LangChain for Python 1.4

Apply the Python 3 baseline first. These rules apply to LangChain for Python 1.4 on the CPython minors up to 3.14 that still receive security fixes; 1.4 also installs on 3.10, which reached end of life on 2026-10-01. They cover agents built with create_agent, tools, the langchain.mcp adapter added in this line, middleware, human approval, structured output, retrieval and memory, tracing, and deployment.

Agent construction and runtime context

• Build model, system_prompt, tools, middleware, response_format, context_schema, checkpointer, and store from trusted application configuration, never from request bodies or model output.
• Keep PromptTemplate and ChatPromptTemplate template text trusted and pass user content as variables; prefer template_format="f-string" and never accept untrusted Jinja2 templates despite their best-effort sandbox.
• Use langchain_core.load.load() and loads() only for trusted serialized objects with a narrow allowed_objects list; keep secrets_from_env=False and the default init_validator, and parse request data as inert JSON instead.
• Treat prompts loaded with langsmith.Client().pull_prompt(), pull_prompt_commit(), or langchain_classic.hub.pull() as executable configuration that can set a model's base_url, headers, and secret references: keep the refusal of public owner/name pulls that langsmith 0.8.0 made the default, never pass dangerously_pull_public_prompt=True, include_model=True, or secrets_from_env=True for a prompt you have not reviewed, pull a pinned name:commit_hash, and