# The Hunt for an Open Source AI Workflow Tool > Source: > Published: 2026-08-01 18:30:00+00:00 I wanted to build a SOC agent. Nothing exotic. Something that picks up an alert, investigates it across the tools we already run, and tells me what it found. And for the workflows where it wants to change something - update a WAF rule, delete a resource - it stops and asks a human first. I thought the hard part would be the agent. It was finding something to orchestrate it. I evaluated seven workflow automation platforms over a couple of weeks - n8n, Activepieces, Dify, Windmill, Tracecat, Kestra and Langflow - ran several of them, and set up the SOC agent by hand. This post is the result of my experiments (and frustration). **TL;DR:** - Nearly every “open source” workflow tool here is actually **open core**- a free version with the important parts held back for paying customers. The AI features are free everywhere. Secrets management, user roles, audit logs and approver identity are not. - The gating isn’t the same everywhere. Some are only source-available. Some ship enterprise-licensed code inside the free build. One doesn’t let you modify the image you self-host. - For a security team trying to build security workflows, free & open source versions are pain. The paywall sits exactly on the security features. **Langflow** is the only one I found that’s genuinely open with nothing held back. It has some gaps, but it’s what I’d recommend today. ### What I was looking for That agent, plus the other security workflows I had in mind, distills to seven requirements: **Both AI and non-AI workflows in one tool.** Some security work needs an LLM. Most of it doesn’t. A scheduled check that hits an API and posts to Slack shouldn’t need one. **The workflow should be a file.** So I can diff it, review it in a pull request, and roll it back when I break something. **And an API, a CLI, or an MCP server.** If workflows are files, my own agents can write them. I can point Claude Code at a workflow and ask it to make a change. **But keep the canvas.** A diagram explains a workflow to a colleague in five seconds. I wanted both - click to build the simple things, drop into code when it gets complex. **A sandbox for each agent.** I treat the agent and the artifacts it produces as untrusted. Prompt injection isn’t solved, and I’m not designing as though someone else will fix it for me. If an agent runs code, that code runs in its own container, and the container gets thrown away. **An approval gate with a name attached.** Not “the workflow paused and then continued.” A specific person said yes, and the system recorded that it was them. **Self-hosted, and genuinely open source.** I want to tweak it to my own requirements, and I should be able to do that *legally* as mentioned in the license. I assumed that last one would be the easy part. ### The tools #### 1. [n8n](https://github.com/n8n-io/n8n) Quite a few folks recommended n8n. It has the best integration catalogue in the category, and for connecting SaaS tools it’s excellent. Then you self-host it. No shareable projects, no variables, no external secrets, no SSO or user roles. **All of it is enterprise-only.** The licence is source-available: you can read the code and use it internally, but the vendor keeps rights a real open source licence would give away. n8n calls it “[fair-code](https://github.com/n8n-io/n8n/blob/master/LICENSE.md),” a term that exists precisely because “open source” would be inaccurate. It’s also fiddly. A Slack bot that replies with a static message to certain users and channels took me four separate nodes. Talking about webhook URLs - every webhook has two URLs - a test one that works while you’re building, a production one that works once published. That split causes friction on every redeploy. I’d skip it and keep two published workflows, one for dev and one for prod. Good product, huge integration catalogue. Not an open source one - and with no user roles or audit trail in the free build, you can’t tell who changed what. #### 2. [Activepieces](https://github.com/activepieces/activepieces) The nicest canvas of anything I tried, and the best approval feature I found anywhere - it posts a message to Slack with approve and reject buttons and waits, for days if needed. It’s also the only tool where moving a box around doesn’t dirty your workflow file, because the layout is calculated on the fly instead of being saved. Which is ironic, because there is no workflow file. Your flows live inside the database. The only feature that writes them out to disk is Git Sync - and that isn’t in the free edition or in [the paid plans](https://www.activepieces.com/pricing). It’s in the top “*Ultimate*” tier, priced after a sales call. So my first requirement is unavailable at any price short of an annual contract. Same story for audit logs, secret managers and custom roles. Two other things stopped me. There’s no sandbox for agent code - their own engineering docs say the worker process *is* the sandbox, so agent-generated code runs alongside the thing supervising it. And it’s TypeScript only, no Python. Lovely to use for the first hour. Then you realise you can’t get your work out of it. #### 3. [Dify](https://github.com/langgenius/dify) Going in, I thought Dify was the real contender to n8n. Code on GitHub, a free cloud tier, good workflow features. It also gives away the thing I care most about: real isolation for each agent, its own restricted environment with its own outbound proxy. That’s better than some commercial products manage. Then I tried to