Lfoss 2096

[deon-sanchez]

Summary by CodeRabbit

• New Features

  • MCP Composer integration with per-project orchestration and composer URL endpoint.
  • Auto-API key auth for new/uploaded projects when auto-login is disabled.
  • Added voice_mode_available to config.
  • Revamped Knowledge Base components (ingestion/retrieval) with optional embeddings.

• Improvements

  • OS-aware SSE URLs; safer auth updates with secret masking; removed password logging.
  • Agent UI: connect external models; streamlined outputs.
  • File loader OCR selection (“None” option) and broader supported types.
  • More consistent memory message selection and conditional routing behavior.
  • Numerous clearer input labels.

• Bug Fixes

  • Ignore None-valued headers; correctly handle Data-wrapped bodies.

• Chores

  • Version 1.6.0; dependency pins updated.
  • Env var rename for MCP Composer; Windows scripts env-file handling.
  • Added ignore for temp member_servers.json.
  • Removed deprecated/legacy tools and components.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

The PR updates configuration defaults, versioning, and Windows scripts; adds MCP Composer orchestration and auth-update helpers; refactors knowledge-base components; adjusts constants and provider availability; removes deprecated Google search/Serper and prototype components; revises multiple component labels/metadata; and makes targeted data/IO, routing, and memory behavior changes.

Changes

Cohort / File(s)	Summary
Env & Packaging /.env.example, /pyproject.toml, /.gitignore	Renamed MCP composer flag and default (true→false), bumped version to 1.6.0, pinned composio deps, and ignored member_servers.json in frontend temp.
Windows Run Scripts /scripts/windows/build_and_run.bat, /scripts/windows/build_and_run.ps1	Moved --env-file to top-level uv run; simplified .env detection flagging.
Auth, MCP Composer, Projects API /src/backend/base/langflow/__main__.py, /src/backend/base/langflow/api/v1/auth_helpers.py, /src/backend/base/langflow/api/v1/mcp_projects.py, /src/backend/base/langflow/api/v1/projects.py, /src/backend/base/langflow/api/v1/schemas.py	Hid default password in logs; added handle_auth_settings_update; expanded MCP composer lifecycle (access verification, OS-aware URLs, SSE, init/start/register); enabled API-key auth paths; auto-assign API key on project create when needed; background start/stop on update; added voice_mode_available to config schema.
Build/Graph Routing /src/backend/base/langflow/api/build.py, /src/backend/base/langflow/components/logic/conditional_router.py	Included conditionally excluded vertices in build responses; added persistent branch exclusions and iteration-limit handling in ConditionalRouter.
Providers, Models, Agent UI /src/backend/base/langflow/base/models/anthropic_constants.py, /src/backend/base/langflow/base/models/model_input_constants.py, /src/backend/base/langflow/components/agents/agent.py	Deprecated claude-3-sonnet-20240229; deactivated Groq provider; updated Agent component (removed Groq/Custom, added connect_other_models path, removed structured output).
Core Constants & Misc Behavior /src/backend/base/langflow/base/constants.py, /src/backend/base/langflow/base/agents/events.py, /src/backend/base/langflow/base/data/utils.py, /src/backend/base/langflow/components/helpers/memory.py, /src/backend/base/langflow/components/processing/structured_output.py, /src/backend/base/langflow/components/data/api_request.py, /src/backend/base/langflow/components/data/url.py	Adjusted SKIPPED_COMPONENTS (unskip File components); simplified “Input” text rendering; reordered TEXT_FILE_TYPES; unified “last N” memory selection then optional reversal; build DataFrame from raw dicts; unwrap Data wrappers in API request body/list; filter None header values in URL loader.
Docling & File Loading /src/backend/base/langflow/base/data/docling_utils.py, /src/backend/base/langflow/components/docling/docling_inline.py, /src/backend/base/langflow/components/docling/docling_remote.py, /src/backend/base/langflow/components/data/file.py	OCR sentinel now "None"; removed some real_time_refresh flags; updated remote API paths/payload keys; changed File component description, extensions, OCR options/defaults, and subprocess arg mapping.
Knowledge Bases Refactor /src/backend/base/langflow/components/knowledge_bases/__init__.py, /src/backend/base/langflow/components/knowledge_bases/ingestion.py, /src/backend/base/langflow/components/knowledge_bases/retrieval.py, /src/backend/base/langflow/components/data/__init__.py	Replaced KBIngestion/KBRetrieval with KnowledgeIngestion/KnowledgeRetrieval; updated inputs/outputs and conversion; added include_embeddings; adjusted exports and lazy imports; removed old KB exports.
Removals: Deprecated Components /src/backend/base/langflow/components/tools/google_search_api.py, /src/backend/base/langflow/components/tools/google_serper_api.py, /src/backend/base/langflow/components/tools/__init__.py, /src/backend/base/langflow/components/google/google_serper_api_core.py, /src/backend/base/langflow/components/deactivated/mcp_sse.py, /src/backend/base/langflow/components/deactivated/mcp_stdio.py, /src/backend/base/langflow/components/prototypes/python_function.py, /src/backend/base/langflow/components/__init__.py	Deleted Google Search/Serper tools and Serper core, MCP SSE/stdio components, and PythonFunction prototype; removed associated exports and prototypes mapping.
Chat UI Inputs Simplification /src/backend/base/langflow/components/input_output/chat.py, /src/backend/base/langflow/components/input_output/chat_output.py	Removed color/icon-related inputs and properties propagation in ChatInput/ChatOutput.
Replacement Metadata Additions /src/backend/base/langflow/components/crewai/*, /src/backend/base/langflow/components/processing/*, /src/backend/base/langflow/components/helpers/*, /src/backend/base/langflow/components/embeddings/*, /src/backend/base/langflow/components/tools/python_*, /src/backend/base/langflow/components/logic/*, /src/backend/base/langflow/components/data/*, /src/backend/base/langflow/components/google/gmail.py, /src/backend/base/langflow/components/datastax/astra_vectorize.py, ...	Added replacement attributes and updated display names to indicate migration targets across many components; no runtime logic changes.
Datastax Mapping & Labels /src/backend/base/langflow/components/datastax/__init__.py, /src/backend/base/langflow/components/datastax/astra_db.py, /src/backend/base/langflow/components/datastax/astra_vectorize.py	Updated import path for AstraDBVectorStore; relabeled inputs; removed deprecation tag and added replacement for Vectorize component.
UI Label Updates /src/backend/base/langflow/components/*/* (Azure, Firecrawl, IBM, HuggingFace, Qdrant, Redis, Clickhouse, Elastic, OpenSearch, AgentQL, Milvus, LangWatch, LangChain Hub, etc.)	Standardized API key/password display names across components; presentation-only changes.

