Langflow 1.12.6 fixes tool discovery path so listing MCP tools no longer executes stored component code

Langflow released 1.12.6 on October 13, including a fix related to agent tool discovery: generating a flow’s input schema no longer instantiates components and runs their stored code. The fix was merged on October 8; the release is the development from the past two days. Release notes

The issue was in the shared json_schema_from_flow path. Both MCP’s tools/list and A2A agent cards use it to obtain input schemas. The previous implementation instantiated components when building the flow graph, which could also execute code at the module level. Maintainers noted that requests to list tools in anonymously shared projects were handled as the project owner, while the custom-code checks applied to public tool calls did not cover the listing path. Fix analysis

The new implementation sets instantiate_components=False and gets input fields from node types and saved templates. Maintainers reported that, before the fix, anonymously listing tools wrote a test marker file; after the fix, the list was still returned, but no file was written. Comparing 27 built-in starter projects in both modes—54 comparisons in total—also produced identical input schemas. There is also a compatibility change: some tools that previously disappeared because code evaluation failed are now listed, with errors surfaced when they are called. Verification results

This change is especially relevant to deployments that connect flows to coding agents. The official documentation explains that Langflow can expose project flows as MCP tools, which clients select based on their names and descriptions. Projects support API keys, OAuth, or no authentication. Tool descriptions are therefore a distinct access stage, and their side effects and permissions also need engineering review. MCP server documentation

Operators should verify that tool listings, input fields, and actual calls behave consistently after upgrading. The public evidence confirms that an existing component’s code could be triggered through a specific path; it does not establish that anonymous users could inject arbitrary code or that every deployment was affected. Whether custom components are allowed, what the flows contain, and how public access is configured remain key factors in assessing the scope.