Middleware integrations

Browse available middleware for different providers or contribute your own to the ecosystem. Learn more about how middleware works in the middleware overview and how to use middleware with Deep Agents in the Deep Agents docs. Middleware enables context engineering, harness customization, and runtime safety controls. It is a useful extension point in LangChain and we love highlighting what the community builds with it:

Add an official integration

Follow the contributing guide to build and publish a middleware package.

Share a community middleware

Open a PR to the docs repo to add your middleware to the all integrations table.

Featured integrations

Provider	Middleware available	Source
`OpenAI middleware`	Content moderation	`langchain-ai/langchain`
`Anthropic middleware`	Prompt caching, bash tool, text editor, memory, and file search	`langchain-ai/langchain`
`AWS middleware`	Prompt caching and AgentCore Payments	`langchain-ai/langchain-aws`, `aws/bedrock-agentcore-sdk-python`
`Microsoft Foundry middleware`	Text moderation, image moderation, prompt shield, protected material, and groundedness	`langchain-ai/langchain-azure`

All middleware

Provider	Middleware available	Source	Downloads
`OpenAI middleware`	Content moderation	`langchain-ai/langchain`
`Anthropic middleware`	Prompt caching, bash tool, text editor, memory, and file search	`langchain-ai/langchain`
`AWS middleware`	Prompt caching and AgentCore Payments	`langchain-ai/langchain-aws`, `aws/bedrock-agentcore-sdk-python`
`Microsoft Foundry middleware`	Text moderation, image moderation, prompt shield, protected material, and groundedness	`langchain-ai/langchain-azure`
`CopilotKit`	CopilotKit middleware and FastAPI bridge for Deep Agents, create_agent graphs, AG-UI, and the React and runtime clients	`CopilotKit/CopilotKit`
`prompt-shield`	Runtime prompt-injection firewall. Scans inputs, tool results, and outputs across detectors and output scanners with block, flag, and log modes.	`mthamil107/prompt-shield`
`compact-middleware`	Claude Code’s compaction engine as LangChain middleware. Multi-level context compaction for long-running agents.	`emanueleielo/compact-middleware`
`Highflame`	Runtime AI security guardrails (prompt injection, PII/DLP, content safety) applied as middleware via Highflame Shield (OWASP LLM Top 10).	`highflame-ai/highflame-sdk`
`langgraph-state-machine`	Section-based flow control for LangGraph React agents. Divides conversations into discrete phases with scoped tools, prompts, auto-transitions, branching, and optional per-section LLM override.	`mahmoud661/langgraph-state-machine`
`Cisco AI Defense`	Runtime security inspection	`cisco-ai-defense/ai-defense-langchain-middleware`
`langchain-runcycles`	Pre-execution budget authority for model calls, tool calls, and agent loops	`runcycles/langchain-runcycles`
`advisor-middleware`	Claude Code’s advisor pattern as LangChain middleware. Pairs a fast executor model with a powerful advisor model that intervenes only on critical decisions.	`emanueleielo/advisor-middleware`
`AxioRank`	Security gateway for AI agents: score tool calls and model turns against policy with allow, deny, and redact.	`AxioRank/langchain-axiorank`
`OpenBox`	Real-time governance for LangGraph and Deep Agents. Policies, guardrails, HITL, OTel hook governance, and behavior rules.	`OpenBox-AI/openbox-langgraph-sdk-python`
`langchain-task-steering`	Implicit state-machine middleware for ordered task pipelines with per-task tool scoping, dynamic prompt injection, and composable completion validation.	`edvinhallvaxhiu/langchain-task-steering`
`langchain-collapse`	Preventive context management. Collapses consecutive tool-call groups before they fill the context window.	`johanity/langchain-collapse`
`RelayShield`	Mandatory pre-execution gate that blocks connect_mcp_server and install_mcp_package tool calls when RelayShield reports risk.	`nzdsf2-gif/langchain-relayshield`
`langchain-router`	Phase-based model routing. Routes execution turns to a fast model, keeps the primary for planning and recovery.	`johanity/langchain-router`
`text2sql-framework`	Replaces RAG with recursive tool use: the agent explores, writes, tests, and self-corrects using one execute_sql tool.	`Text2SqlAgent/text2sql-framework`
`langchain-distil`	Reversible, certified context compression. Digests large tool outputs and message history before the model call (tool and function messages reversibly, human and system losslessly, the model messages never rewritten), with byte-exact recovery of every digest. Decision-equivalence between compressed and full context is certified offline by a statistical non-inferiority gate.	`dshakes/distil`
`Tessera`	Signed trust labels and taint-tracking that gate tool calls when context contains untrusted segments.	`kenithphilip/Tessera`
`comply54`	Runtime compliance enforcement for AI agents under African data protection and financial-sector regulations (deny, escalate, audit, or allow).	`comply54/langchain-comply54`
`NoPII`	Runtime PII tokenization. Detects personal data in outbound prompts, replaces it with deterministic vault tokens before the request reaches the LLM, and restores the original values in the response.	`Enigma-Vault/NoPII`
`OWASP Agent Memory Guard`	Runtime defense against AI agent memory poisoning (OWASP ASI06). Scans messages, model responses, and tool outputs locally with block, warn, and strip modes.	`OWASP/www-project-agent-memory-guard`
`DNS-AID`	DNS-based agent discovery via the DNS-AID protocol. Auto-publishes agents on startup, auto-unpublishes on shutdown, and provides discovery tools.	`IngmarVG-IB/langchain-dns-aid`
`Nuggets Authority`	Pre-execution authority enforcement for tool calls. Verifies a scoped, signed delegation before each tool runs, fails closed on deny, and emits an independently verifiable cryptographic proof of every decision.	`NuggetsLtd/langchain-nuggets`
`langchain-pop`	Portable persona loading, legacy migration, and boundary-aware tool filtering for LangChain agents.	`joy7758/persona-object-protocol`
`ATR Guardrail`	Runtime detection of prompt injection, tool poisoning, and unsafe tool calls using Agent Threat Rules. Halts the agent or blocks the tool call on a critical finding and keeps an audit trail.	`Agent-Threat-Rule/agent-threat-rules`	N/A
`eager-tools`	Reduces agent wall-clock latency by dispatching each tool call the moment its streaming block closes, overlapping tool execution with LLM generation.	`cloudthinker-ai/eager-tools`	N/A
`Haldir`	Governance layer for LangChain agents with scoped sessions, encrypted secrets, hash-chained audit, and policy enforcement.	`ExposureGuard/haldir`	N/A