Sequence Diagram(s)

sequenceDiagram
    autonumber
    actor User
    participant API as Projects API
    participant Helper as handle_auth_settings_update
    participant DB as DB
    participant Composer as MCP Composer Service

    User->>API: PUT /projects/{id} (project update incl. auth_settings)
    API->>DB: Load existing project
    API->>Helper: handle_auth_settings_update(project, new_auth_settings)
    Helper-->>API: {start, stop, handle}
    API->>DB: Persist updated project
    alt start == true
        API->>Composer: register_project_with_composer(project)
        Composer-->>API: ok
    else stop == true
        API->>Composer: stop_project_composer(project_id)
        Composer-->>API: ok
    end
    API-->>User: 200 Updated

Loading

sequenceDiagram
    autonumber
    participant Client
    participant API as MCP Projects API
    participant Auth as verify_project_auth
    participant Util as should_use_mcp_composer
    participant SSE as get_project_sse/get_composer_sse_url

    Client->>API: GET /mcp/{project_id}/tools
    API->>Auth: verify_project_auth(db, project_id, qp, header)
    Auth-->>API: User
    API->>Util: should_use_mcp_composer(project)
    alt Composer enabled (OAuth)
        API->>SSE: get_composer_sse_url(project)
        SSE-->>API: composer SSE URL
        API-->>Client: Tools (via composer)
    else API-key or disabled
        API->>SSE: get_project_sse(project_id)
        SSE-->>API: SSE transport
        API-->>Client: Tools (direct)
    end

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~75 minutes

Possibly related PRs

• fix(langwatch): prevent trace errors with proper API key validation #9720 — Changes the MCP composer env variable to LANGFLOW_MCP_COMPOSER_ENABLED and updates defaults; overlaps with env and composer toggles here.
• ref: refactor MCP-related functionality centralizing common utilities #9059 — Refactors MCP server/project handling; intersects with expanded MCP composer orchestration and verify_project_auth changes.
• fix: Knowledge base component refactor #9543 — Knowledge-base components refactor (ingestion/retrieval renames/exports); matches the KB changes in this PR.

Tip

👮 Agentic pre-merge checks are now available in preview!

Pro plan users can now enable pre-merge checks in their settings to enforce checklists before merging PRs.

• Built-in checks – Quickly apply ready-made checks to enforce title conventions, require pull request descriptions that follow templates, validate linked issues for compliance, and more.
• Custom agentic checks – Define your own rules using CodeRabbit’s advanced agentic capabilities to enforce organization-specific policies and workflows. For example, you can instruct CodeRabbit’s agent to verify that API documentation is updated whenever API schema files are modified in a PR. Note: Upto 5 custom checks are currently allowed during the preview period. Pricing for this feature will be announced in a few weeks.

Example:

reviews:
  pre_merge_checks:
    custom_checks:
      - name: "Undocumented Breaking Changes"
        mode: "warning"
        instructions: |
          Pass/fail criteria: All breaking changes to public APIs, CLI flags, environment variables, configuration keys, database schemas, or HTTP/GraphQL endpoints must be documented in the "Breaking Change" section of the PR description and in CHANGELOG.md. Exclude purely internal or private changes (e.g., code not exported from package entry points or explicitly marked as internal).

Please share your feedback with us on this Discord post.

✨ Finishing Touches

• 📝 Generate Docstrings

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch lfoss-2096

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate failed

Failed conditions
14 Security Hotspots
D Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE