A platform team at a fintech has standardised on LangChain. Agents are built with create_agent, deployed and traced through LangSmith, and every model call routes through the LangSmith LLM Gateway under a $2,000-a-month cap on the R&D workspace. When a coding agent gets stuck in an overnight retry loop, the gateway returns a 402 and the violation lands in the trace. That is a real control plane, and it works because the team owns the whole path.
Down the hall, the security lead has a different list. Four hundred engineers run Claude Desktop and Cursor. Sales runs a Notion assistant somebody connected six months ago. Nobody on the platform team built any of it, none of it imports langchain, and none of it will ever route through a base URL the platform team controls.
Both problems are governance. They are not the same perimeter, and that is the whole comparison.
LangChain is an MIT-licensed open-source agent framework plus LangSmith, which LangChain describes as "the framework agnostic agent engineering platform for observing, evaluating, and deploying agents." Its enforcement lives in three places it owns: composable middleware inside the agent process, Deployment and Fleet for agents run on its infrastructure, and the LLM Gateway, which its own product page defines as "the governance layer between your agents and model providers." Waxell is an AI control plane organised around surfaces rather than around a stack. The MCP Gateway is one MCP endpoint per tenant that Claude Desktop, Claude Code, Cursor or any MCP client points at, so tool calls from agents nobody built are identity-resolved and policy-checked before an upstream sees them. Observe instruments the agents you do build; Endpoints reaches the laptop. LangChain governs the path it owns, very well. Waxell governs the paths that already exist.
What LangChain is built for
LangChain is the most widely adopted way to build an agent, and in 2026 it is no longer only a framework. Its governance story is substantially stronger than its reputation as "just a library" suggests.
Enforcement starts in the framework, in code. LangChain's framework page describes middleware as a way to "extend agent behavior through middleware without rewriting core logic. Add human-in-the-loop approval, compress long conversations, or remove sensitive data — all with simple, composable hooks." The prebuilt list includes HumanInTheLoopMiddleware, which pauses on named tools via interrupt_on with approve, edit or reject decisions; PIIMiddleware, with redact, mask, block and hash strategies plus custom detectors; ToolCallLimitMiddleware and ModelCallLimitMiddleware for runaway loops; and ModelFallbackMiddleware. Anyone claiming LangChain has no enforcement primitives has not read the middleware docs.
The LLM Gateway is a real enforcement point, not a dashboard — and LangChain labels it Public Beta. Every gateway docs page carries the banner "Beta: The LLM Gateway is in beta," and LangChain's product FAQ says it is "currently available in Public Beta," included with Plus and Enterprise plans, with "complete GA pricing" to follow. What it does today it does properly. A spend policy "blocks any request that would push spend past the cap, returning a 402 response," evaluated across organization, workspace, API key and user scopes over hourly, daily, weekly or monthly windows, with LangChain's docs describing "sub-second enforcement latency" and most-restrictive-wins conflict resolution. Blocked requests are traced with the violation as metadata and surface as issues in LangSmith Engine. Data-protection policies scan outbound requests using Presidio for named entities and pattern rules for structured identifiers, redact secrets across a long provider list, then de-redact the placeholders in the response so agent behaviour is not broken. Scanner failures are documented as fail-close.
Fleet is where LangChain's tool-layer governance lives. Fleet's access-and-oversight documentation describes role permissions on MCP servers — mcp-servers:read, invoke, create, update, delete — attribute-based policies over tagged mcp_server and fleet_integration resources, a workspace integration gate, and a published evaluation order: ABAC deny, then RBAC, then ABAC allow. There is a central approval inbox. This is genuine tool-call governance, better specified than most of the category.
The gateway reaches coding agents. LangChain documents pointing Claude Code, Codex CLI, Gemini CLI and Deep Agents Code at the gateway with a base-URL swap, distributed by MDM for company-wide rollout. Its July 20, 2026 essay Building Governed Agents argues the tool layer matters: "For agents, the greatest risk is often not what the model says, but what the agent can do." Waxell agrees with the premise.
Where the two architectures diverge
The unit of control. LangChain's LLM Gateway is scoped to the model call by design — its page is titled "Control every model call," and adoption is a base_url swap. Waxell's MCP Gateway is scoped to the tools/call: one URL per tenant in front of the upstreams a tenant has configured, with every call that traverses it identity-resolved, policy-checked, fingerprinted and logged before the upstream sees it, and the result checked again on the way back. Neither unit is better in the abstract. They catch different things.
