> ## Documentation Index
> Fetch the complete documentation index at: https://langchain-docs-zh.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# 中间件集成

> 使用 LangChain Python 集成中间件。

浏览不同提供商的可用中间件或为生态系统贡献您自己的中间件。了解更多关于中间件的工作原理，请参考 [中间件概述](https://langchain-docs-zh.mintlify.site/langchain/oss/langchain/middleware/overview.md)，以及如何在 [Deep Agents 文档](https://langchain-docs-zh.mintlify.site/langchain/oss/deepagents/customization.md#中间件) 中使用中间件与 Deep Agents。

Integration components
Arrows show a typical retrieval flow. The highlighted component is the one this page covers.

### Typical retrieval flow

### Agent capabilities

### Execution and state

## 分享您的中间件

中间件支持上下文工程、 harness 自定义和运行时安全控制。它是 LangChain 中一个有用的扩展点，我们很乐意展示社区使用它所构建的内容：

> [card] [Add an official integration](https://langchain-docs-zh.mintlify.site/langchain/oss/contributing/implement-langchain.md#middleware)
>
> 按照贡献指南构建和发布中间件包。

> [card] [Share a community middleware](https://github.com/langchain-ai/docs)
>
> 向文档仓库提交 PR，将您的中间件添加到所有集成表格中。

## 精选集成

| 提供商 | 可用中间件 | 来源 | 下载 |
| :- | :- | :- | :- |
| [`OpenAI middleware`](https://langchain-docs-zh.mintlify.site/langchain/oss/python/integrations/middleware/openai) | 内容审核、模型路由和工具风险门控 | [`langchain-ai/langchain`](https://github.com/langchain-ai/langchain/tree/master/libs/partners/openai) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-openai/month)](https://pypi.org/project/langchain-openai/) |
| [`Anthropic middleware`](https://langchain-docs-zh.mintlify.site/langchain/oss/python/integrations/middleware/anthropic) | 提示词缓存、bash 工具、文本编辑器、记忆和文件搜索 | [`langchain-ai/langchain`](https://github.com/langchain-ai/langchain/tree/master/libs/partners/anthropic) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-anthropic/month)](https://pypi.org/project/langchain-anthropic/) |
| [`AWS middleware`](https://langchain-docs-zh.mintlify.site/langchain/oss/python/integrations/middleware/aws) | 提示词缓存和 AgentCore 支付 | [`langchain-ai/langchain-aws`](https://github.com/langchain-ai/langchain-aws/tree/main/libs/aws), [`aws/bedrock-agentcore-sdk-python`](https://github.com/aws/bedrock-agentcore-sdk-python) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-aws/month)](https://pypi.org/project/langchain-aws/) |
| [`Microsoft Foundry middleware`](https://langchain-docs-zh.mintlify.site/langchain/oss/python/integrations/middleware/azure_ai) | 文本审核、图像审核、提示词盾牌、受保护材料和对齐性 | [`langchain-ai/langchain-azure`](https://github.com/langchain-ai/langchain-azure/tree/main/libs/azure-ai) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-azure-ai/month)](https://pypi.org/project/langchain-azure-ai/) |
| [`NVIDIA middleware`](https://langchain-docs-zh.mintlify.site/langchain/oss/python/integrations/middleware/nvidia) | 模型路由和 Nemotron 3 Ultra 执行优化 | [`langchain-ai/langchain-nvidia`](https://github.com/langchain-ai/langchain-nvidia), [`langchain-ai/deepagents`](https://github.com/langchain-ai/deepagents) | 不适用 |

