How do I secure LangServe?

Put LangServe behind an authenticating reverse proxy with TLS, or enable the framework's auth dependencies before binding to a public interface.

How many LangServe instances are exposed?

11 LangServe instances are reachable in the Shodan index (source: Shodan count · `http.html:"langserve"`, 2026-08); that is a fingerprint match, not a verified zero-auth count.

← what I check

EXPOSURE LangServe
SEVERITY CRITICAL
PROBE GET :8000/openapi.json

CRITICAL

Is your LangServe exposed?

Chain /invoke and /playground open: anyone can run your LangChain agent against your models and tools.

Scan a host you own → Fix card Census

Why it matters

LangServe publishes your LangChain/LangGraph runnable over HTTP with a playground UI. Without auth, anyone can open /playground or call /invoke and run your chain against your models, tools, and data.

How common is it?

11 LangServe instances are reachable in the Shodan index. Fingerprint match, not a verified zero-auth count · src: Shodan count · `http.html:"langserve"` · 2026-08

Counts are population-level, from third-party indexes and my own honeypots. I never scan the internet and this page makes no claim about any specific host.

Fix it

The full walkthrough lives on the fix card, kept current in one place:

Full fix card: langserve-exposed →