Langflow vs Sim (2026)

Stands at F on breadth across classes. Two structural properties make this stronger than a component count would suggest. Bundles are organised BY SERVICE PROVIDER, so integration breadth grows by provider rather than by hand-built connector, and the MCP client means any MCP-exposed tool becomes callable without Langflow shipping anything. The escape hatches are unusually open even by open-source standards: an API Request component for any endpoint, and full custom Python components for anything else, with the vendor explicitly suggesting a legacy component's code as the starting point for your own. Tool Mode on a component converts it into an agent-callable tool, which is the tool-calling half of this axis and is a clean design. Recorded per section 7: the Apify and similar bundles are Langflow reaching out to third-party services, which counts here and is not evidence of Langflow's own extensibility, graded on Ext.

Stands at F but at medium confidence, and the reason is recorded. Multi-step orchestration is documented beyond doubt: a node graph with typed ports, loops, branching, parsing, type conversion, component grouping for reuse, and freeze to pin upstream state. Multi-agent is the half resting on thinner first-party material. What IS documented is that flows and components can be used as agent tools, so one agent invokes another flow, which is genuine composition. The stateful multi-agent LangGraph integration that would settle this decisively was described only in third-party coverage of the 1.8.4 release and was not confirmed on a Langflow page this pass, so it is not used here. Fetching the Agents section would take this to high confidence either way. Note also that Langflow now ships an ASSISTANT that generates flows and custom components from a prompt, which is a builder aid rather than runtime orchestration and is deliberately not credited on this axis.

Stands at P, and the April grade turns out correct. Two of the three classes are well documented. Events: a dedicated Webhook component with its own POST endpoint per flow, API-key authenticated by default, described by the vendor as the versatile event-driven entrypoint and paired with a Parser for payload extraction. Channels: the Langflow API, an embeddable chat web component for any site, the Playground, and flows exposed as MCP tools that external assistants invoke. THE MISSING CLASS IS SCHEDULES. No scheduler, cron or recurring-run capability appears anywhere in the documented navigation, and the vendor's own trigger documentation covers only the API and webhooks. That is consistent with the product's design, since Langflow expects an external scheduler to call the webhook, but it is a genuine gap against this axis. Would move to F on a documented scheduling surface.

Stands at F. Retrieval is the capability Langflow was built around and it is assembled from first-class parts rather than behind one switch: document loaders, text splitters with configurable chunk size and overlap, embedding models, vector stores as provider bundles, and retrieval components, all connected on the canvas with typed ports. Relevant to the open Knowledge convention, this vendor sits on the MAINTAINED STRUCTURE side but exposes the construction rather than the result, which is a third shape worth naming: the customer builds and owns the index, chooses the store, and can point at a database they already run. Because vector stores are bundles rather than a proprietary layer, the knowledge base can live entirely in customer infrastructure, which pairs with the Dep grade. File management for uploaded documents is documented separately with metadata tracked in the database.

Stands at F, strengthened, and it is now among the best-evidenced Know cells in the lane because the retrieval stack is native rather than an integration. THE MECHANISM IS DOCUMENTED, WHICH ALMOST NOTHING ELSE THIS SESSION MANAGED. Sim's Knowledge Base is described as a native feature using ADVANCED AI EMBEDDINGS AND VECTOR SEARCH TECHNOLOGY, with VECTOR EMBEDDINGS, AUTOMATIC CONVERSION OF TEXT INTO HIGH-DIMENSIONAL VECTORS FOR INTELLIGENT SIMILARITY MATCHING, and semantic search that understands meaning and context rather than matching keywords. THE CONTRAST WITH THE OTHER FULL CELLS TODAY IS WORTH RECORDING. joget and autogpt both reached Full on a Pinecone connector, where the vector store is a customer-supplied dependency and chunking, embedding and refresh are the customer's problem. Here the store is the platform's own and the surrounding controls are documented as their own pages: CONNECTORS, TAGS AND FILTERING, DEBUGGING RETRIEVAL and CHUNKING STRATEGIES. A vendor publishing a chunking strategies page and a retrieval debugging page has built a retrieval product, not a database binding. DEBUGGING RETRIEVAL IS THE PAGE THAT STANDS OUT and it is rare across the index. Most grounding failures are silent: the agent answers confidently from the wrong passage and nobody knows. A documented surface for inspecting what was retrieved and why is the difference between a knowledge base a team can operate and one they have to trust. MULTIPLE KNOWLEDGE BASES PER WORKSPACE are supported for different purposes or departments, and tag-based filtering scopes retrieval within one, so a single corpus can serve several agents with different views of it. The vendor's own framing on the product page is that data stored semantically in Sim is THE MEMORY YOUR AGENTS REASON OVER; that is grounding and is graded here, with agent state graded separately on Mem, and the record keeps the two distinct.

N>F, and the N was badly wrong rather than marginally wrong. Memory is not merely present, it is ON BY DEFAULT: the vendor states that in any project using Chat, memories are always being stored. The Agent component carries built-in chat memory enabled by default and retrieves messages from previous conversations on the same session ID, which is cross-session persistence in the plain sense the axis means. Three properties push this to F rather than P. Sessions are first-class and arbitrary, so using user IDs as session IDs isolates each user's history. Storage is pluggable to external databases rather than trapped in the product. And memory is INSPECTABLE AND EDITABLE from the Playground, where a builder can read, edit and delete stored messages to change how the agent behaves, which is a rarer guarantee than persistence itself. Note for the axis generally: Langflow REMOVED the Memory component category in version 1.5 and folded it into Helpers and Bundles, so a grader searching for a memory category would find nothing. That is very likely how this cell came to be N, and it is a trap worth remembering.

Stands at F, and the July self-flag is resolved. That basis noted THE MEMORY PAGE ITSELF WAS NOT OPENED IN THIS PASS SO CROSS SESSION SEMANTICS ARE GRADED FROM THE SURROUNDING DOCUMENTATION. The Agent block documentation settles it in one sentence. THE DECIDING LINE: MEMORY REQUIRES A CONVERSATION ID TO PERSIST ACROSS RUNS. Persisting across runs is the ruled Full condition, stated by the vendor, with the mechanism named. That is the exact question the July pass left open. FOUR MEMORY MODES ARE DOCUMENTED AS AGENT CONFIGURATION rather than as an integration a customer wires: NONE where each request is independent, CONVERSATION holding full history keyed by a conversation ID, SLIDING WINDOW BY MESSAGES keeping the N most recent, and SLIDING WINDOW BY TOKENS keeping messages up to a token limit. Offering the retention policy as a first-class setting is unusual in this lane, where memory is normally on or absent; here a builder chooses how much history persists and pays for it in context accordingly. THE ACCUMULATION LIMB IS SERVED BY MEM0, documented as enabling agents to MAINTAIN PERSISTENT MEMORY ACROSS WORKFLOW EXECUTIONS, RECALL PAST CONVERSATIONS, REMEMBER USER PREFERENCES, AND BUILD UPON PREVIOUS INTERACTIONS, with add, semantic search and retrieve operations. Zep ships alongside as a second external memory option. SO BOTH LIMBS ARE PRESENT BY DIFFERENT ROUTES: native session-keyed persistence configurable per agent, and accumulating long-term memory through integrations. Tables hold durable structured rows workflows read and write, and Variables carry in-run state, so the platform distinguishes three kinds of state cleanly rather than conflating them. WORTH RECORDING FOR CONSISTENCY: this is the third record today crediting Mem0, after autogpt and joget. In each case it is credited as a documented first-class primitive the customer wires, which the 31 August ruling permits explicitly.

N>F, and unlike Mem this one looks like genuine PRODUCT CHANGE rather than a grading error: HITL is documented as a Langflow 1.11 capability and the record was built in May against roughly 1.8, so N may well have been correct at build time. That distinction matters for the lane note, because it separates records that were graded badly from records that simply aged. Two independent mechanisms earn the F, and the second is unusually granular. The Human Input component pauses at a chosen point and opens one branch per configured user action, so approve and reject route to different downstream paths rather than merely gating. Agent tool approval is finer still: Requires approval is set PER TOOL, so a run pauses only when the agent reaches the specific dangerous tool, which is a more precise control than the whole-run gates most vendors in this lane ship. The checkpoint-and-resume design is also worth noting, since completed steps are not re-executed on resume.

Stands at P, and P is the right shape for a self-hosted open-source product rather than a criticism of it. Real controls exist and are documented: API-key authentication on every flow endpoint, webhook authentication enabled by default with an explicit warning against disabling it, automatic stripping of API keys and tokens from saved flow data, and encrypted storage of component credentials in a variables table. What cannot be present is the other half of the section 7 conjunction. There is no attestation, and there structurally cannot be one that covers a customer's own self-hosted instance, since the operator runs the infrastructure. That is a property of the delivery model, not a deficiency to hold against the vendor, and it is the reason this sits at P rather than N or F. ONE THING A BUYER SHOULD KNOW, recorded because it is first-party: the project's own README carries a standing caution to upgrade past a named remote-code-execution CVE, and third-party coverage reports further unauthenticated RCE-class CVEs during 2026. A visual builder that executes arbitrary Python is a large attack surface and should not be exposed to untrusted networks.

Stands at P. The July basis carried an explicit instruction, RECHECK BEFORE ANY UPGRADE, and this pass performed that recheck and found nothing new. Recording the negative result so the next reviewer does not repeat it. WHAT WAS SEARCHED: sim.ai, docs.sim.ai and the enterprise documentation, anchored on trust centre, SOC 2 and compliance terms. No trust centre, no report request path, no named audit firm, no observation period and no compliance page was found. The SOC 2 and HIPAA claims remain confined to the ai4.sim.ai marketing microsite with type unspecified. The July grade and reasoning stand unchanged. THE CONTROL HALF IS THE STRONGEST OF ANY PARTIAL IN THIS LANE, which is what makes the cell frustrating rather than weak. SAML 2.0 and OIDC single sign-on across Okta, Entra ID, Google Workspace and ADFS. Workspace roles and permission groups enforced at execution time rather than only in the interface. Secrets management. Organisation-wide audit logs. Configurable data retention. Session policies and verified domains. And data drains continuously exporting logs to a customer-owned S3 bucket. THAT LAST ONE IS A GENUINE DIFFERENTIATOR and worth carrying: a customer's security team can pipe activity into their own SIEM rather than reading the vendor's dashboard, which is the form of auditability that survives a vendor outage or a contract ending. WHY IT STILL SITS AT PARTIAL. The bar is a conjunction: an attestation or certification alongside a named control. The controls half is met several times over; the attestation half is asserted on a marketing microsite and nowhere else. Under the hedge ladder that is the asserted-with-no-report rung, the same position as agentx today, and one rung below aigensei's SOC 2-aligned only in that a type is claimed rather than alignment. ONE STRUCTURAL POINT IN THE VENDOR'S FAVOUR, recorded but not credited: the platform is open source under Apache 2.0 and self-hostable, so a customer can inspect the code and run it inside their own controls. That is a different kind of assurance from an attestation and it is graded on Dep and Ext, not here.

Stands at F but confidence drops to medium, because what I verified is run inspection rather than a trace product. Per-component Inspect showing output and logs is genuinely the why rather than the what, since a builder can see what each node in the graph produced and where a run diverged, and that is more than the reporting dashboards several vendors are graded F for. Monitor endpoints expose stored messages programmatically. WHAT I DID NOT VERIFY FIRST-PARTY this pass is the external tracing integration with LangSmith and Langfuse that the record's own prose claims and that third-party coverage repeats; it is not used to support this grade. Also not verified: any audit trail of who changed a flow, which for a self-hosted open-source tool would ordinarily be the operator's responsibility rather than the product's. Fetching the Develop section would settle both. If neither is there, this cell is arguably P.

Stands at F. For an MIT-licensed self-hostable product the residency question answers itself in the strongest possible way: the customer runs the software, so the region, the database and the perimeter are all theirs by construction, and there is no vendor-side data location to negotiate. That is a categorically different guarantee from a SaaS vendor offering region selection, and it should be described that way on comparison pages rather than levelled flat with them. The delivery surface is unusually wide: a documented deployment section, containerised deployment, a Python package, a signed desktop application for macOS and Windows for people who do not want to manage environments at all, and LFX for embedding Langflow as a dependency inside another application. A no-op database mode even allows running with no persistence. Recorded rather than graded: IBM Langflow Cloud is reported by third parties to be in private preview, so the managed path is not yet generally available and the production path today is infrastructure the customer stands up.

Stands at F, and under the 31 August ruling this is a clean case rather than a marginal one. The vendor states that Langflow includes several pre-built templates ready to use or customise, and named templates recur throughout the documentation as the assumed starting point, with instructions repeatedly opening a flow FROM a template rather than from blank. That is packaged assets the customer adopts, which is the operative bar, and the browsable-gallery question does not arise. Two further layers sit alongside: grouped components can be saved to the component menu as reusable custom components, and flows import and export as JSON so a team or the community can circulate finished assets. Not counted here, deliberately: the Langflow Assistant generates flows and components from a prompt, which is generation rather than a supplied asset, and crediting it would blur the axis.

Stands at F. Model choice is a per-node property here rather than an account setting, so different steps of one flow can run on different providers, and the Language Model component's provider and model fields are the ordinary way to configure any LLM step. Local models via Ollama matter for the same reason Dep does: combined with self-hosting they let the entire stack run inside the customer's boundary with no external inference at all, which very few vendors in this lane can offer. Provider bundles mean the roster grows by integration rather than by vendor permission, and custom Python components mean an unsupported provider is a component away. Not to be confused with the Ext credit for exposing flows as MCP servers, which is the opposite direction of travel and is graded there.

Stands at F and the provider list is broader than the July basis recorded, now taken from the Agent block reference rather than summarised. THIRTEEN PROVIDERS ARE NAMED IN THE BLOCK DOCUMENTATION: OpenAI, Anthropic, Google Gemini, xAI Grok, DeepSeek, Groq, Cerebras, AZURE OPENAI, AZURE ANTHROPIC, GOOGLE VERTEX AI, AWS BEDROCK, OpenRouter, and local models through Ollama or VLLM. Selection is per Agent block from a model combobox where the builder can type or select any supported model. THE THREE HYPERSCALER ROUTES ARE THE ENTRIES THAT MATTER MOST and were not in the July list. Azure OpenAI, Azure Anthropic, Vertex AI and Bedrock let a customer consume frontier models through a cloud contract they already hold, under their existing data processing terms and commit spend. For a regulated buyer that is frequently the only permitted route to a given model, and a platform that omits it forces a procurement conversation that has already been had. THE ECONOMICS ARE DOCUMENTED AND UNUSUALLY CLEAN: bring your own key bills at base provider pricing WITH NO MARKUP, while hosted keys carry a 1.1x multiplier, and local models through Ollama or VLLM incur no API cost at all. Publishing the exact spread between routes lets a customer decide on cost rather than guess, and no-markup BYOK means the platform takes nothing on inference. THE GOVERNANCE LAYER IS THE PART FEW COMPETITORS HAVE: enterprise permission groups restrict WHICH PROVIDERS ARE ALLOWED, enforced at execution time and not only in the interface. So an organisation can permit Bedrock and forbid direct OpenAI across every agent its teams build, which is model choice bounded by policy rather than left to each builder. Combined with the fully offline self-hosted path credited on Dep, a customer can run the platform and its models entirely inside their own infrastructure.

Stands at F and clears Mike's 30 August Ext bar on multiple routes. The distinguishing property is that extensibility runs BOTH WAYS through MCP, which few vendors in this lane manage: Langflow exposes flows as an MCP server so external clients call them as tools, and connects outward to external MCP servers as a client. Under section 7 the server direction credits Ext and the client direction credits Int, and they are graded separately here rather than one fact doing double duty. Beyond MCP, every flow is callable over a documented REST API, flows import and export as JSON so an agent definition is a portable artifact, custom components are authored in Python, and an embeddable chat web component ships for front-end integration. LFX is a separately documented package for running flows as a dependency.

Stands at P. The debugging surface is genuinely good and better than several vendors graded higher elsewhere: a Playground for interactive testing, single-component runs that execute one node in isolation without its upstream dependencies, per-component output and log inspection, freeze to pin upstream state while iterating on one node, editable and deletable message logs so a tester can reshape history and observe the effect, and backup flows created automatically before breaking component updates. What is absent is the F bar as this lane has set it. There is no evaluation product: no scoring, no test-case generation, no regression suite, no benchmarking, nothing that measures one version against another. Compare lyzr, which earns F on an LLM-as-a-judge evaluator with production-readiness scoring, and stackai on the same shape. This is debugging, not evaluation, and the distinction is the axis. Recorded honestly: version 1.12 is in preview and this is a fast-moving open-source project, so the cell is worth re-checking each sweep.