## 所有中间件

| Provider | Middleware available | Source | Downloads |
| :- | :- | :- | :- |
| [`OpenAI middleware`](https://langchain-docs-zh.mintlify.site/langchain/oss/python/integrations/middleware/openai) | Content moderation, model routing, and tool-risk gating | [`langchain-ai/langchain`](https://github.com/langchain-ai/langchain/tree/master/libs/partners/openai) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-openai/month)](https://pypi.org/project/langchain-openai/) |
| [`Anthropic middleware`](https://langchain-docs-zh.mintlify.site/langchain/oss/python/integrations/middleware/anthropic) | Prompt caching, bash tool, text editor, memory, and file search | [`langchain-ai/langchain`](https://github.com/langchain-ai/langchain/tree/master/libs/partners/anthropic) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-anthropic/month)](https://pypi.org/project/langchain-anthropic/) |
| [`AWS middleware`](https://langchain-docs-zh.mintlify.site/langchain/oss/python/integrations/middleware/aws) | Prompt caching and AgentCore Payments | [`langchain-ai/langchain-aws`](https://github.com/langchain-ai/langchain-aws/tree/main/libs/aws), [`aws/bedrock-agentcore-sdk-python`](https://github.com/aws/bedrock-agentcore-sdk-python) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-aws/month)](https://pypi.org/project/langchain-aws/) |
| [`Microsoft Foundry middleware`](https://langchain-docs-zh.mintlify.site/langchain/oss/python/integrations/middleware/azure_ai) | Text moderation, image moderation, prompt shield, protected material, and groundedness | [`langchain-ai/langchain-azure`](https://github.com/langchain-ai/langchain-azure/tree/main/libs/azure-ai) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-azure-ai/month)](https://pypi.org/project/langchain-azure-ai/) |
| [`CopilotKit`](https://langchain-docs-zh.mintlify.site/langchain/oss/langchain/frontend/integrations/copilotkit) | CopilotKit middleware and FastAPI bridge for Deep Agents, create\_agent graphs, AG-UI, and the React and runtime clients | [`CopilotKit/CopilotKit`](https://github.com/CopilotKit/CopilotKit) | [  ![Downloads per month](https://static.pepy.tech/badge/copilotkit/month)](https://pypi.org/project/copilotkit/) |
| [`Deep Agents Graph Memory`](https://github.com/TahaK29/deepagents-graph-memory) | Graph context middleware and tools for Deep Agents that record and recall workflow findings using embedded LadybugDB. | [`TahaK29/deepagents-graph-memory`](https://github.com/TahaK29/deepagents-graph-memory) | [  ![Downloads per month](https://static.pepy.tech/badge/deepagents-graph-memory/month)](https://pypi.org/project/deepagents-graph-memory/) |
| [`Tenuo`](https://tenuo.ai/langchain) | Task-scoped authorization for LangChain agents that limits each task to the tools, argument values and time it needs, enforced before execution, with delegated agents receiving a subset of the parent's permissions. | [`tenuo-ai/tenuo`](https://github.com/tenuo-ai/tenuo) | [  ![Downloads per month](https://static.pepy.tech/badge/tenuo/month)](https://pypi.org/project/tenuo/) |
| [`ISNAD`](https://github.com/alizahidraja/isnad) | Claim-level provenance and trust grading for agent outputs. Grades every transmitter in a claim's chain (source, scraper, model) in a living registry, caps the chain at its weakest link, and quarantines fabricated (mawḍūʿ) chains—with a tamper-evident audit trail. | [`alizahidraja/isnad`](https://github.com/alizahidraja/isnad) | [  ![Downloads per month](https://static.pepy.tech/badge/isnad/month)](https://pypi.org/project/isnad/) |
| [`attenu-guard`](https://attenu.io/docs/example-langgraph/) | Per-agent permission enforcement on every tool call and subagent handoff through wrap\_tool\_call (a subagent's permissions are a computed subset of its parent's), with a hash-chained audit log verified offline | [`attenu-io/attenu-guard`](https://github.com/attenu-io/attenu-guard) | [  ![Downloads per month](https://static.pepy.tech/badge/attenu-guard/month)](https://pypi.org/project/attenu-guard/) |
| [`PIIAnonymizationMiddleware`](https://athroniaeth.github.io/piighost/getting-started/langchain/) | Protect personal data (PII) in prompts, tool calls, and agent conversations. Hides sensitive values from the model, then restores the real values in the reply and at the tool boundary, so tools and the user still get the real data. Pluggable regex, NER, and LLM detectors, thread-consistent tokens, and token-by-token streaming restoration. | [`Athroniaeth/piighost`](https://github.com/Athroniaeth/piighost) | [  ![Downloads per month](https://static.pepy.tech/badge/piighost/month)](https://pypi.org/project/piighost/) |
| [`Highflame`](https://github.com/highflame-ai/highflame-sdk) | Runtime AI security guardrails (prompt injection, PII/DLP, content safety) applied as middleware via Highflame Shield (OWASP LLM Top 10). | [`highflame-ai/highflame-sdk`](https://github.com/highflame-ai/highflame-sdk) | [  ![Downloads per month](https://static.pepy.tech/badge/highflame/month)](https://pypi.org/project/highflame/) |
| [`LLMSlimToolOutputMiddleware`](https://github.com/Thanatos9404/llmslim/blob/main/docs/integrations/LANGCHAIN.md#agents-shorten-long-tool-output-langchain-1x) | Agent middleware that shortens long tool results once, before the model first sees them, so later model calls resend identical bytes. Local, no model call. | [`Thanatos9404/llmslim`](https://github.com/Thanatos9404/llmslim) | [  ![Downloads per month](https://static.pepy.tech/badge/llmslim/month)](https://pypi.org/project/llmslim/) |
| [`TracekitMiddleware`](https://github.com/Cygnux-Labs/Tracekit/blob/main/docs/integrations/langchain.md) | Tracekit asks a separate signer to allow, deny or hold each agent tool call for a person before it runs, and records every call and result in a signed, hash-chained log that can be verified offline. | [`Cygnux-Labs/Tracekit`](https://github.com/Cygnux-Labs/Tracekit) | [  ![Downloads per month](https://static.pepy.tech/badge/tracekit-ai/month)](https://pypi.org/project/tracekit-ai/) |
| [`Vulnify`](https://docs.vulnify.io/sdks/adapters/?utm_source=github\&utm_medium=directory\&utm_campaign=langchain-docs#langchain-create_agent-middleware) | Runtime authorization for tool calls with ALLOW, REVIEW, or BLOCK decisions, risk scores, optional human approval, and error ToolMessages for blocked calls. | [`vulnify/vulnify-sdk-python`](https://github.com/vulnify/vulnify-sdk-python) | [  ![Downloads per month](https://static.pepy.tech/badge/vulnify/month)](https://pypi.org/project/vulnify/) |
| [`xaidr`](https://github.com/delphisecurity/xaidr#langchain-middleware) | In-process runtime security sensor for AI agents. LangChain middleware covering input, tool-call, and output boundaries for prompt injection, jailbreak, DLP, and A2A-protocol scanning. | [`delphisecurity/xaidr`](https://github.com/delphisecurity/xaidr) | [  ![Downloads per month](https://static.pepy.tech/badge/xaidr/month)](https://pypi.org/project/xaidr/) |
| [`prompt-shield`](https://github.com/mthamil107/prompt-shield) | Runtime prompt-injection firewall. Scans inputs, tool results, and outputs across detectors and output scanners with block, flag, and log modes. | [`mthamil107/prompt-shield`](https://github.com/mthamil107/prompt-shield) | [  ![Downloads per month](https://static.pepy.tech/badge/prompt-shield-ai/month)](https://pypi.org/project/prompt-shield-ai/) |
| [`Cisco AI Defense`](https://github.com/cisco-ai-defense/ai-defense-langchain-middleware) | Runtime security inspection | [`cisco-ai-defense/ai-defense-langchain-middleware`](https://github.com/cisco-ai-defense/ai-defense-langchain-middleware) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-cisco-aidefense/month)](https://pypi.org/project/langchain-cisco-aidefense/) |
| [`compact-middleware`](https://github.com/emanueleielo/compact-middleware) | Claude Code's compaction engine as LangChain middleware. Multi-level context compaction for long-running agents. | [`emanueleielo/compact-middleware`](https://github.com/emanueleielo/compact-middleware) | [  ![Downloads per month](https://static.pepy.tech/badge/compact-middleware/month)](https://pypi.org/project/compact-middleware/) |
| [`SRARiskGateMiddleware`](https://github.com/sriram1983007-dev/langchain-sra-riskgate#readme) | Checks stablecoin payment tool calls before they run and holds or rejects those that break spend, recipient, or asset rules. | [`sriram1983007-dev/langchain-sra-riskgate`](https://github.com/sriram1983007-dev/langchain-sra-riskgate) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-sra-riskgate/month)](https://pypi.org/project/langchain-sra-riskgate/) |
| [`SeekritCredentials`](https://seekrit.dev/docs/guides/frameworks/langgraph#4-scope-a-key-to-one-tool) | Scopes secrets per model call and per tool call. Credentials stay as placeholders in agent code and are substituted at the HTTP boundary against a default-deny allowlist, so an unlisted tool cannot reach a credential. | [`seekritdev/python-sdk`](https://github.com/seekritdev/python-sdk) | [  ![Downloads per month](https://static.pepy.tech/badge/seekrit/month)](https://pypi.org/project/seekrit/) |
| [`OpenBox`](https://docs.openbox.ai/getting-started/langgraph) | Real-time governance for LangGraph and Deep Agents. Policies, guardrails, HITL, OTel hook governance, and behavior rules. | [`OpenBox-AI/openbox-langgraph-sdk-python`](https://github.com/OpenBox-AI/openbox-langgraph-sdk-python) | [  ![Downloads per month](https://static.pepy.tech/badge/openbox-langgraph-sdk-python/month)](https://pypi.org/project/openbox-langgraph-sdk-python/) |
| [`ScaleDown middleware`](https://langchain-docs-zh.mintlify.site/langchain/oss/python/integrations/middleware/scaledown) | Conversation summarization, context and tool result compression, and structured extraction | [`scaledown-team/langchain-scaledown`](https://github.com/scaledown-team/langchain-scaledown/tree/main/libs/scaledown) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-scaledown/month)](https://pypi.org/project/langchain-scaledown/) |
| [`NeuralTrust TrustGuard`](https://docs.neuraltrust.ai/integrations/langchain) | TrustGuard evaluate middleware. Allow, block, report, or transform agent input, model output, and optional tool traffic. | [`NeuralTrust/langchain-neuraltrust`](https://github.com/NeuralTrust/langchain-neuraltrust) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-neuraltrust/month)](https://pypi.org/project/langchain-neuraltrust/) |
| [`Nuggets Authority`](https://nuggets.life) | Pre-execution authority enforcement for tool calls. Verifies a scoped, signed delegation before each tool runs, fails closed on deny, and emits an independently verifiable cryptographic proof of every decision. | [`NuggetsLtd/langchain-nuggets`](https://github.com/NuggetsLtd/langchain-nuggets) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-nuggets/month)](https://pypi.org/project/langchain-nuggets/) |
| [`GoAT`](https://pypi.org/project/langgraph-goat/) | langgraph-goat records candidate plans, scores, and why each was chosen or rejected as a LangGraph agent plans, then renders a natural-language explanation for debugging and end-user transparency. | [`Samsung/langgraph-goat`](https://github.com/Samsung/langgraph-goat) | [  ![Downloads per month](https://static.pepy.tech/badge/langgraph-goat/month)](https://pypi.org/project/langgraph-goat/) |
| [`Pydantic Monty Code Interpreter`](https://github.com/shane-rand/langchain-monty) | Provides Code Interpretation inside Pydantic's Monty Runtime | [`langchain-monty`](https://github.com/shane-rand/langchain-monty) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-monty/month)](https://pypi.org/project/langchain-monty/) |
| [`ProvaredMiddleware`](https://github.com/provared/provared/tree/main/python/integrations/provared-langchain) | Checks each tool call through wrap\_tool\_call against a passkey-signed permission, runs the tool only if allowed, and writes a signed, hash-chained receipt that can be verified offline. | [`provared/provared`](https://github.com/provared/provared/tree/main/python/integrations/provared-langchain) | [  ![Downloads per month](https://static.pepy.tech/badge/provared-langchain/month)](https://pypi.org/project/provared-langchain/) |
| [`langchain-runcycles`](https://runcycles.io) | Pre-execution budget authority for model calls, tool calls, and agent loops | [`runcycles/langchain-runcycles`](https://github.com/runcycles/langchain-runcycles) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-runcycles/month)](https://pypi.org/project/langchain-runcycles/) |
| [`PromptFirewallHandler`](https://github.com/TimurRakhmatullin86/langchain-promptfirewall#readme) | Sub-millisecond PII detection and prompt injection firewall for LangChain. Zero network, zero GPU, pure Rust core via PyO3. | [`TimurRakhmatullin86/langchain-promptfirewall`](https://github.com/TimurRakhmatullin86/langchain-promptfirewall) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-promptfirewall/month)](https://pypi.org/project/langchain-promptfirewall/) |
| [`TealTiger`](https://docs.tealtiger.ai/integrations/langchain) | Deterministic governance middleware. Policy enforcement, cost limits, tool allowlisting, FREEZE rules, and SARIF audit evidence with no LLM in the governance path. | [`agentguard-ai/tealtiger`](https://github.com/agentguard-ai/tealtiger/tree/main/packages/langchain-tealtiger) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-tealtiger/month)](https://pypi.org/project/langchain-tealtiger/) |
| [`langchain-router`](https://github.com/johanity/langchain-router) | Phase-based model routing. Routes execution turns to a fast model, keeps the primary for planning and recovery. | [`johanity/langchain-router`](https://github.com/johanity/langchain-router) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-router/month)](https://pypi.org/project/langchain-router/) |
| [`langchain-task-steering`](https://github.com/edvinhallvaxhiu/langchain-task-steering) | Implicit state-machine middleware for ordered task pipelines with per-task tool scoping, dynamic prompt injection, and composable completion validation. | [`edvinhallvaxhiu/langchain-task-steering`](https://github.com/edvinhallvaxhiu/langchain-task-steering) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-task-steering/month)](https://pypi.org/project/langchain-task-steering/) |
| [`BastionGuardrailMiddleware`](https://bastionsoft.com) | Prompt-injection and jailbreak detection. Screens user input and tool results, including indirect injection through retrieved content, before the model runs. Runs locally on your own hardware. | [`bastion-soft/bastion-prompt-protection`](https://github.com/bastion-soft/bastion-prompt-protection) | [  ![Downloads per month](https://static.pepy.tech/badge/bastion-prompt-protection/month)](https://pypi.org/project/bastion-prompt-protection/) |
| [`DynamicToolSelectorMiddleware`](https://github.com/RauhanAhmed/langchain-dynamic-tools-middleware) | Drop-in agent middleware providing sub-100ms hybrid dense and sparse vector tool retrieval over zvec. Eliminates prompt token overhead by >80% and outperforms LLM-based tool selection on Berkeley Function Calling Leaderboard (BFCL) benchmarks. | [`RauhanAhmed/langchain-dynamic-tools-middleware`](https://github.com/RauhanAhmed/langchain-dynamic-tools-middleware) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-dynamic-tools-middleware/month)](https://pypi.org/project/langchain-dynamic-tools-middleware/) |
| [`ATLTaskMiddleware`](https://github.com/wenhua6666668-oss/langchain-agenttrafficlab#automatic-task-time-routing-v03) | Automatic task-time routing to executable MCP and provider capabilities, with failure redecision and outcome reporting. | [`wenhua6666668-oss/langchain-agenttrafficlab`](https://github.com/wenhua6666668-oss/langchain-agenttrafficlab) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-agenttrafficlab/month)](https://pypi.org/project/langchain-agenttrafficlab/) |
| [`advisor-middleware`](https://github.com/emanueleielo/advisor-middleware) | Claude Code's advisor pattern as LangChain middleware. Pairs a fast executor model with a powerful advisor model that intervenes only on critical decisions. | [`emanueleielo/advisor-middleware`](https://github.com/emanueleielo/advisor-middleware) | [  ![Downloads per month](https://static.pepy.tech/badge/advisor-middleware/month)](https://pypi.org/project/advisor-middleware/) |