actually build in it. The canvas looks great. The rest of the UX doesn’t. Every time you reference the output of an earlier step or a variable - in a prompt, in a field, anywhere - you type an opening brace, wait for a dropdown, and click the variable. You can’t paste the reference in as text; it won’t bind. By hand it’s mildly annoying. If you want an agent building workflows for you, it’s a wall. The CLI was meant to be the way around that. [ difyctl](https://docs.dify.ai/en/cli/reference/version) is pinned to one exact server version - the latest difyctl required Dify 1.16.0 and nothing else, while the cloud was a version behind (1.15), so I had to downgrade the CLI to make it work. It also can’t read logs or traces. Still alpha. The licence looks like Apache 2.0 but isn’t - their [own text](https://github.com/langgenius/dify/blob/main/LICENSE) calls it “a modified version of the Apache License 2.0,” which means it isn’t the OSI-approved licence it resembles. You can’t run a multi-tenant setup, where a tenant means a workspace, and you can’t remove their logo. Contributors also agree Dify can commercialise their code and change the licence terms later. Great runtime. Everything around it made me put it down. #### 4. [Windmill](https://github.com/windmill-labs/windmill) Best engine of the lot, and the best file format - a twenty-step workflow fits on one screen and reads cleanly. It even generates instructions for AI coding agents that edit your workflows. Then I looked at audit logging in the free version. The function that’s supposed to record an audit entry takes your data, reports success, and does nothing with it. Asking for the log back returns an empty list. [The comment sitting where the implementation should be](https://github.com/windmill-labs/windmill/blob/main/backend/windmill-audit/src/audit_oss.rs) says: “*Implementation is not open source as Audit logs is a Windmill Enterprise Edition feature*.” Approvals that require a logged-in user error out in the free build, so “a named person approved this” isn’t possible. And [the licence](https://github.com/windmill-labs/windmill/blob/main/LICENSE) says the community image you download contains proprietary code, and that you may not modify or wrap it. Most open core products at least let you change what you’re running. This one forbids it, and charges per user and per worker. #### 5. [Tracecat](https://github.com/TracecatHQ/tracecat) Architecturally the closest fit to what I wanted, and built for security teams specifically. Workflows are readable YAML with the canvas layout kept in a separate section, so your diffs stay clean. It ships its own MCP server, so Claude Code can write workflows for it directly. There’s a problem. The enterprise package is [a required dependency](https://github.com/TracecatHQ/tracecat/blob/main/pyproject.toml). The server won’t start without it, and there’s no build or config option that leaves it out. Even if you never touch a paid feature, the enterprise code is loaded and running. Their enterprise licence says production use requires a licence “for the correct number of user seats.” Their README says something narrower, about not redistributing or selling. Two documents from the same vendor, two different answers. Probably not malicious - it reads like boilerplate that never got updated after the enterprise package became mandatory. But I won’t build on something where I can’t tell what I’m allowed to do. #### 6. [Kestra](https://github.com/kestra-io/kestra) Cleanest licence of any mature tool here. Properly Apache 2.0, with no enterprise code in the repository at all. The whole AI layer - agents, tool calling, MCP - is free and included. Pricing is per instance rather than per user, which I respect. So I ran it. I built a workflow with a pause step and no timeout, and it sat there patiently until I came back and released it. Deploying and resuming over the REST API worked too. Then I looked at what it had recorded. It logs *when* the execution was resumed. It does not log *who* resumed it, because the free build has a single shared login for the whole instance. There is no “who” available to record. Approvals restricted to a named person or group use a different task type, and that one is [Enterprise](https://kestra.io/docs/oss-vs-paid), along with the audit logs that would capture the decision. **The free version gives you a pause. The paid version gives you an approval.** A pause stops the work until somebody does something. An approval means a specific person accepted responsibility. Only the second is a security control. There’s also no secrets manager in the free build - secrets are environment variables that every workflow can read. Kestra is a good product and I’d happily pay for it. But that makes it a reasonably priced commercial product with a generous free tier. Open source is a different category. ### The pattern Six tools, and the same shape every time. **The AI features are free everywhere. The operational features are paid everywhere.