117 API operations with no declared telemetry config found in Langfuse
The same five checks, pointed at a service rather than a library — the open-source LLM observability platform a great many LangChain apps are already wired into. The answers come back almost inverted: the checks that don't apply to a library carry most of the weight here, and the ones that did the work on LangChain have nothing to say about this one.
- Repository
- langfuse/langfuse
- Commit
- 431d5bad4bd9ac42df86175c68756ab9455a84a3
- Subject
- fix(web): remove dead markdown toggle, tabs inset and badge polish (#17446)
- Scanned
- 2026-09-16 · 3,233 source files
This is an independent analysis of a public repository. Foretop is not affiliated with or endorsed by the repository owner.
What Ebb, telltale, charter and lading found
Ebb, telltale, charter and lading are the checks you can install and re-run yourself today. Each one's scope, its result, and — below — every source it matched.
| Check | Scope | Results | Outcome |
|---|---|---|---|
| ebb | whole repo | 2,122 | Model IDs matched against the bundled retirement registry. |
| telltale | web/public/generated/api/openapi.yml | 3,036 | 117 documented operations checked against every Prometheus alert rule, OTel Collector pipeline and Grafana dashboard committed to this repo. |
| charter | repo root | — | No .mcp.json or .cursor/mcp.json in the repo — no agent configuration is declared here, so there is nothing to hold a capability baseline against. |
| lading | repo root | — | No uv.lock anywhere in the repo. Langfuse is TypeScript (3,228 .ts files against 5 .py), and lading reads uv.lock only — a documented gap in the tool, not a clean bill of health for the dependency tree. |
Every result, grouped and filterable
Deduplicated into real issue groups, never one row per raw occurrence. Filter by check, deadline, provider or context, or search — every filter is reflected in the URL, so a filtered view is a link you can share.
No telemetry configuration (Prometheus alert rules, an OTel Collector config, or a Grafana dashboard) is declared in this repository, so nothing here alerts on or dashboards these routes. They are not untraced, though: this repository registers @opentelemetry/instrumentation-http at web/src/observability.config.ts:120, which emits a server span per request, so trace coverage is reported as unknown rather than absent.
7 issue groups across 80 occurrences · 5,166 scanned
Act now gemini-pro Act now · retired 2025-02-18 · configuration reference 15 occurrence(s)
Act now gpt-5-codex Act now · retired 2026-07-23 · configuration reference 8 occurrence(s)
| Context | Evidence | Excerpt |
|---|---|---|
| configuration | .github/workflows/ci-runtime-analyst.lock.yml:872:2269 | gpt-5-codex |
| configuration | .github/workflows/ci-runtime-analyst.lock.yml:872:3818 | gpt-5-codex |
| configuration | .github/workflows/ci-runtime-analyst.lock.yml:1475:1974 | gpt-5-codex |
| configuration | .github/workflows/ci-runtime-analyst.lock.yml:1475:3671 | gpt-5-codex |
| configuration | .github/workflows/dependabot-security-maintainer.lock.yml:906:2269 | gpt-5-codex |
| configuration | .github/workflows/dependabot-security-maintainer.lock.yml:906:3818 | gpt-5-codex |
| configuration | .github/workflows/dependabot-security-maintainer.lock.yml:1490:1974 | gpt-5-codex |
| configuration | .github/workflows/dependabot-security-maintainer.lock.yml:1490:3671 | gpt-5-codex |
Act now o3-deep-research Act now · retired 2026-07-23 · configuration reference 8 occurrence(s)
| Context | Evidence | Excerpt |
|---|---|---|
| configuration | .github/workflows/ci-runtime-analyst.lock.yml:872:2475 | o3-deep-research |
| configuration | .github/workflows/ci-runtime-analyst.lock.yml:872:2583 | o3-deep-research |
| configuration | .github/workflows/ci-runtime-analyst.lock.yml:1475:2202 | o3-deep-research |
| configuration | .github/workflows/ci-runtime-analyst.lock.yml:1475:2318 | o3-deep-research |
| configuration | .github/workflows/dependabot-security-maintainer.lock.yml:906:2475 | o3-deep-research |
| configuration | .github/workflows/dependabot-security-maintainer.lock.yml:906:2583 | o3-deep-research |
| configuration | .github/workflows/dependabot-security-maintainer.lock.yml:1490:2202 | o3-deep-research |
| configuration | .github/workflows/dependabot-security-maintainer.lock.yml:1490:2318 | o3-deep-research |
Act now o4-mini-deep-research Act now · retired 2026-07-23 · configuration reference 8 occurrence(s)
| Context | Evidence | Excerpt |
|---|---|---|
| configuration | .github/workflows/ci-runtime-analyst.lock.yml:872:2503 | o4-mini-deep-research |
| configuration | .github/workflows/ci-runtime-analyst.lock.yml:872:2610 | o4-mini-deep-research |
| configuration | .github/workflows/ci-runtime-analyst.lock.yml:1475:2232 | o4-mini-deep-research |
| configuration | .github/workflows/ci-runtime-analyst.lock.yml:1475:2347 | o4-mini-deep-research |
