# pull

> **Function** in `langchain_classic`

📖 [View in docs](https://reference.langchain.com/python/langchain-classic/hub/pull)

Pull an object from the hub and returns it as a LangChain object.

!!! danger "Hub manifests are untrusted input"

    Treat every prompt pulled from the hub as untrusted, regardless of
    the owner. Public prompts authored by other users are obviously
    external content, but prompts from your own account — or your
    organization's account — are also unsafe if that account, a
    teammate's account, or the upstream prompt has been compromised.
    A single malicious commit to a prompt your code pulls is enough to
    execute attacker-controlled configuration on every machine that runs
    `pull()`.

    `pull()` deserializes the manifest via `load()`, so the
    `langchain_core.load.load` threat model applies — a manifest can
    intentionally configure a model with a custom base URL, headers,
    model name, or other constructor arguments. These are supported
    features, but they also mean the prompt contents are executable
    configuration rather than plain text: a compromised prompt can
    redirect API traffic, inject headers, or trigger arbitrary code paths
    in the classes it instantiates.

    Prefer the LangSmith SDK directly. If you must use `pull()`, pin the
    commit hash, audit the manifest before deserializing, and never run
    it against an account whose access controls you cannot vouch for.

## Signature

```python
pull(
    owner_repo_commit: str,
    *,
    include_model: bool | None = None,
    api_url: str | None = None,
    api_key: str | None = None,
) -> Any
```

## Parameters

| Name | Type | Required | Description |
|------|------|----------|-------------|
| `owner_repo_commit` | `str` | Yes | The full name of the prompt to pull from in the format of `owner/prompt_name:commit_hash` or `owner/prompt_name` or just `prompt_name` if it's your own prompt. |
| `include_model` | `bool \| None` | No | Whether to include the model configuration in the pulled prompt. When `True`, the model declared by the prompt is also deserialized. (default: `None`) |
| `api_url` | `str \| None` | No | The URL of the LangChain Hub API. Defaults to the hosted API service if you have an API key set, or a localhost instance if not. (default: `None`) |
| `api_key` | `str \| None` | No | The API key to use to authenticate with the LangChain Hub API. (default: `None`) |

## Returns

`Any`

The pulled LangChain object.

## ⚠️ Deprecated

Deprecated since version 1.0.6. langchain_classic.hub.pull is deprecated. Use the LangSmith SDK instead. Will be removed in version 2.0.0.

---

[View source on GitHub](https://github.com/langchain-ai/langchain/blob/185119f98e6286253a2326d7cf4f59592678023d/libs/langchain/langchain_classic/hub.py#L62)