static audit · 2026-10-26T03:53:55.745Z

langflow-ai/langflow

120 source files scanned · 11 LLM call site(s) · ~0% of LLM spend looks recoverable (static heuristics · repo looks like a library)

Library/SDK layout detected (installable Python package with src/ layout and no app entry point): call sites are most likely pass-through wrappers where the caller chooses the model and prompt, so findings are downgraded one level and the estimate is discounted.

badge   ![TokenZero audit](https://tokenzero.sh/v1/badge/audit/aud_XWzTN8z9KhRiuuYnROxdxA.svg)

repo badge   [![LLM spend audited by TokenZero](https://tokenzero.sh/v1/badge/repo/langflow-ai/langflow.svg)](https://tokenzero.sh/audit/langflow-ai/langflow)

Models referenced

none detected

Findings

SeverityWhereFindingEst.
lowsrc/bundles/anthropic/src/lfx_anthropic/components/anthropic/anthropic.py:169LLM call inside a loop
Per-item calls repeat the full prompt prefix for every element. If items are independent and latency-tolerant, the provider Batch API is 50% cheaper, and OpenAI Flex processing (`service_tier: "flex"`) gives the same 50% on ordinary calls without restructuring; if the prefix is shared, caching pays off immediately.
Fix: Batch where possible, or set `service_tier: "flex"` on OpenAI calls that can wait; otherwise keep the shared prefix cache-formatted (TokenZero does this automatically).
25%
lowsrc/bundles/google/src/lfx_google/components/google/google_generative_ai.py:119LLM call inside a loop
Per-item calls repeat the full prompt prefix for every element. If items are independent and latency-tolerant, the provider Batch API is 50% cheaper, and OpenAI Flex processing (`service_tier: "flex"`) gives the same 50% on ordinary calls without restructuring; if the prefix is shared, caching pays off immediately.
Fix: Batch where possible, or set `service_tier: "flex"` on OpenAI calls that can wait; otherwise keep the shared prefix cache-formatted (TokenZero does this automatically).
25%

Fix all of it with one line

OPENAI_BASE_URL=https://tokenzero.sh/v1
ANTHROPIC_BASE_URL=https://tokenzero.sh

Keys pass through untouched. Cache formatting and exact caching are on by default; cascade routing stays opt-in. How it works