Native integration · Shipped

Mneme HQ + LangChain / LangGraph

Deterministic architectural governance for LangChain agents running on LangGraph. Mneme injects architectural context before model calls and evaluates supported filesystem mutations before execution using the same Mneme enforcement engine as every other integration — exposed as agent middleware your application controls.

Set up Mneme Evidence Running it across a team? Request a pilot →

Status: native, shipped, bounded

The integration merged on August 25, 2026 (PR #331) and lives at mneme/integrations/langchain/adapter.py, installable with the extra pip install "mneme-hq[langchain]". It implements LangChain’s agent middleware API (wrap_model_call, wrap_tool_call, awrap_tool_call) and is validated against exact pinned versions:

langchain 1.3.17
langchain-core 1.6.0
langgraph 1.2.11

These are the validated pins. No generic version compatibility is claimed or implied beyond them.

The architectural boundary, precisely: the middleware translates LangChain events into existing Mneme semantics — retrieval is the unchanged DecisionRetriever path shared with the Claude Agent SDK adapter, and enforcement is the unchanged mneme check contract shared with the Claude Code hook. It does not implement a second policy or enforcement engine.

How it works

project_memory.json
    ↓
Mneme decision retrieval
    ↓
wrap_model_call
    ↓
architectural context injected
    ↓
LangChain agent
    ↓
write_file / edit_file
    ↓
wrap_tool_call / awrap_tool_call
    ↓
mneme check --target-path
    ↓
ALLOW / WARN / DENY

Sync and async loops behave identically: invoke goes through wrap_tool_call, ainvoke through awrap_tool_call, with the same policy applied. In strict mode, trusted WARN/FAIL verdicts deny the mutation before the tool handler runs and return rejection feedback to the model as the tool result. In warn mode the handler executes with a visible governance result carried on the tool output. Degraded evaluation fails open visibly: an unevaluated mutation is never silently reported as governed.

Supported surface

This integration is precise about what it governs and what it does not:

Surface	Status
`wrap_model_call`	Context injection — retrieved decisions appended before model calls.
`wrap_tool_call`	Sync pre-tool enforcement.
`awrap_tool_call`	Async pre-tool enforcement.
`write_file`	Governed. Full proposed content checked.
`edit_file`	Governed. Only the introduced delta is checked (ADR-018).
Trusted strict WARN / FAIL verdict	Denied before the handler runs; rejection feedback returned to the model.
Warn mode	Handler executes with a visible governance result on the tool result.
Degraded evaluation	Fails open visibly: UNEVALUATED marker, never silent.
`execute` / shell surfaces	Not governed. Out of scope for this milestone.
Arbitrary custom tools	Not governed. The tool map is deliberately closed.
Raw `StateGraph` custom `ToolNode`s	Bypass surface. Applications that wire their own execution nodes can bypass any middleware.
Remote / virtual filesystem semantics	Unsupported / unvalidated. Same-named tools over virtual backends are intercepted, but local-path semantics may not describe the actual mutation target there.

A compiled, middleware-equipped agent remains governed when embedded as a node or subgraph in a larger graph — that composition was proven empirically in validation. What Mneme claims no opinion over are nodes it cannot intercept.

What this integration is not

No second enforcement engine. The adapter translates between LangChain middleware shapes and existing core behavior — introduced-delta selection, path applicability, mode resolution, and verdict parsing are unchanged.
No shell governance. execute and shell surfaces receive no checker invocations; ADR-021’s prevent–catch–verify arc does not yet generalize here.
No custom-tool coverage. Read-only tools, custom tools, and anything outside the closed write_file/edit_file map get zero checker calls.
No raw-graph guarantee. Raw StateGraph graphs wiring their own ToolNodes are a documented bypass surface.
No Deep Agents support claim. Because remote/virtual filesystem semantics remain unvalidated, Deep Agents stays roadmap-only until its own pinned validation passes.

Evidence

docs/integrations/langchain-langgraph.md — canonical integration document: architecture, scope, policy table, and trace behavior
validation/langgraph/ — capability matrix and live fixture results under the pinned versions
PR #331 — implementation, tests, and closeout record

Deterministic guardrails inside LangChain agents

Open-source. Repo-native. Architectural context before generation and deterministic enforcement before disk — with every boundary on this page stated rather than implied.

GitHub All integrations