** Agents, tool calling, MCP support, model choice - free, in every single one. Secrets management, user roles, audit logs, approver identity, git integration - paid, in every single one. That’s the business model. AI capability gets you to download it. The boring operational plumbing and security features are what you’ll eventually pay for. Notice what that means if you work in security. The features behind the paywall *are* the accountability layer. You can self-host the whole thing, read every line, and still not answer “who approved this change?” Six for six. I’d stopped expecting anything else. ### The exception: [Langflow](https://github.com/langflow-ai/langflow) I evaluated Langflow alongside everything above, and held it back until now because it’s the only one that breaks the pattern. I didn’t expect it to. It’s the best known canvas AI builder around. Something that popular usually has a paid tier by now. It doesn’t. [One licence file](https://github.com/langflow-ai/langflow/blob/main/LICENSE), MIT, unmodified. No enterprise directory anywhere. No licence key checks, no feature entitlements, no hidden switches. There are exactly two feature flags in the entire product, and both are ordinary environment variables with nothing verifying a licence behind them. I went looking for the catch and couldn’t find one. It’s also actively maintained, which matters when you’re betting on a project surviving. What it does well: human approval gates, AI workflow fundamentals like loops and flows, MCP support in both directions, a CLI for pushing and pulling workflows, around 28 model providers including local ones like Ollama, and a real plugin system. Now the hiccups. **There’s no sandbox.** Component code runs inside the main server process, and there’s no isolation library anywhere in the project. [Their own documentation](https://docs.langflow.org/security) says plainly that **Langflow doesn’t isolate users from each other, or restrict access to local disk and network resources**. **Python only** for code steps. **No view of how you’re doing over time** - you can trace an individual run, which is useful, but nothing is aggregated, so you can’t ask whether this month’s prompt beats last month’s. Not a major issue though, as it has integration to other AI telemetry tools like Langfuse. **Flow files are verbose.** You can export a flow as JSON, commit it, and import it back, and there’s an API to create one programmatically, so the round trip works. But a four-node flow is around 60 KB, because every node embeds the full source of its component along with its canvas position. Reviewing that diff in a pull request isn’t realistic. And if you want an agent writing flows for you, it has to reproduce Langflow’s edge format exactly, which is a JSON blob encoded inside the edge’s own ID string. Doable, but you’ll want a helper so the agent only writes the logic. Two more things keep me watching. The macOS desktop app isn’t open source - the source isn’t in any of their public repositories, and the binaries ship with no licence attached. Use the web version and you’re on MIT; use the desktop app and you’re running something you can’t inspect. And role-based access control needs a plugin that doesn’t publicly exist. [Their docs](https://docs.langflow.org/authentication-overview) are blunt about it - the open-source build “registers a pass-through service that **always allows** every action for every authenticated user,” and turning the setting on without a plugin “**does not** restrict access.” I couldn’t find the plugin anywhere, and the docs never say where you’d get one. DataStax, who maintains it, were acquired by IBM. The licence is clean today. Every other tool in this post was clean at some point too. ### Everything, side by side My requirements down the left, Langflow first. ✅ works in the free self-hosted build, ⚠️ partly works or works with a caveat, ❌ missing or behind a paid tier. | Requirement | Langflow | n8n | Activepieces | Dify | Windmill | Tracecat | Kestra | |---|---|---|---|---|---|---|---| AI and non-AI workflows | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | Canvas authoring | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ⚠️ | | Workflow as a diffable file | ⚠️ | ⚠️ | ❌ | ⚠️ | ✅ | ✅ | ✅ | | API, CLI or MCP server | ✅ | ✅ | ⚠️ | ⚠️ | ✅ | ⚠️ | ✅ | | Sandbox per agent | ❌ | ❌ | ❌ | ✅ | ⚠️ | ❌ | ✅ | | Approval with a named approver | ⚠️ | ❌ | ⚠️ | ⚠️ | ❌ | ❌ | ❌ | | Genuinely open source, nothing gated | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | A few of those deserve a footnote. - Kestra’s canvas is a form-driven editor rather than a drag-and-drop graph. - Tracecat’s MCP server works on the free build while its REST API needs enterprise service accounts. - Windmill can run a step in an isolated image, but whether you’re licensed to use that in production on the community edition is a question I’d want answered in writing. And notice the bottom two rows. Nobody gives you a named approver for free, and only one column has a tick on the last row. ### So where does this leave us If you’re evaluating anything in this space, “open source” on a homepage tells you nothing. Check the licence file. Then check whether the free build does what the docs imply. And check the date on whatever comparison you’re reading, including this one - licences move. Every one of them is good at something. n8n’s integrations are unmatched. Windmill’s engine is lovely. Dify’s sandboxing beats most paid products. But being good at something doesn’t help when the thing you need is behind a sales call. Langflow is what I’d run today for security automation. It loses on the sandbox feature. I’d run it anyway, because it’s the only one where I can read all of it, change any of it, and not worry about which version I’m allowed to use. I can build the sandboxing myself. Or create a custom bundle to interact with external sandboxes. If you’ve deployed any of these for security work, I’d like to hear how it went - especially if you solved the sandboxing problem on top of one of them. Reach out on [LinkedIn](https://www.linkedin.com/in/bnchandrapal/).