1 model migration found in LangChain
We pointed all five checks at a real, public, extremely well-maintained repository and published everything they returned — including the two that don't apply to a library shaped like this one, and why not. Every row links to the source at the exact commit, and to the exact line when the scanner reports one. Nothing here is illustrative.
- Repository
- langchain-ai/langchain
- Commit
- e92c8a08bf382121cc1e95f7e75ddc8cb9c01ab0
- Subject
- fix(core): avoid mutation in google-genai standard content (#40023)
- Scanned
- 2026-09-16 · 2,552 source files
This is an independent analysis of a public repository. Foretop is not affiliated with or endorsed by the repository owner.
What Ebb, telltale, charter and lading found
Ebb, telltale, charter and lading are the checks you can install and re-run yourself today. Each one's scope, its result, and — below — every source it matched.
| Check | Scope | Results | Outcome |
|---|---|---|---|
| ebb | whole repo | 907 | Model IDs matched against the bundled retirement registry. |
| telltale | repo root | — | No OpenAPI spec at the repo root (tried openapi.yaml/.yml/.json, swagger.yaml/.yml/.json). LangChain is a library, not a service — there is no contract to compare telemetry against. |
| charter | .mcp.json | 2 | Both declared MCP servers are HTTP endpoints. Static parsing cannot say what tools they expose without launching them, so both are reported unknown rather than assumed safe. |
| lading | libs/langchain | 633 | 283 artifacts from the real uv.lock via PyPI, 228 resolved to a real licence — many of the most common Python packages (click, pydantic, numpy, pytest) report no licence at all through the live PyPI API, so a curated package-name override (verified against each real LICENSE file) covers the ones live resolution cannot. Scoped to one sub-package: LangChain has no root lockfile, six live under libs/. |
Every result, grouped and filterable
Deduplicated into real issue groups, never one row per raw occurrence. Filter by check, deadline, provider or context, or search — every filter is reflected in the URL, so a filtered view is a link you can share.
1 issue group across 22 occurrences · 1,192 scanned
Plan gpt-4 Plan · retires 2026-10-23 · invocation reference 22 occurrence(s)
And the 512 we could not answer
512 of ebb's 907 results are ?unknown — model strings that are real references but are not in the retirement registry, so no deadline can be claimed for them. They are reported as unknown, not quietly dropped and not counted as clear. They are visible in the Review tab above, not hidden below the fold.
If a tool showed you only the 395 it could resolve and said nothing about the other 512 strings it walked past, you would have no way to know the difference between "checked and fine" and "never looked".
The same five checks, elsewhere
What a suite is for: the answers come back in a different shape for every codebase, and which checks have nothing to say is itself information.
Langfuse — 117 API operations with no declared telemetry config found in Langfuse · AutoGPT — 286 dependencies found in AutoGPT · nuxt.com — 3 declared MCP servers found in nuxt.com · the CZI data portal — 4 MCP servers with elevated access found in the CZI data portal
Preview: what Undertow observed
Undertow is still in development. It is not publicly installable, and nothing below can be reproduced by a reader today — it is shown because a check that cannot see something has to say so, including here. Ebb, telltale, charter and lading, above, are all available now.
| Check | Scope | Observations | Outcome |
|---|---|---|---|
| undertow | — | — | Scans vendor subprocessor pages by URL, not repositories. Nothing in a source tree is in its scope by design. |
Run it on yours
Same command, same registry, no account and no upload — detection is local and only results ever leave your machine.
Results above are a snapshot at
commit e92c8a0, taken 2026-09-16. Both
projects move quickly; re-running it today may return something different, which is
rather the point.