LangChain's own docs are precise about the gateway's coverage boundary. Under "what it does not cover," the data-protection page states that "system prompts, developer prompts, and tool-call arguments are not scanned"; that provider responses are not redacted, with "streaming response redaction in progress"; and that traces written directly to the LangSmith API, bypassing the gateway, are not scanned. It adds that if the requirement is preventing PII from entering the platform at all, "gateway redaction alone is not sufficient." That is unusually candid documentation, and it draws the perimeter more clearly than a competitor could.
Those are limits of the gateway, not of LangChain. The open-source PIIMiddleware runs inside the agent process, and with apply_to_output=True it redacts streamed wire output — text deltas, tool-call arguments, tool outputs and state snapshots. A team that wants both surfaces covered can compose the middleware and route through the gateway; the point is that the two controls sit in different places and are bought and operated differently.
Who has to be inside the stack. Fleet governs Fleet's agents — its remote-MCP page notes that "LangSmith Fleet doesn't execute these tools itself, it forwards requests to the MCP server." Deployment governs agents deployed on Deployment. Middleware governs agents whose source you can edit. Waxell's gateway inverts the requirement: an MCP client points at a URL, and the desktop assistant its user installed is governed without anyone touching agent code. LangChain's coding-agent guide notes the friction of the alternative on those same clients — "Claude Desktop plugins break when the gateway is configured," and Claude users on a paid plan, Plus and Max, "are not yet supported."
The device. Endpoints is a signed macOS and Windows agent that reads the plaintext hostname from the TLS handshake without decryption, inventories AI apps against a catalog of 60+ provider domains per device and per user, and supports three postures: observe-only by default, block at the network layer, or opt-in capture with on-device redaction. It deploys through Hexnode, Jamf, Kandji, Mosyle or Intune. The failure mode it addresses is specific: an engineer pastes a customer record into a desktop assistant that routes straight to a provider API over port 443, invisible to the web proxy, the EDR and the gateway alike. Waxell's Endpoints page puts the cost of that gap at an average of $670,000 added to breach costs from shadow AI. On either vendor's own account of itself, this is a surface neither a gateway nor a framework is positioned to reach.
Both vendors gate governance behind tiers — differently. LangChain's administration docs state that "RBAC is a feature that is only available to Enterprise customers," with other plans defaulting to the Admin role for all users; Fleet's tool access control is likewise "an Enterprise feature"; and gateway Data Protection controls are Enterprise-only and request-gated. Waxell's published table puts Base governance on Free and Team, Advanced on Business at $199/mo, and adds Compliance at Enterprise. The difference is where the first governed tool call sits: Waxell's Free tier includes one governed MCP upstream and 10,000 traced executions; LangChain's Developer tier is one seat and 5,000 base traces, with LLM Gateway controls beginning on Plus at $39 per seat.
What Waxell adds
The MCP Gateway resolves each call to a real user identity rather than a service account, across three auth modes — on-behalf-of OAuth, a shared service account, or a bring-your-own token held in the credential broker. Deactivating a Waxell account revokes that person's per-upstream OAuth grants in one transaction and records the unwind in an audit log that is durable, CSV-exportable, and stores no payloads. Rule changes propagate to the fleet within 30 seconds. When a call is parked for human approval the gateway holds the MCP connection open with progress notifications, so the agent waits rather than times out; a denial returns a structured error it can recover from. Tools are tracked through five fingerprint states — Pending review, Drift detected, Trusted, Blocked, Removed — so a definition that changes after review resurfaces for an admin instead of staying trusted.
Observe instruments the agents you build in two lines with zero config — the product page states 200+ frameworks, LLMs and vector DBs, auto-instrumented for Python — and enforces 50+ policy categories that include operational ones — rate limits, cost, kill switches, delegation — alongside safety and privacy.
