). Scans messages, model responses, and tool outputs locally with block, warn, and strip modes.	OWASP/www-project-agent-memory-guard
comply54	Runtime compliance enforcement for AI agents under African data protection and financial-sector regulations (deny, escalate, audit, or allow).	comply54/langchain-comply54
NoPII	Runtime PII tokenization. Detects personal data in outbound prompts, replaces it with deterministic vault tokens before the request reaches the LLM, and restores the original values in the response.	Enigma-Vault/NoPII
text2sql-framework	Replaces RAG with recursive tool use: the agent explores, writes, tests, and self-corrects using one execute_sql tool.	Text2SqlAgent/text2sql-framework
DNS-AID	DNS-based agent discovery via the DNS-AID protocol. Auto-publishes agents on startup, auto-unpublishes on shutdown, and provides discovery tools.	IngmarVG-IB/langchain-dns-aid
langgraph-state-machine	Section-based flow control for LangGraph React agents. Divides conversations into discrete phases with scoped tools, prompts, auto-transitions, branching, and optional per-section LLM override.	mahmoud661/langgraph-state-machine
VecrContextCompressor	Deterministic LLM context compression with a regex retention whitelist for structured tokens before the model call.	h2cker/vecr
ATR Guardrail	Runtime detection of prompt injection, tool poisoning, and unsafe tool calls using Agent Threat Rules. Halts the agent or blocks the tool call on a critical finding and keeps an audit trail.	Agent-Threat-Rule/agent-threat-rules	N/A
eager-tools	Reduces agent wall-clock latency by dispatching each tool call the moment its streaming block closes, overlapping tool execution with LLM generation.	cloudthinker-ai/eager-tools	N/A
Haldir	Governance layer for LangChain agents with scoped sessions, encrypted secrets, hash-chained audit, and policy enforcement.	ExposureGuard/haldir	N/A
NVIDIA middleware	Model routing and Nemotron 3 Ultra harness optimization	langchain-ai/langchain-nvidia, langchain-ai/deepagents	N/A