Skip to content

2026-06-24_Langflow-Sovereign-Rruntime

Choose a tag to compare

View all tags
@CyberStrategy1 CyberStrategy1 released this 24 Jun 14:06
· 245 commits to main since this release
2026-06-24_Langflow-Sovereign-Rruntime
8d9314e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

🔐 Announcing: Langflow Sovereign Runtime — AI SAFE2 v3.0

The First Enforcement Package That Defends a Visual DAG Builder — From Outside the DAG

Cyber Strategy Institute | June 2026

examples/langflow-sovereign-runtime is live. 21/21 passing. Introducing a
new defense architecture for a platform that can't be defended the conventional way.

▶ View the package →

The Architectural Problem

Every other sovereign runtime in this series — Make.com, xAI/Grok, Lovable,
Manus, Cursor — defends a platform that has a Python execution boundary you
can wrap, a hook you can intercept, or a callback you can install.

Langflow doesn't. It's a visual DAG builder. Nodes execute internally.
There is no Python callback. There is no hook.

The conventional defense pattern doesn't apply.

The New Pattern: External Proxy + Inline DAG Node

We ship two enforcement layers because one isn't enough:

Layer 1 — External API Proxy:
Scans every request before it reaches Langflow's HTTP endpoints.
Blocks injection at the webhook surface, tweaks field exploits, global
variable header attacks, and knowledge document poisoning — before they
ever touch the Langflow server.

Layer 2 — Inline DAG Node:
safe2_guardian_component.py drops directly into Langflow flows
as a CustomComponent between data-fetching nodes and Agent nodes.
It intercepts the LF-COMP surface — injection traveling multiple
DAG hops — from within the flow itself.

External Client → [AI SAFE2 Proxy] → Langflow → [DAG: URLFetcher → AI SAFE2 Guardian → Agent]

The Surface That Changes Everything: LF-MCP

From Langflow's live documentation, confirmed June 2026:

"When you create a Langflow project, Langflow automatically adds the project
to your MCP server's configuration and makes the project's flows available
as MCP tools."

LANGFLOW_ADD_PROJECTS_TO_MCP_SERVERS defaults to True.

Combined with LANGFLOW_AUTO_LOGIN=true (also common in development setups),
you get an unauthenticated MCP server exposing all your flows as tools to any
connected MCP client — including Claude, ChatGPT, and any other LLM you've
connected to MCP. This is the highest-blast-radius default configuration
in the entire sovereign runtime series.

Two environment variables fix it:

LANGFLOW_ADD_PROJECTS_TO_MCP_SERVERS=false
LANGFLOW_AUTO_LOGIN=false

The runtime validates this on startup via scan_mcp_config().

What the Test Caught (Honest Disclosure)

T1-05 failed on the first run. LF-MCP.NOALLOWLIST was initially flagged as
HIGH severity — which didn't trigger the raise in the scan method (which
only raised on CRITICAL). The severity was correctly elevated to CRITICAL
after review: auto-exposing all flows with no allowlist is a full-account
blast-radius event, not a minor configuration advisory. Fixed before shipping.

That's the methodology working.

21/21 Passing

PYTHONPATH=enforcement python3 smoke_test.py

# === TIER 1: Langflow-Specific Attack Surfaces ===
#   ✓  T1-01 LF-WHK IPI in webhook payload (async background run) blocked
#   ✓  T1-02 LF-RUN tweaks override system_prompt with code injection blocked
#   ✓  T1-03 LF-GVAR LANGFLOW_DATABASE_URL redirect via header blocked
#   ✓  T1-04 LF-KNOW injection in RAG knowledge document blocked
#   ✓  T1-05 LF-MCP auto-expose without project allowlist blocked
#   ✓  T1-06 LF-FLOW CustomComponent with subprocess blocked
#   ✓  T1-07 LF-INST IPI in agent system_prompt blocked
# ... T2 + T3 ...
# TOTAL: 21/21 -- SOVEREIGN BASELINE VERIFIED

AI SAFE2 Controls Enforced

P1.T1.2 P1.T1.5 P1.T1.9 P1.T1.10 P1.T1.4_ADV
P1.T2.5 S1.3 S1.5 S1.6 P2.T3.1
A2.5 M4.5 E5.1 CP.4

All verified against live AI SAFE2 v3.0 framework. All surfaces verified
against live Langflow documentation. Zero fabricated controls.

Complete Sovereign Runtime Series

Runtime Unique Architecture Status
make-sovereign-runtime Visual module chain ✅ Released
xai-grok-sovereign-runtime CLI + multi-agent ✅ Released
lovable-sovereign-runtime Build + deploy + DB ✅ Released
manus-sovereign-runtime Persistent VM + browser ✅ Released
cursor-sovereign-runtime IDE + cloud VM ✅ Released
langflow-sovereign-runtime Visual DAG builder ✅ This release

All six share one NEXUS kernel. One Love Score across your entire agentic stack.

Built by The Architect — Cyber Strategy Institute
"Engineered Certainty for the Agentic Age."

Assets 2
Loading