Haystack
A Python framework for composing controlled, production-ready LLM pipelines and agent workflows.
- Source repo
- deepset-ai/haystack
- Stars
- ★ 27k
- Last updated
- today
- License
- Apache-2.0
- Primary language
- Python
- FA score
- 52/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformOpenAI API
- Cost
- Free software; you pay for model usage
- Setup effort
- Low · running in minutes
- You'll need
- Typical use
- A Python team building a RAG question-answering system that needs document retrieval, ranking, and generation as separately inspectable steps.
- Not a fit if
- Teams needing out-of-the-box REST API or MCP serving, which requires Hayhooks
- Developers building in languages other than Python
- Source review
- 52/100 · Major gaps 2 safety controls not found
What does this agent do, and when should you use it?
Haystack is an open-source AI orchestration framework for building production-ready LLM applications in Python. Its named execution primitives include Pipeline, which runs synchronously or asynchronously and streams token by token, and Agent, which can execute concurrent tool calls. Developers compose retrieval, ranking, filtering, memory, tools, routing, and generation into workflows with loops, branches, and conditional logic. The project supplies components for retrieval, indexing, tool calling, memory, and evaluation, while supporting custom components through a consistent interface. It targets RAG, semantic search, question answering, multimodal applications, and autonomous agents; for REST API or MCP-server delivery, the README points to the companion Hayhooks project.
An application connects built-in or custom components in a Pipeline to retrieve, rank, filter, combine, structure, and route context before model generation or tool calls. Pipeline runs synchronously or asynchronously and can stream token by token, while Agent can run tool calls concurrently. Agent behavior can be extended with before_llm, before_tool, and on_exit lifecycle hooks, while step_count, token_usage, and tool calls are tracked. SkillToolset can introduce skill descriptions into context only when needed, and Agent Pack includes ready-made agents such as a deep research agent and an advanced RAG agent.
- A Python team building a RAG question-answering system that needs document retrieval, ranking, and generation as separately inspectable steps.
- An enterprise-search team assembling indexing, retrieval, and filtering components for semantic search over an internal knowledge base.
- An application team that needs streaming responses and wants one Pipeline usable in both synchronous and asynchronous execution modes.
- An agent team that needs concurrent tool calls, lifecycle hooks, and token_usage tracking for monitoring and cost control.
- A product team building a multimodal application that needs to place non-text inputs in an explicit workflow.
- A service team that wants to expose an existing Haystack pipeline through HTTP REST endpoints or MCP using Hayhooks.
How do you install or deploy this agent?
Run: pip install haystack-aiFor nightly pre-releases, the README also provides: pip install --pre haystack-ai. The documented installation path requires Python and pip.
How do you use this agent?
The README does not provide a copyable first Pipeline or Agent program, provider credential setup, environment-variable names, configuration format, or minimum working invocation. It does state that Python applications compose components in Pipeline and run them synchronously or asynchronously, or use Agent to orchestrate tool calls. Listed model and infrastructure integrations include OpenAI, Mistral, Anthropic, Cohere, Hugging Face, Google, Azure OpenAI, AWS Bedrock, and local models. REST API or MCP-server delivery requires the separately referenced Hayhooks project.
What are this agent's strengths and limitations?
- Pipeline supports synchronous execution, asynchronous execution, and token-by-token streaming in one named primitive.
- The workflow model supports loops, branches, and conditional logic while keeping retrieval, memory, tools, and generation explicit and traceable.
- Agent exposes lifecycle hooks including before_llm, before_tool, and on_exit, and tracks step_count, token_usage, and tool calls.
- The README documents a multi-provider model and infrastructure path that permits components to be swapped without rewriting the whole system.
- The README does not include a minimal runnable program, credential configuration, or a complete first invocation, so implementation details must be obtained elsewhere.
- Serving pipelines or agents as REST APIs or MCP servers is not presented as an in-repository command; it relies on the companion Hayhooks project.