Feature comparison
| Capability | Waxell | LangChain / LangSmith |
|---|---|---|
| Enforcement point | ||
| Spend / cost policy in the request path | ✅ Cost is one of the 50+ categories; Runtime gates each step before it executes | ✅ Yes (402 response, sub-second enforcement, 4 scopes, 4 windows — gateway in Public Beta) |
| Rate limiting | ✅ Yes | ✅ Yes (gateway policies; ToolCallLimitMiddleware in OSS) |
| PII redaction on outbound model requests | ✅ Yes | ✅ Yes (Enterprise, request-gated; Presidio + pattern rules) |
| Redaction of provider responses | ✅ Result checked on the return path | ⚠️ Gateway: "not redacted", "streaming response redaction is in progress"; OSS PIIMiddleware can redact streamed output |
| Tool-call arguments scanned | ✅ Per-tool PII scan modes | ⚠️ Gateway: "system prompts, developer prompts, and tool-call arguments are not scanned"; OSS PIIMiddleware covers tool-call args with apply_to_output=True
|
| Human approval on sensitive tool calls | ✅ Gateway parks the call, holds the connection open | ✅ Yes (Fleet inbox; HumanInTheLoopMiddleware in OSS) |
| In-code enforcement primitives | ⚠️ Policy is configured, not composed | ✅ Yes (composable middleware, MIT-licensed) |
| Kill switches | ✅ Yes (Runtime: "stop any agent, any workflow, any session") | ⚠️ Call-limit and fallback middleware; not framed as a kill switch |
| Perimeter | ||
| Governs assistants you did not build | ✅ Yes (one MCP URL — Claude Desktop, Claude Code, Cursor) | ⚠️ Coding-agent model calls via base-URL swap; docs note Claude Desktop plugins break and Claude Plus/Max are not yet supported |
| Governs tool calls to third-party MCP upstreams | ✅ Yes (broker; policy before upstream, check on return) | ✅ Yes, for Fleet agents (RBAC + ABAC + workspace gate) |
| Governs agents built in any framework | ⚠️ Observe instruments Python frameworks | ✅ Observability is framework agnostic (OTel; Python, TS, Go, Java SDKs) |
| Shadow AI on employee devices | ✅ Yes (Endpoints, 60+ domains, macOS + Windows, MDM) | ⚠️ Not described in LangChain's published product line |
| Managed execution runtime | ✅ Runtime | ✅ Deployment (durable runtime, registry, rollbacks, A2A/MCP) |
| Isolated sandbox for agent-generated code | ⚠️ Not a named product | ✅ Sandboxes (microVM isolation, Auth Proxy) |
| Build-side | ||
| Open-source agent framework | ❌ Bring your own framework | ✅ LangChain + LangGraph, MIT-licensed |
| Evaluation / LLM-as-judge tooling | ⚠️ Quality policy category | ✅ Yes (core strength) |
| Automated failure triage | ⚠️ Not offered as a product | ✅ Engine (clusters issues, proposes fixes) |
| Commercials | ||
| Self-serve signup | ✅ Yes | ✅ Yes |
| Governed tool call on the free tier | ✅ Yes (1 MCP upstream) | ⚠️ Gateway controls begin on Plus ($39/seat) |
| Governance included below Enterprise | ✅ Base on Free and Team, Advanced on Business | ⚠️ RBAC is "only available to Enterprise customers"; Fleet tool access control is "an Enterprise feature" |
| Published prices | ✅ Free / $49 / $199 / Custom | ✅ $0 / $39 per seat / Custom, plus LCU and LSU metering |
When to use LangChain
- You want the framework, durable runtime, evals, deployment and gateway from one vendor.
- Model spend is the acute problem and you want hard caps by org, workspace, key and user — and you are comfortable adopting a component LangChain currently labels Public Beta.
- You want enforcement expressed as code engineers compose and test, rather than a policy console.
- You are an Enterprise buyer, where RBAC, ABAC, SCIM and gateway data protection are included.
When to use Waxell
- The agents you most need to govern are ones your team did not write and will not instrument.
- You need the tool call itself brokered: identity resolution to a real person, approval parking, and an audit record that stores decisions rather than payloads.
- Offboarding has to revoke upstream grants in one action rather than across a dozen admin consoles.
- Your shadow-AI exposure includes desktop assistants that will never cross a corporate gateway.
- You want a governed tool call on the free tier, before anyone signs anything.