| [`TurnWindowMiddleware`](https://github.com/bharatkhanna-dev/langchain-turn-window#readme) | Cross-provider LangChain agent middleware that retains the most recent human-anchored conversation turns before each model call while keeping tool-call and tool-result messages together. | [`bharatkhanna-dev/langchain-turn-window`](https://github.com/bharatkhanna-dev/langchain-turn-window) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-turn-window/month)](https://pypi.org/project/langchain-turn-window/) |
| [`MeragptDecider`](https://github.com/Sandeep85Das/langchain-meragpt) | Typed decisions (yes/no, choice, score) with calibrated probabilities from meraGPT Decider 1, as a Runnable, a tool, and agent middleware. | [`Sandeep85Das/langchain-meragpt`](https://github.com/Sandeep85Das/langchain-meragpt) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-meragpt/month)](https://pypi.org/project/langchain-meragpt/) |
| [`Wity`](https://github.com/info-alphanimble/langchain-wity#readme) | Fixed-option questions about text in one pass, with a probability per option, for model routing, tool-risk checks, and classification. | [`info-alphanimble/langchain-wity`](https://github.com/info-alphanimble/langchain-wity) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-wity/month)](https://pypi.org/project/langchain-wity/) |
| [`LoopGrid`](https://loopgrid.io/integrations/langchain/) | Native LangChain AgentMiddleware for signed decision evidence, policy enforcement, human approval, and guarded tool execution through LoopGrid Core. | [`loopgridio/loopgrid-langchain`](https://github.com/loopgridio/loopgrid-langchain) | [  ![Downloads per month](https://static.pepy.tech/badge/loopgrid-langchain/month)](https://pypi.org/project/loopgrid-langchain/) |
| [`RelayShield`](https://api.relayshield.net/developers) | Mandatory pre-execution gate that blocks connect\_mcp\_server and install\_mcp\_package tool calls when RelayShield reports risk. | [`nzdsf2-gif/langchain-relayshield`](https://github.com/nzdsf2-gif/langchain-relayshield) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-relayshield/month)](https://pypi.org/project/langchain-relayshield/) |
| [`RecallChatMessageHistory`](https://recallmem.dev/guides/langchain) | Chat message history stored in a Recall session, so Recall also learns about the user from it. | [`recallmem/recall`](https://github.com/recallmem/recall) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-recall/month)](https://pypi.org/project/langchain-recall/) |
| [`RecallMiddleware`](https://recallmem.dev/guides/langchain) | Long-term memory for create\_agent agents: adds what Recall learned about the user to the system prompt and records each exchange. | [`recallmem/recall`](https://github.com/recallmem/recall) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-recall/month)](https://pypi.org/project/langchain-recall/) |
| [`MaskflowReversibleAnonymizer`](https://github.com/maskflow/maskflow/tree/main/packages/maskflow-langchain) | Reversible PII anonymizer / deanonymizer, a drop-in for langchain-experimental's Presidio anonymizer (same .anonymize / .deanonymize / .deanonymizer\_mapping and JSON/YAML save-load). Adds the Indian identifiers most tools miss (Aadhaar, PAN, GSTIN, UPI, IFSC, ABHA, names, addresses), a streaming-aware deanonymizer Runnable, and an optional leak-guard callback that fails a call closed if PII reaches the model. | [`maskflow/maskflow`](https://github.com/maskflow/maskflow/tree/main/packages/maskflow-langchain) | [  ![Downloads per month](https://static.pepy.tech/badge/maskflow-langchain/month)](https://pypi.org/project/maskflow-langchain/) |
| [`langchain-collapse`](https://github.com/johanity/langchain-collapse) | Preventive context management. Collapses consecutive tool-call groups before they fill the context window. | [`johanity/langchain-collapse`](https://github.com/johanity/langchain-collapse) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-collapse/month)](https://pypi.org/project/langchain-collapse/) |
