foretop

117 API operations with no declared telemetry config found in Langfuse

The same five checks, pointed at a service rather than a library — the open-source LLM observability platform a great many LangChain apps are already wired into. The answers come back almost inverted: the checks that don't apply to a library carry most of the weight here, and the ones that did the work on LangChain have nothing to say about this one.

117
API operations checked
3,036
route/signal cells missing coverage
11
confidently actionable model references
8
subprocessors baselined
Repository
langfuse/langfuse
Commit
431d5bad4bd9ac42df86175c68756ab9455a84a3
Subject
fix(web): remove dead markdown toggle, tabs inset and badge polish (#17446)
Scanned
2026-09-16 · 3,233 source files

This is an independent analysis of a public repository. Foretop is not affiliated with or endorsed by the repository owner.

Keep scan history in Foretop Hub — free for 3 repositories

What Ebb, telltale, charter and lading found

Ebb, telltale, charter and lading are the checks you can install and re-run yourself today. Each one's scope, its result, and — below — every source it matched.

Each installable check's scope and result for this repository
CheckScopeResultsOutcome
ebb whole repo 2,122 Model IDs matched against the bundled retirement registry.
telltale web/public/generated/api/openapi.yml 3,036 117 documented operations checked against every Prometheus alert rule, OTel Collector pipeline and Grafana dashboard committed to this repo.
charter repo root — No .mcp.json or .cursor/mcp.json in the repo — no agent configuration is declared here, so there is nothing to hold a capability baseline against.
lading repo root — No uv.lock anywhere in the repo. Langfuse is TypeScript (3,228 .ts files against 5 .py), and lading reads uv.lock only — a documented gap in the tool, not a clean bill of health for the dependency tree.

Every result, grouped and filterable

Deduplicated into real issue groups, never one row per raw occurrence. Filter by check, deadline, provider or context, or search — every filter is reflected in the URL, so a filtered view is a link you can share.

No telemetry configuration (Prometheus alert rules, an OTel Collector config, or a Grafana dashboard) is declared in this repository, so nothing here alerts on or dashboards these routes. They are not untraced, though: this repository registers @opentelemetry/instrumentation-http at web/src/observability.config.ts:120, which emits a server span per request, so trace coverage is reported as unknown rather than absent.

