# Extension points — langflow-ai/langflow

> Canonical page: https://codevetter.com/unpack/langflow/extension-points

# Extension points — langflow-ai/langflow

Scanned commit 5621dcfd84e11108e4cc1ecb0c51f41053c4211c (2026-09-15). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

Langflow is built to be extended at five seams: (1) component/extension bundles via the `langflow.extensions` entry point + extension.json manifests + seed dirs + components_path; (2) service replacement via `lfx.services` entry points and lfx.toml/pyproject config (auth SSO, authorization/RBAC, catalog policy, model-provider policy, policy bundle); (3) HTTP route plugins via the `langflow.plugins` entry point with conflict-protected registration; (4) CLI plugins via register_cli_command_plugins; (5) enterprise hooks via the lifespan hook registry. Custom components subclass lfx Component and are discovered from directories.
- Route plugins: distributions registering a `langflow.plugins` entry point get a callable register(app) invoked with a _PluginAppWrapper that reserves every existing (path, method), refuses shadowing (RouteConflictError), and rolls back a half-registered plugin's routes on failure. — [src/backend/base/langflow/plugin_routes.py#L66-170](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/plugin_routes.py#L66-L170) [src/backend/base/langflow/plugin_routes.py#L173-234](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/plugin_routes.py#L173-L234) [src/backend/base/langflow/main.py#L1037-1038](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/main.py#L1037-L1038)
- Service plugins: the `lfx.services` entry-point group registers service classes (override=False) and `lfx.toml`/`pyproject.toml [tool.lfx.services]` entries register with override=True; precedence is config > decorator > entry point, SETTINGS_SERVICE can never be overridden, and misconfigured MODEL_PROVIDER_POLICY/POLICY_BUNDLE services refuse to boot rather than fall back. — [src/lfx/src/lfx/services/manager.py#L366-405](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/lfx/src/lfx/services/manager.py#L366-L405) [src/lfx/src/lfx/services/manager.py#L477-558](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/lfx/src/lfx/services/manager.py#L477-L558)
- The OSS authorization layer is a designed plugin seam: LangflowAuthorizationService is a registered pass-through (every check allows) replaced by listing a real plugin class under `authorization_service` in lfx.toml — the same pattern documented for SSO via `auth_service`. — [src/backend/base/langflow/services/utils.py#L615-628](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/services/utils.py#L615-L628) [src/backend/base/langflow/services/authorization/service.py](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/services/authorization/service.py) [AGENTS.md](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/AGENTS.md)
- Component/extension bundles: lfx-* packages ship an extension.json manifest inside the wheel and register a `langflow.extensions` entry point; discovery also scans LANGFLOW_SEED_DIR (default /opt/langflow/bundles) directories; inline bundles can come from components_path parents. — [src/bundles/openai/pyproject.toml#L36-50](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/bundles/openai/pyproject.toml#L36-L50) [src/lfx/src/lfx/extension/discovery.py](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/lfx/src/lfx/extension/discovery.py) [src/lfx/src/lfx/interface/components.py#L875-891](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/lfx/src/lfx/interface/components.py#L875-L891)
- Custom components: subclass lfx.custom.custom_component.component.Component (re-exported as langflow.custom.Component), declare display_name/inputs/outputs, drop the file under a components_path directory; LFX_DEV=1 / LFX_DEV=<modules> enables dynamic hot loading; directory_reader scans the paths. — [src/lfx/src/lfx/custom/custom_component/component.py#L165](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/lfx/src/lfx/custom/custom_component/component.py#L165) [src/lfx/src/lfx/custom/directory_reader/directory_reader.py](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/lfx/src/lfx/custom/directory_reader/directory_reader.py) [src/backend/base/langflow/custom/__init__.py](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/custom/__init__.py) [AGENTS.md](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/AGENTS.md)
- Enterprise lifespan hooks: modules can append async callables to _enterprise_lifespan_hooks['startup'|'shutdown'] at app-construction time; startup hooks run after all services init, shutdown hooks run first in teardown; failures are logged and never block boot. — [src/backend/base/langflow/main.py#L81-99](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/main.py#L81-L99) [src/backend/base/langflow/main.py#L657-703](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/main.py#L657-L703)
- CLI plugins: lfx.cli.command_plugins.register_cli_command_plugins is invoked by the langflow Typer app so installed packages can add CLI subcommands; lfx's own commands are modular register(app) functions per group. — [src/lfx/src/lfx/cli/command_plugins.py](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/lfx/src/lfx/cli/command_plugins.py) [src/backend/base/langflow/__main__.py#L43](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/__main__.py#L43) [src/lfx/src/lfx/__main__.py#L44-52](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/lfx/src/lfx/__main__.py#L44-L52)
- Deployment adapters/mappers: register_builtin_adapters + register_builtin_deployment_mappers import provider modules (e.g. watsonx_orchestrate) which register onto AdapterRegistry singletons — gated behind FEATURE_FLAGS.wxo_deployments. — [src/backend/base/langflow/services/utils.py#L650-683](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/services/utils.py#L650-L683) [src/backend/base/langflow/api/v1/mappers/deployments](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/backend/base/langflow/api/v1/mappers/deployments)
- Sandbox backend plugins: LANGFLOW_SANDBOX_BACKEND_PLUGINS whitelists which entry-point plugins may load an executor backend for code-execution components; the default backend is 'none'. — [src/lfx/src/lfx/utils/sandbox/registry.py#L192-325](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/lfx/src/lfx/utils/sandbox/registry.py#L192-L325)
- Frontend white-label seams: CustomRoutesStore/CustomAuthRoutesStore/CustomRoutesStorePages in routes.tsx let deployments override routes/pages, and icons register via lazyIconImports; the frontend only talks to the backend over HTTP/WS. — [src/frontend/src/routes.tsx#L21-51](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/src/frontend/src/routes.tsx#L21-L51) [docs/agents/ARCHITECTURE.md](https://github.com/langflow-ai/langflow/blob/5621dcfd84e11108e4cc1ecb0c51f41053c4211c/docs/agents/ARCHITECTURE.md)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)