| [`Tessera`](https://github.com/kenithphilip/Tessera) | Signed trust labels and taint-tracking that gate tool calls when context contains untrusted segments. | [`kenithphilip/Tessera`](https://github.com/kenithphilip/Tessera) | [  ![Downloads per month](https://static.pepy.tech/badge/tessera-mesh/month)](https://pypi.org/project/tessera-mesh/) |
| [`CTRLRunMiddleware`](https://docs.ctrlrun.dev/guides/langchain-middleware) | Policy-gated tool calls through wrap\_tool\_call: a refused call never reaches the tool and the model is told which rule refused it; an effect key executes at most once across processes sharing a store; a tool that raises leaves the effect unresolved rather than retried; an approve decision holds the call for a person; a receipt for every decision, refusals included. | [`CTRLRun/ctrlrun`](https://github.com/CTRLRun/ctrlrun/tree/main/adapters/langchain) | [  ![Downloads per month](https://static.pepy.tech/badge/ctrlrun-langchain/month)](https://pypi.org/project/ctrlrun-langchain/) |
| [`DeepKeep middleware`](https://docs.deepkeep.ai) | DeepKeep AI Firewall pre-moderation and post-moderation for LangChain agents. | | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-deepkeep/month)](https://pypi.org/project/langchain-deepkeep/) |
| [`AxioRank`](https://axiorank.com/docs/integrations/langchain) | Security gateway for AI agents: score tool calls and model turns against policy with allow, deny, and redact. | [`AxioRank/langchain-axiorank`](https://github.com/AxioRank/langchain-axiorank) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-axiorank/month)](https://pypi.org/project/langchain-axiorank/) |
| [`SubmilliMiddleware`](https://submilli.ai/docs/tutorials/connect-deepagents/) | Code-mode middleware that runs agent-written TypeScript programs on submilli-server under a policy and can call the agent's own tools. | [`submilli/submilli-python`](https://github.com/submilli/submilli-python) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-submilli/month)](https://pypi.org/project/langchain-submilli/) |
| [`langchain-pop`](https://github.com/joy7758/persona-object-protocol/tree/main/integrations/langchain-pop) | Portable persona loading, legacy migration, and boundary-aware tool filtering for LangChain agents. | [`joy7758/persona-object-protocol`](https://github.com/joy7758/persona-object-protocol/tree/main/integrations/langchain-pop) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-pop/month)](https://pypi.org/project/langchain-pop/) |
| [`OWASP Agent Memory Guard`](https://owasp.org/www-project-agent-memory-guard/) | Runtime defense against AI agent memory poisoning (OWASP ASI06). Scans messages, model responses, and tool outputs locally with block, warn, and strip modes. | [`OWASP/www-project-agent-memory-guard`](https://github.com/OWASP/www-project-agent-memory-guard/tree/main/integrations/langchain-agent-memory-guard) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-agent-memory-guard/month)](https://pypi.org/project/langchain-agent-memory-guard/) |
| [`langchain-distil`](https://github.com/dshakes/distil) | Reversible, certified context compression. Digests large tool outputs and message history before the model call (tool and function messages reversibly, human and system losslessly, the model messages never rewritten), with byte-exact recovery of every digest. Decision-equivalence between compressed and full context is certified offline by a statistical non-inferiority gate. | [`dshakes/distil`](https://github.com/dshakes/distil) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-distil/month)](https://pypi.org/project/langchain-distil/) |
| [`comply54`](https://comply54.io/langchain) | Runtime compliance enforcement for AI agents under African data protection and financial-sector regulations (deny, escalate, audit, or allow). | [`comply54/langchain-comply54`](https://github.com/comply54/langchain-comply54) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-comply54/month)](https://pypi.org/project/langchain-comply54/) |
| [`DNS-AID`](https://github.com/IngmarVG-IB/langchain-dns-aid) | DNS-based agent discovery via the DNS-AID protocol. Auto-publishes agents on startup, auto-unpublishes on shutdown, and provides discovery tools. | [`IngmarVG-IB/langchain-dns-aid`](https://github.com/IngmarVG-IB/langchain-dns-aid) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-dns-aid/month)](https://pypi.org/project/langchain-dns-aid/) |