7 issue groups across 80 occurrences · 5,166 scanned

Act now gemini-pro Act now · retired 2025-02-18 · configuration reference 15 occurrence(s)
Act now gpt-5-codex Act now · retired 2026-07-23 · configuration reference 8 occurrence(s)
Act now o3-deep-research Act now · retired 2026-07-23 · configuration reference 8 occurrence(s)
Every occurrence in this group, with its exact evidence link
ContextEvidenceExcerpt
configuration.github/workflows/ci-runtime-analyst.lock.yml:872:2475o3-deep-research
configuration.github/workflows/ci-runtime-analyst.lock.yml:872:2583o3-deep-research
configuration.github/workflows/ci-runtime-analyst.lock.yml:1475:2202o3-deep-research
configuration.github/workflows/ci-runtime-analyst.lock.yml:1475:2318o3-deep-research
configuration.github/workflows/dependabot-security-maintainer.lock.yml:906:2475o3-deep-research
configuration.github/workflows/dependabot-security-maintainer.lock.yml:906:2583o3-deep-research
configuration.github/workflows/dependabot-security-maintainer.lock.yml:1490:2202o3-deep-research
configuration.github/workflows/dependabot-security-maintainer.lock.yml:1490:2318o3-deep-research
Act now o4-mini-deep-research Act now · retired 2026-07-23 · configuration reference 8 occurrence(s)
Every occurrence in this group, with its exact evidence link
ContextEvidenceExcerpt
configuration.github/workflows/ci-runtime-analyst.lock.yml:872:2503o4-mini-deep-research
configuration.github/workflows/ci-runtime-analyst.lock.yml:872:2610o4-mini-deep-research
configuration.github/workflows/ci-runtime-analyst.lock.yml:1475:2232o4-mini-deep-research
configuration.github/workflows/ci-runtime-analyst.lock.yml:1475:2347o4-mini-deep-research
configuration.github/workflows/dependabot-security-maintainer.lock.yml:906:2503o4-mini-deep-research
configuration.github/workflows/dependabot-security-maintainer.lock.yml:906:2610o4-mini-deep-research
configuration.github/workflows/dependabot-security-maintainer.lock.yml:1490:2232o4-mini-deep-research
configuration.github/workflows/dependabot-security-maintainer.lock.yml:1490:2347o4-mini-deep-research
Act now claude-3-5-haiku-20241022 Act now · retired 2026-02-19 · configuration reference 4 occurrence(s)
Every occurrence in this group, with its exact evidence link
ContextEvidenceExcerpt
configuration.github/workflows/claude-code-security-review.yml:57:24claude-3-5-haiku-20241022
unknownpackages/shared/src/server/llm/types.ts:406:3claude-3-5-haiku-20241022
historical_catalogworker/src/constants/default-model-prices.json:1915:18claude-3-5-haiku-20241022
historical_catalogworker/src/constants/default-model-prices.json:1916:41claude-3-5-haiku-20241022
Act now claude-opus-4-1-20250805 Act now · retired 2026-08-05 · configuration reference 3 occurrence(s)
Every occurrence in this group, with its exact evidence link
ContextEvidenceExcerpt
configuration.github/workflows/claude-code-security-review.yml:68:24claude-opus-4-1-20250805
unknownpackages/shared/src/server/llm/types.ts:399:3claude-opus-4-1-20250805
historical_catalogworker/src/constants/default-model-prices.json:3389:18claude-opus-4-1-20250805
Act now gemini-2.0-flash Act now · retired 2026-06-01 · configuration reference 34 occurrence(s)
Every occurrence in this group, with its exact evidence link
ContextEvidenceExcerpt
configurationpackages/shared/scripts/seeder/utils/framework-traces/google-adk-2025-08-28.json:84:35gemini-2.0-flash
configurationpackages/shared/scripts/seeder/utils/framework-traces/google-adk-2025-08-28.json:89:22gemini-2.0-flash
configurationpackages/shared/scripts/seeder/utils/framework-traces/google-adk-2025-08-28.json:176:22gemini-2.0-flash
configurationpackages/shared/scripts/seeder/utils/framework-traces/google-adk-2025-08-28.json:234:29gemini-2.0-flash
configurationpackages/shared/scripts/seeder/utils/framework-traces/google-adk-2025-08-28.json:337:16gemini-2.0-flash
configurationpackages/shared/scripts/seeder/utils/framework-traces/google-adk-2025-08-28.json:350:18gemini-2.0-flash
configurationpackages/shared/scripts/seeder/utils/framework-traces/google-adk-2025-08-28.json:448:35gemini-2.0-flash
configurationpackages/shared/scripts/seeder/utils/framework-traces/google-adk-2025-08-28.json:453:22gemini-2.0-flash
configurationpackages/shared/scripts/seeder/utils/framework-traces/google-adk-2025-08-28.json:519:22gemini-2.0-flash
configurationpackages/shared/scripts/seeder/utils/framework-traces/google-adk-2025-08-28.json:553:29gemini-2.0-flash
configurationpackages/shared/scripts/seeder/utils/framework-traces/google-adk-2025-08-28.json:651:16gemini-2.0-flash
configurationpackages/shared/scripts/seeder/utils/framework-traces/google-adk-2025-08-28.json:664:18gemini-2.0-flash
unknownpackages/shared/src/server/llm/types.ts:431:3gemini-2.0-flash
unknownpackages/shared/src/server/llm/types.ts:456:3gemini-2.0-flash
test_fixtureweb/src/components/design-system/SelectInput/SelectInput.stories.tsx:52:20gemini-2.0-flash
test_fixtureworker/src/__tests__/chatml/adapters/gemini.test.ts:200:16gemini-2.0-flash
test_fixtureworker/src/__tests__/chatml/framework-traces/google-adk-2025-08-28.trace.json:90:18gemini-2.0-flash
test_fixtureworker/src/__tests__/chatml/framework-traces/google-adk-2025-08-28.trace.json:144:18gemini-2.0-flash
test_fixtureworker/src/__tests__/chatml/framework-traces/google-adk-2025-08-28.trace.json:325:30gemini-2.0-flash
test_fixtureworker/src/__tests__/chatml/framework-traces/google-adk-2025-08-28.trace.json:327:16gemini-2.0-flash
test_fixtureworker/src/__tests__/chatml/framework-traces/google-adk-2025-08-28.trace.json:362:160gemini-2.0-flash
test_fixtureworker/src/__tests__/chatml/framework-traces/google-adk-2025-08-28.trace.json:362:432gemini-2.0-flash
test_fixtureworker/src/__tests__/chatml/framework-traces/google-adk-2025-08-28.trace.json:362:1961gemini-2.0-flash
test_fixtureworker/src/__tests__/chatml/framework-traces/google-adk-2025-08-28.trace.json:362:2952gemini-2.0-flash
test_fixtureworker/src/__tests__/chatml/framework-traces/google-adk-2025-08-28.trace.json:380:30gemini-2.0-flash
test_fixtureworker/src/__tests__/chatml/framework-traces/google-adk-2025-08-28.trace.json:382:16gemini-2.0-flash
test_fixtureworker/src/__tests__/chatml/framework-traces/google-adk-2025-08-28.trace.json:417:160gemini-2.0-flash
test_fixtureworker/src/__tests__/chatml/framework-traces/google-adk-2025-08-28.trace.json:417:432gemini-2.0-flash
test_fixtureworker/src/__tests__/chatml/framework-traces/google-adk-2025-08-28.trace.json:417:1687gemini-2.0-flash
test_fixtureworker/src/__tests__/chatml/framework-traces/google-adk-2025-08-28.trace.json:417:2377gemini-2.0-flash
test_fixtureworker/src/__tests__/chatml/integration.test.ts:252:14gemini-2.0-flash
test_fixtureworker/src/__tests__/chatml/integration.test.ts:303:14gemini-2.0-flash
historical_catalogworker/src/constants/default-model-prices.json:2897:18gemini-2.0-flash
historical_catalogworker/src/constants/default-model-prices.json:2898:43gemini-2.0-flash