Stands at F, and the July self-flag is resolved. That basis recorded honestly that THE EVALUATOR PAGE ITSELF WAS NOT OPENED IN THIS PASS SO DEPTH IS GRADED FROM ITS FIRST CLASS PLACEMENT IN THE BLOCK SET. The page is now open and the depth holds up. WHAT THE BLOCK ACTUALLY DOES: it USES AI TO SCORE AND ASSESS CONTENT QUALITY AGAINST CUSTOM METRICS, where the customer defines each metric with a name, a description and a numeric range, the documented examples being accuracy, clarity and relevance on one-to-five scales. THE SCHEMA ENFORCEMENT IS THE DETAIL THAT MAKES IT AN INSTRUMENT RATHER THAN A PROMPT. The Evaluator GENERATES A JSON SCHEMA RESPONSE FORMAT BASED ON YOUR METRICS AND ENFORCES STRICT MODE, SO THE LLM IS CONSTRAINED TO RETURN ONLY THE EXPECTED METRIC SCORES AS NUMBERS, NO EXTRA TEXT OR EXPLANATIONS. Numbers rather than prose is what makes a score comparable at all, and it is the difference between this and the model-as-judge pattern held at Partial on snaplogic. THE COMPARISON LIMB IS DOCUMENTED EXPLICITLY: the block is described as suited to QUALITY CONTROL, A/B TESTING, and one of its named use cases is A/B TESTING CONTENT, COMPARE MULTIPLE AI-GENERATED RESPONSES. The guidance also states CONNECT WITH AGENT BLOCKS: USE EVALUATOR BLOCKS TO ASSESS AGENT BLOCK OUTPUTS AND CREATE FEEDBACK LOOPS, so the subject being scored is the agent's own behaviour on the customer's own work, which is exactly what the ruled bar asks. A WORKED PATTERN IS PUBLISHED: Agent generates, Evaluator scores, Condition checks a threshold, then publish or revise. That is a quality gate with a readable numeric result driving control flow. THE HONEST LIMIT, and it is why this is not the strongest Eval cell in the index: comparison is between candidate outputs within a run, not across agent versions over time. No retained test set, stored expected outputs or regression run history is documented, which is what agentx has and this does not. Debugging is separately strong through block-by-block run traces, knowledge base retrieval debugging and per-run cost.

P>N, the one downward correction and the same axis error the Coding agent lane corrected thirteen times, appearing here in a different disguise. Nothing first-party drives a browser. What exists is a Web Search component that the vendor's own documentation describes as WEB SCRAPING subject to rate limits, plus an API Request component, plus provider bundles. Fetching pages over HTTP is not operating software that lacks a programmatic interface. Two near-misses were checked and refused. The Apify bundle brokers a hosted RAG Web Browser actor, but under section 7 that is Apify's capability reached through an integration, not Langflow's, in the same way Zapier exposing Motion actions was not Motion's extensibility. And community projects wiring the browser-use library into Langflow as a custom component are third-party work, not shipped product; the fact that this requires a custom component is itself evidence of absence. Confidence is medium because the component catalogue is large and version 1.12 is already in preview, so a first-party browser component could appear.

P>F, and this is a consistency correction rather than new evidence. The July basis found the capability and then withheld Full on a bar that does not exist. ITS REASONING, VERBATIM: the browser engine is AN INTEGRATED THIRD PARTY RATHER THAN SIM'S OWN, SO THE CAPABILITY IS DELIVERED BUT NOT FIRST PARTY. That test appears nowhere in the axis definition, which asks whether an agent operates software the vendor does not control because no programmatic interface exists. It asks what the customer can do, not who wrote the driver. THE INDEX DOES NOT APPLY THAT BAR ANYWHERE ELSE, which is what makes it an invented one. Model cells credit vendors for OpenAI and Anthropic models they did not build. Know cells credited joget and autogpt for Pinecone integration. Mem cells credit Mem0 across three records including this one. Penalising a third-party engine only on Comp would single out one axis for a rule the other thirteen do not carry. THE DECIDING PRECEDENT IS FROM EARLIER TODAY AND IS THE SAME ENGINE. autogpt moved N>F on a Stagehand Blocks section in its documentation, Stagehand being Browserbase's framework built on act, extract and observe. Sim ships FIRST CLASS BROWSER USE AND STAGEHAND INTEGRATIONS in its tools catalogue, with Apify and Bright Data alongside. Same engine, same integration shape, same product category, reviewed the same day. Grading them differently would have been indefensible. WHAT THE CUSTOMER ACTUALLY RECEIVES is the test that matters: a workflow block that drives a real browser against an interface with no API, composable beside the other thousand integrations. Browser Use and Stagehand both perform navigation and action rather than retrieval alone, which is the line held against scraping on ai-library, pickaxe and joget this session. Recorded for the lane: fifth genuine Comp positive in Agent builder, after sema4-ai, kalcend, integrail and autogpt, and the second resting on Stagehand.