| [`NoPII`](https://github.com/Enigma-Vault/NoPII/tree/main/integrations/langchain-nopii-middleware) | Runtime PII tokenization. Detects personal data in outbound prompts, replaces it with deterministic vault tokens before the request reaches the LLM, and restores the original values in the response. | [`Enigma-Vault/NoPII`](https://github.com/Enigma-Vault/NoPII/tree/main/integrations/langchain-nopii-middleware) | [  ![Downloads per month](https://static.pepy.tech/badge/langchain-nopii-middleware/month)](https://pypi.org/project/langchain-nopii-middleware/) |
| [`text2sql-framework`](https://github.com/Text2SqlAgent/text2sql-framework) | Replaces RAG with recursive tool use: the agent explores, writes, tests, and self-corrects using one execute\_sql tool. | [`Text2SqlAgent/text2sql-framework`](https://github.com/Text2SqlAgent/text2sql-framework) | [  ![Downloads per month](https://static.pepy.tech/badge/text2sql-framework/month)](https://pypi.org/project/text2sql-framework/) |
| [`langgraph-state-machine`](https://github.com/mahmoud661/langgraph-state-machine) | Section-based flow control for LangGraph React agents. Divides conversations into discrete phases with scoped tools, prompts, auto-transitions, branching, and optional per-section LLM override. | [`mahmoud661/langgraph-state-machine`](https://github.com/mahmoud661/langgraph-state-machine) | [  ![Downloads per month](https://static.pepy.tech/badge/langgraph-state-machine/month)](https://pypi.org/project/langgraph-state-machine/) |
| [`VecrContextCompressor`](https://github.com/h2cker/vecr) | Deterministic LLM context compression with a regex retention whitelist for structured tokens before the model call. | [`h2cker/vecr`](https://github.com/h2cker/vecr) | [  ![Downloads per month](https://static.pepy.tech/badge/vecr-compress/month)](https://pypi.org/project/vecr-compress/) |
| [`ACGSMiddleware`](https://github.com/acgs-ai/langchain-acgs#readme) | Checks each agent tool call against ACGS constitution rules before it runs; blocked calls are denied, and review rules pause the agent. | [`acgs-ai/langchain-acgs`](https://github.com/acgs-ai/langchain-acgs) | N/A |
| [`ATR Guardrail`](https://github.com/Agent-Threat-Rule/agent-threat-rules/tree/main/integrations/langchain) | Runtime detection of prompt injection, tool poisoning, and unsafe tool calls using Agent Threat Rules. Halts the agent or blocks the tool call on a critical finding and keeps an audit trail. | [`Agent-Threat-Rule/agent-threat-rules`](https://github.com/Agent-Threat-Rule/agent-threat-rules/tree/main/integrations/langchain) | N/A |
| [`eager-tools`](https://github.com/cloudthinker-ai/eager-tools) | Reduces agent wall-clock latency by dispatching each tool call the moment its streaming block closes, overlapping tool execution with LLM generation. | [`cloudthinker-ai/eager-tools`](https://github.com/cloudthinker-ai/eager-tools) | N/A |
| [`Haldir`](https://github.com/ExposureGuard/haldir/tree/main/integrations/langchain-haldir) | Governance layer for LangChain agents with scoped sessions, encrypted secrets, hash-chained audit, and policy enforcement. | [`ExposureGuard/haldir`](https://github.com/ExposureGuard/haldir/tree/main/integrations/langchain-haldir) | N/A |
| [`NVIDIA middleware`](https://langchain-docs-zh.mintlify.site/langchain/oss/python/integrations/middleware/nvidia) | Model routing and Nemotron 3 Ultra harness optimization | [`langchain-ai/langchain-nvidia`](https://github.com/langchain-ai/langchain-nvidia), [`langchain-ai/deepagents`](https://github.com/langchain-ai/deepagents) | N/A |

> [!NOTE]
>
> 如果您想贡献集成，请参考 [贡献集成](https://langchain-docs-zh.mintlify.site/langchain/oss/contributing/overview.md#build-a-new-integration)。

***

> 官方原文：[src/oss/python/integrations/middleware/index.mdx](https://github.com/langchain-ai/docs/blob/main/src/oss/python/integrations/middleware/index.mdx) · 非官方翻译，译文由 AI 生成，以英文原文为准。


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.