Who else processes your data

undertow is the one check here that never looks at a repository. It reads the vendor's own published subprocessor page and turns it into a structured list you can diff on the next run — 8 entries, extracted from the live page.

Requested
https://langfuse.com/security/subprocessors
Resolved to
https://clickhouse.com/legal/agreements/langfuse-subprocessors

The URL is Langfuse's own. It now redirects to ClickHouse's legal site, which is the finding: ClickHouse acquired Langfuse, so the legal entity processing data ingested into Langfuse Cloud changed. A redirect is exactly the kind of quiet change a screenshot diff would show as noise and a person would skim past.

Subprocessors8 listed
SubprocessorServiceRegionEffective
Amazon Web Services (AWS) Cloud hosting and infrastructure provider Customer Selected 2026-08-10
AWS Bedrock Generative AI services Same as Customer Selected Location for Cloud Provider 2026-08-10
Salesforce, Inc. Customer support case management, messaging services (Slack) United States of America 2026-08-10
Pylon Labs, Inc. Customer support chat platform United States of America 2026-08-10
Google LLC (Workspace) Email and office applications United States of America 2026-08-10
Waypoint Tech Inc. Support knowledge management United States of America 2026-08-10
Github, Inc. Support escalations United States of America 2026-08-10
kapa.ai, Inc. Support deflection with AI United States of America 2026-08-10

And the 1,005 we could not answer

1,005 of ebb's 2,122 results are ?unknown — model strings that are real references but are not in the retirement registry, so no deadline can be claimed for them. They are reported as unknown, not quietly dropped and not counted as clear. They are visible in the Review tab above, not hidden below the fold.

If a tool showed you only the 1,117 it could resolve and said nothing about the other 1,005 strings it walked past, you would have no way to know the difference between "checked and fine" and "never looked".

The same five checks, elsewhere

What a suite is for: the answers come back in a different shape for every codebase, and which checks have nothing to say is itself information.

LangChain — 1 model migration found in LangChain · AutoGPT — 286 dependencies found in AutoGPT · nuxt.com — 3 declared MCP servers found in nuxt.com · the CZI data portal — 4 MCP servers with elevated access found in the CZI data portal

Preview: what Undertow observed

Undertow is still in development. It is not publicly installable, and nothing below can be reproduced by a reader today — it is shown because a check that cannot see something has to say so, including here. Ebb, telltale, charter and lading, above, are all available now.

In-development checks and what each observed
CheckScopeObservationsOutcome
undertow langfuse.com/security/subprocessors 8 One real vendor page, fetched live and extracted into a structured subprocessor list.

Run it on yours

Same command, same registry, no account and no upload — detection is local and only results ever leave your machine.

Results above are a snapshot at commit 431d5ba, taken 2026-09-16. Both projects move quickly; re-running it today may return something different, which is rather the point.