- Cloud-model and cloud-infrastructure use still requires provider-specific integration and credentials; the README does not define a unified authentication mechanism.
- Anonymous telemetry sends an event when pipeline components are initialized; opting out requires following separate telemetry documentation.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| Haystack This agent | 52 · Major gaps | Library / SDKFree + model costs | ★ 27k | today | Python | OpenAI API |
| Understanding AI Agents: Design Principles and Engineering Practice | 41 · Major gaps | CLIFree + model costs | ★ 57k | 29d ago | Python | — |
| Hello-Agents | 54 · Major gaps | Web appFree + model costs | ★ 86k | 23d ago | Python | OpenAI API |
| Puppyone | 39 · Major gaps | Self-hosted serviceFreemium | ★ 1.3k | 4mo ago | TypeScript | ChatGPT · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows: framework designed for trusted execution environment, security boundaries clear (SECURITY.md), but no explicit least-privilege implementation; user confirmation mechanism not mentioned; data flow transparency partially present (e.g., telemetry description), but not detailed; sensitive data handling not specifically addressed; dependency security measures exist (e.g., uv exclude-newer), but no full vulnerability scan evidence; external effects (e.g., network requests) described but no controls; rollback mechanism not mentioned; source attribution has copyright notice but no detailed contributor info. Deductions: lack of specific implementation details and evidence.
Evidence shows: project structure consistent, test configuration complete (pyproject.toml), dependencies clearly declared, but no runtime reliability guarantees; failure messages not detailed. Deductions: static review cannot verify runtime behavior.
Evidence shows: broad audience (developers, enterprises), diverse scenarios (RAG, agents, etc.), capability boundaries described in README, but trigger precision (e.g., agent exit conditions) not detailed; environment fit (Python versions, Docker) described. Deductions: insufficient detail on trigger precision and boundaries.
Evidence shows: clear information architecture (README, docs links), clear installation instructions, stable naming (haystack-ai), examples and FAQ provided, known limitations in SECURITY.md, Apache-2.0 license, versioning with VERSION.txt and changelog (reno), maintenance responsibility clear (deepset). Deductions: some documentation not provided in this review.
Evidence shows: high output usability (componentized, serializable), high marginal value (open-source framework), reasonable cost-benefit (free to use). Deductions: lack of actual runtime data.
Evidence shows: README claims partially supported by links, but no independent verification; limited cross-source corroboration; facts and inferences not clearly separated. Deductions: static review cannot verify claims.
- Not found in source: confirmation before actingTurn on (or add) a confirmation step before it acts, and try it in a sandbox or test environment before real data.
- Not found in source: rollback or recovery pathBack up first, or work on a git branch or snapshot, so its changes can be undone.
- Static review cannot verify runtime behavior; all reliability-related scores are inferred from code and documentation.
- Security boundaries are clear, but users are responsible for input validation and SSRF protection; framework does not provide default protections.
- Dependency security measures exist, but no full vulnerability scan report is provided; check dependency versions before use.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
🔒 Security Notes - Haystack now requires anyio>=4.14.2. anyio is installed transitively through httpx and openai; versions before 4.14.2 are affected by CVE-2026-63374 (GHSA-82r6-8w77-94w6). - Haystack now requires certifi>=2026.10.19. certifi is installed transitively through httpx and posthog; earlier versions trust eMudhra/emSign certificate authorities whose private keys were compromised (GHSA-6q48-6c7w-9gw2). If you pin certifi, raise the pin to at least 2026.10.19.View on GitHub ↗ -
Release notes excerpt
🔒 Security Notes - Haystack now requires certifi>=2026.10.19. certifi is installed transitively through httpx and posthog; earlier versions trust eMudhra/emSign certificate authorities whose private keys were compromised (GHSA-6q48-6c7w-9gw2). If you pin certifi, raise the pin to at least 2026.10.19.View on GitHub ↗