LangGraph vs Strands Agents

LangGraph 60

The library sends nothing according to the data-storage page, re-read on 1 November. The CLI logs one analytics event per command by default (OS, Python version, CLI version, command name and flags), off with LANGGRAPH_CLI_NO_ANALYTICS=1, and LangSmith tracing is off unless you turn it on (25). Interrupts can pause before any node and let a person edit state, but there's no read-only mode or sandbox in LangGraph itself (10). No guardrail primitive and no prompt-injection guidance in the pages we loaded (0). LangSmith tracing, opt-in (10). LangChain's organisation SECURITY.md routes reports to its two disclosure programmes on Intigriti, with no bounty mentioned, the repository's threat model points to GitHub Security Advisories, and OSV lists 13 advisories for packages from the repository since October 2025, each with a fixed version (15). Framework reading, so SOC 2 isn't scored.

Strands Agents 89

Framework reading (telemetry defaults, approvals, guardrails, sandboxing). No usage analytics found in either SDK, and OpenTelemetry is opt-in (25). Interrupts and the harness's interventions gate tool calls behind human approval or Cedar policies, but the default sandbox is the local host (16). Guardrails, PII redaction and trusted message history pages, with Bedrock Guardrails integration (13). OpenTelemetry traces for every model and tool call (15). The AWS Vulnerability Disclosure Program on HackerOne and three advisories in October 2026 published with fixed versions (20). 25+16+13+15+20 = 89.

LangGraph 70

No MCP client in LangGraph. It comes from LangChain's langchain.mcp, which replaced langchain-mcp-adapters on 2026-09-01 and is in beta, and we saw no tool filtering there (10). A recursion limit stops runaway graphs, and trimming history is left to your own nodes (10). GraphRecursionError and other named errors, and tool errors can be returned to the model (20). Per-node retry policies and checkpointed resume (20). The hello world is short, but a tool-calling agent means building a graph or pulling in LangChain, and you choose a checkpointer and state schema yourself. Python and TypeScript (10).

Strands Agents 87

Framework reading. An MCPClient is passed straight to the agent in a few lines and its lifecycle is managed, with tool filtering per client (22). Conversation managers, turn limits, token budgets and cancellation bound each run (20). Stop reasons and typed events, and hooks that can retry a model or tool call (16). Retry strategies, session managers that persist and resume a conversation, and interrupts that resume where they paused (17). Two official languages, but the default provider is Bedrock, which needs AWS credentials and model access (12). 22+20+16+17+12 = 87.

LangGraph 75

Official packages on PyPI (Requires-Python >=3.10 in the pyproject at 1.2.19) and npm (node >=18, per the 1 October check) (20). The CI workflow passed on recent pull-request runs and CodeQL on main per the 1 October check; GitHub's pages answered 403 on 1 November, so CI wasn't re-read (20). 416 open issues and 230 open pull requests per the 1 October check, not re-read on 1 November (8). Seven 1.2.x patch releases since 1.2.12 with conventional commit messages, but 1.2.18 (26 October) carries a commit marked breaking (feat(langgraph)!, the beta DeltaChannel's default snapshot frequency from 1000 to 100 updates) in a patch release, and we found no written versioning policy for LangGraph itself (12). 1.2.19, classed 5 - Production/Stable (15).

Strands Agents 87

Local-package reading. Official PyPI and npm packages with Python 3.10 and Node 22 stated (20). A public CI workflow runs lint, type checks, unit and integration tests for each package on pull requests to main, plus security-audit workflows, and the latest Python, TypeScript, harness and MCP runs on main passed on 6 November (25). 664 open issues and 1,151 open issues and pull requests on 6 November, with 545 issues opened in the 90 days to 3 November. Of the 50 newest, 12 had a comment and 15 were closed, and 9 of the 40 newest open items carry a bug label. An issue-responder workflow runs on new issues (12). A written semantic versioning policy, experimental APIs kept apart, and deprecations removed only at a major (15). 1.0 since 15 July 2025 (15). 20+25+12+15+15 = 87.

LangGraph 81

MIT (30). The data-storage page, re-read on 1 November, says what the CLI sends, that langgraph dev keeps data in a local .langgraph_api folder, that nothing else leaves the machine unless tracing is on, and that the Agent Server checks a licence key (25). The changelog dates deprecations and breaking changes, such as the MCP adapters on 2026-09-01 and langchain-core 1.7.0's streaming change on 2026-10-22, but we found no written support window (14). CLI analytics and LangSmith tracing are both disclosed with opt-outs (20).

Strands Agents 72

Apache-2.0 (30). A library that stores session state where the developer configures it. The default FileSessionManager kept sessions world-readable in /tmp until 1.48.0, which the October advisories record and fix (20). A written deprecation policy with warnings and removal at majors, without a dated support window (16). Telemetry is opt-in and documented (20). 30+20+16+20 = 86.

LangGraph 89

A typed graph API with a reference site (25). llms.txt at docs.langchain.com, per the listing's earlier check (10). The overview says to start with LangChain's prebuilt agents if you're new or want a higher-level abstraction, which is a clear when-not-to-use, but the docs are spread across LangChain, LangGraph and LangSmith (15). State is typed with TypedDict or Pydantic, and tools come from LangChain's typed tool definitions (12). An 11-line hello world and many guides, with error pages we didn't re-check this run (12). Dated changelog (15).

Strands Agents 95

Framework reading. Typed Python and TypeScript APIs with a reference for each (25). llms.txt with a Markdown twin of every page (10). The llms.txt and docs say when to use Strands over a hand-written loop and when to take the harness rather than the SDK (18). Tools are typed from decorated functions or Zod schemas (15). Python and TypeScript examples on every page, stop reasons and hook events documented, with no catalogue of exceptions (12). Versioning page and tagged releases per package (15). 25+10+18+15+12+15 = 95.