How Waxell handles this
Waxell's MCP Gateway gives an organisation one MCP endpoint per tenant. Any MCP-compatible client — Claude Desktop, Claude Code, Cursor, a custom agent — points at that URL instead of at each upstream, and from that moment every tool call crossing the gateway is resolved to a real person, checked against tenant policy before the upstream sees it and again on the way back, fingerprinted through five review states, and written to a durable audit log. Rule changes reach the fleet in about 30 seconds, and calls that need a human park without timing out. Observe adds two-line instrumentation and 50+ policy categories for the agents you write; Endpoints inventories and governs the AI already running on employee machines, with capture off until an admin turns it on.
FAQ
Is Waxell a LangChain alternative?
Not directly — they solve adjacent problems. LangChain is a framework plus an agent engineering platform; Waxell is a governance control plane with no framework of its own and an explicit bring-your-own-framework stance. The overlap is real at the gateway, where both enforce policy in the request path. Choose by perimeter: if the agents you need to govern are ones your team builds and deploys, LangChain covers more of that lifecycle; if they are assistants and tools nobody on your team built, Waxell's unit of control fits better.
Does LangSmith block anything, or does it only observe?
It blocks. LangSmith's LLM Gateway — which LangChain currently labels Public Beta — applies spend policies that return a 402 and reject the request when a cap would be exceeded, with LangChain's documentation describing sub-second enforcement latency, and data-protection policies that redact PII and secrets from outbound requests before they reach the provider. In the open-source framework, HumanInTheLoopMiddleware pauses named tool calls for approval and PIIMiddleware supports a block strategy. Treating LangSmith as observability-only is out of date.
Can LangSmith govern Claude Desktop or Cursor?
Partly, and the boundary is worth reading in LangChain's own docs. The gateway supports pointing coding agents including Claude Code, Codex CLI and Gemini CLI at its endpoint via a base-URL swap, which brings their model calls under spend, rate and data policies. LangChain's guide also notes that "Claude Desktop plugins break when the gateway is configured" and that Claude users on a paid plan, Plus and Max, "are not yet supported." Waxell's MCP Gateway approaches the same clients from the tool-call side rather than the model-call side, which is why it works through an MCP endpoint rather than a provider base URL.
What does LangSmith's gateway redaction actually cover?
LangChain documents this precisely. Redaction applies to outbound request content before it leaves the gateway, and the redacted form is what appears in traces. It does not cover provider responses — streaming response redaction is described as in progress — and it does not cover system prompts, developer prompts or tool-call arguments. Traces written directly to the LangSmith API, bypassing the gateway, are not scanned. LangChain notes that preventing PII from entering the platform by any route requires ingestion-level redaction, which it describes as a separate capability. Some of those gaps close inside the agent process rather than at the gateway: the open-source PIIMiddleware redacts tool-call arguments, tool outputs and streamed text when configured with apply_to_output=True.
Can I run both?
Yes, and for teams already standardised on LangChain that is the likely shape. LangChain's gateway governs model calls for the agents your team builds; Waxell's gateway governs the tool calls those and other MCP clients make, including ones outside your stack; Endpoints covers devices. Waxell instruments agents rather than replacing the framework they were written in.
Sources
- LangChain, "LangSmith LLM Gateway" — accessed August 10, 2026
- LangChain, "LangSmith: The Agent Engineering Platform" — accessed August 10, 2026
- LangChain, "LangChain: Open Source AI Agent Framework" — accessed August 10, 2026
- LangChain, "LangSmith Plans and Pricing" — accessed August 10, 2026
- LangChain (Martha Janicki), "Building Governed Agents: A Framework for Cost, Control, and Compliance" — July 20, 2026
- LangChain, "LLM Gateway — Data protection" — Docs by LangChain, accessed August 10, 2026
- LangChain, "LLM Gateway — Spend policies" — Docs by LangChain, accessed August 10, 2026
- LangChain, "LLM Gateway — Set up coding agents" — Docs by LangChain, accessed August 10, 2026
- LangChain, "Fleet — Access & oversight" — Docs by LangChain, accessed August 10, 2026
- LangChain, "Fleet — Remote MCP servers" — Docs by LangChain, accessed August 10, 2026
- LangChain, "Organization — Administration overview" — Docs by LangChain, accessed August 10, 2026
- LangChain, "Prebuilt middleware" — Docs by LangChain, accessed August 10, 2026
Originally published on the Waxell blog.
Most of the AI in your organisation was installed by someone who never asked you. Start free with the Waxell MCP Gateway.
Top comments (0)