Open source workflow automation tools

Four kinds of automation tool

Every tool here does the same basic thing: a trigger, such as a schedule, a webhook, a new record in an app or a message on a queue, starts a sequence of actions. They differ in who builds those sequences and what they connect to.

• No-code app connectors work like Zapier and Make. They offer a visual builder and a catalog of ready-made integrations for SaaS apps. Activepieces is the most complete. Automatisch is simpler and has fewer apps. Sim adds AI agents to a large integration catalog.
• Event and device automation works like IFTTT: when this happens, do that. Node-RED wires devices, MQTT topics and HTTP endpoints together in a flow editor and runs happily on a Raspberry Pi. Huginn runs agents that watch websites, feeds and inboxes and act on what they find.
• Developer platforms treat each step as code. Windmill turns scripts in many languages into scheduled jobs, webhooks, flows and simple internal UIs.
• Orchestrators run long, reliable pipelines for data and operations. Kestra declares flows in YAML with event triggers and backfills. StackStorm automates incident response and runbooks for ops teams.

If the people building automations are not developers, start with the first group. If your automations already live in scripts, the last two will feel more natural.

What to check before you choose

1. Integrations and triggers. Check that the apps you rely on are covered, with the triggers you need and not just actions. Also check how you would fill a gap: a generic HTTP step, a code step or an SDK for writing integrations.
2. Trigger speed. Webhook triggers fire straight away. Polling triggers check on an interval, which can be minutes. Automatisch’s documentation, for example, says its flows currently run every 15 minutes.
3. Credential security. An automation server holds tokens for many other services, which makes it a valuable target. Find out how credentials are encrypted and where the key lives, and back the key up with the database. Check whether the editor needs a login by default: Node-RED’s documentation says its editor is open until you configure authentication.
4. Code isolation. If users can add code steps, see how they are sandboxed. Activepieces offers several sandbox modes, Windmill uses nsjail, and Sim sends Python and shell code to a remote sandbox provider.
5. Telemetry. Activepieces and Automatisch send anonymous usage data by default. Both document how to turn it off.
6. The cost of self-hosting. Requirements range from a single Node.js process with no database (Node-RED), through PostgreSQL and Redis (Activepieces, Automatisch, Sim), to MongoDB, RabbitMQ and a server with more than 16 GB of RAM for production (StackStorm).
7. Migration. We found no documented importer for Zapier Zaps, Make scenarios or IFTTT Applets in these projects. Plan to rebuild your workflows and test them side by side before switching off the old service.

Where workflow data goes

An automation service sees the data passing through every workflow: form entries, emails, CRM records, payment events. Zapier describes itself as a data processor for that content, says it hosts data on AWS servers in the United States, and is certified under the EU–US Data Privacy Framework. The European Commission adopted the adequacy decision for that framework on 10 July 2023, which allows personal data to go to participating US companies without extra safeguards. Make lets organizations choose US or EU data zones, but its help center notes that some AI features always process requests in the US. IFTTT says its service is hosted and operated in the United States.

Self-hosting keeps run history and stored credentials on infrastructure you control. The workflows still send data to every third-party API they call, so the services you connect matter as much as where the automation runs.

Licenses and open-core editions

Node-RED, Huginn, Kestra and StackStorm are under OSI-approved licenses throughout. Activepieces (MIT), Automatisch (AGPL-3.0) and Sim (Apache-2.0) keep enterprise features such as SSO and audit logs in directories under proprietary licenses. Windmill’s source is AGPL-3.0, but its official Docker images include proprietary code, so a build that is open source in every part has to be compiled from source. Each app page explains the details.

Source-available tools we do not list

Some well-known automation tools publish their source code without an open source license. n8n uses its Sustainable Use License, which limits use to internal business, personal or non-commercial purposes, plus a separate enterprise license for some files. Pipedream’s repository is under the Pipedream Source Available License, which excludes commercial use. Inngest uses the Server Side Public License. None of these licenses is approved by the OSI, so these projects are left out even though they are popular.