| configuration | .github/workflows/dependabot-security-maintainer.lock.yml:906:2503 | o4-mini-deep-research |
| configuration | .github/workflows/dependabot-security-maintainer.lock.yml:906:2610 | o4-mini-deep-research |
| configuration | .github/workflows/dependabot-security-maintainer.lock.yml:1490:2232 | o4-mini-deep-research |
| configuration | .github/workflows/dependabot-security-maintainer.lock.yml:1490:2347 | o4-mini-deep-research |
Act now claude-3-5-haiku-20241022 Act now · retired 2026-02-19 · configuration reference 4 occurrence(s)
| Context | Evidence | Excerpt |
|---|---|---|
| configuration | .github/workflows/claude-code-security-review.yml:57:24 | claude-3-5-haiku-20241022 |
| unknown | packages/shared/src/server/llm/types.ts:406:3 | claude-3-5-haiku-20241022 |
| historical_catalog | worker/src/constants/default-model-prices.json:1915:18 | claude-3-5-haiku-20241022 |
| historical_catalog | worker/src/constants/default-model-prices.json:1916:41 | claude-3-5-haiku-20241022 |
Act now claude-opus-4-1-20250805 Act now · retired 2026-08-05 · configuration reference 3 occurrence(s)
| Context | Evidence | Excerpt |
|---|---|---|
| configuration | .github/workflows/claude-code-security-review.yml:68:24 | claude-opus-4-1-20250805 |
| unknown | packages/shared/src/server/llm/types.ts:399:3 | claude-opus-4-1-20250805 |
| historical_catalog | worker/src/constants/default-model-prices.json:3389:18 | claude-opus-4-1-20250805 |
Act now gemini-2.0-flash Act now · retired 2026-06-01 · configuration reference 34 occurrence(s)
Who else processes your data
undertow is the one check here that never looks at a repository. It reads the vendor's own published subprocessor page and turns it into a structured list you can diff on the next run — 8 entries, extracted from the live page.
- Requested
- https://langfuse.com/security/subprocessors
- Resolved to
- https://clickhouse.com/legal/agreements/langfuse-subprocessors
The URL is Langfuse's own. It now redirects to ClickHouse's legal site, which is the finding: ClickHouse acquired Langfuse, so the legal entity processing data ingested into Langfuse Cloud changed. A redirect is exactly the kind of quiet change a screenshot diff would show as noise and a person would skim past.
| Subprocessor | Service | Region | Effective |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting and infrastructure provider | Customer Selected | 2026-08-10 |
| AWS Bedrock | Generative AI services | Same as Customer Selected Location for Cloud Provider | 2026-08-10 |
| Salesforce, Inc. | Customer support case management, messaging services (Slack) | United States of America | 2026-08-10 |
| Pylon Labs, Inc. | Customer support chat platform | United States of America | 2026-08-10 |
| Google LLC (Workspace) | Email and office applications | United States of America | 2026-08-10 |
| Waypoint Tech Inc. | Support knowledge management | United States of America | 2026-08-10 |
| Github, Inc. | Support escalations | United States of America | 2026-08-10 |
| kapa.ai, Inc. | Support deflection with AI | United States of America | 2026-08-10 |
And the 1,005 we could not answer
1,005 of ebb's 2,122 results are ?unknown — model strings that are real references but are not in the retirement registry, so no deadline can be claimed for them. They are reported as unknown, not quietly dropped and not counted as clear. They are visible in the Review tab above, not hidden below the fold.
If a tool showed you only the 1,117 it could resolve and said nothing about the other 1,005 strings it walked past, you would have no way to know the difference between "checked and fine" and "never looked".
The same five checks, elsewhere
What a suite is for: the answers come back in a different shape for every codebase, and which checks have nothing to say is itself information.
LangChain — 1 model migration found in LangChain · AutoGPT — 286 dependencies found in AutoGPT · nuxt.com — 3 declared MCP servers found in nuxt.com · the CZI data portal — 4 MCP servers with elevated access found in the CZI data portal
Preview: what Undertow observed
Undertow is still in development. It is not publicly installable, and nothing below can be reproduced by a reader today — it is shown because a check that cannot see something has to say so, including here. Ebb, telltale, charter and lading, above, are all available now.
| Check | Scope | Observations | Outcome |
|---|---|---|---|
| undertow | langfuse.com/security/subprocessors | 8 | One real vendor page, fetched live and extracted into a structured subprocessor list. |
Run it on yours
Same command, same registry, no account and no upload — detection is local and only results ever leave your machine.
Results above are a snapshot at
commit 431d5ba, taken 2026-09-16. Both
projects move quickly; re-running it today may return something different, which is
rather the point.