AgentField vs Orchestrator Zero
oz0 records agent jobs running on your infrastructure. AgentField routes requests to agent services at their URLs. oz0 uses nodes that dial out to a shared control plane, which manages tenants, model access and plugin tool rules.
What AgentField is
AgentField is an open-source control plane for AI agents from the team behind Agnostiq and Covalent. You write agents in Python, TypeScript or Go with its SDKs, and each agent process registers with a stateless Go control plane that turns every reasoner and skill into a REST endpoint, then routes, queues, retries and traces the calls between them. The same company also makes CodeAF, a coding agent.
agentfield.ai- Runs
- Self-hosted
- Licence
- Apache-2.0, no paid edition
- Checked
- 27 October 2026
Side by side.
AgentField's ratings come from its own pages. A column's name opens its definition and how Orchestrator Zero does it. How we rated
Where it runs
Linux, macOS and Windows
Yes: Windows via the desktop app
The installer and docs cover macOS (launchd) and Linux (systemd), and the AgentField Desktop app ships a Windows installer that bundles the af CLI and runs the local control plane and agents.
No inbound ports
Yes
DocsNo: Calls into agents
The control plane calls each agent on a callback URL, so the machine that runs it must accept requests.
Fleet operations
Yes
DocsConditional: Agent registry and canaries
Agent services register with heartbeats and tags, and canary weights route calls between versions. Host enrollment, blocking and operating-system upgrades are not a complete managed machine lifecycle.
Durability
Durable runs
Conditional: Re-runs, resume is manual
A crashed job's lease expires and the job runs again; resuming from a step needs checkpoints you write.
Governance
Tool policy outside the model
Conditional: Allow/deny rules, no approve
Tag-based allow and deny rules are enforced by the control plane on every cross-agent call, MCP tools included, but no rule can send a call to a person (approvals are coded with app.pause()) and a call that matches no policy is allowed.
Approvals in chat
Conditional: Webhook API, no chat or CLI
A run can pause durably in PostgreSQL for a decision, but the decision arrives as an HMAC-signed webhook POST: there is no approve page, CLI command or chat-app button, and the Slack integration only triggers reasoners.
Tool snapshots
Yes
DocsNot documented
Searched the docs corpus, search API and repository for tool snapshots, rug pull, tool poisoning, tool pinning and tool definition changes; MCP tools are registered as skills with no documented check of their descriptions or schemas.
Tenants built in
Yes
DocsConditional: Team boundaries
Teams limit which agents can call each other; keeping tenants' data or secrets apart is not documented.
Cost
Budgets that stop a run
Conditional: Caps for some harnesses
Caps per call and per day exist, and a cap in dollars only for the Claude Code harness.
Security
Provider keys off the workers
Yes
DocsNo: Keys in the agent's env
Model calls are made from the agent process through LiteLLM, the Vercel AI SDK or HTTP, with the provider key in the agent's config or environment; no gateway that adds the key is documented.
Sandbox with an egress allowlist
Not documented
The docs describe agent processes or containers you deploy and provider-specific harness restrictions. A platform-managed sandbox with an outbound host allowlist is not documented.
Audit and compliance
Tamper-evident audit trail
Yes: Signed record per execution
Executions can produce Ed25519-signed W3C credentials containing input and output hashes, chained across workflows and verifiable offline. Admin changes are not documented as part of that chain.
Erasure by key
Not documented
Searched the docs and repository for erasure, GDPR, deleting a user's data, crypto-shredding and per-user keys; memory keys can be deleted one at a time, including in a user's actor scope, but no per-person deletion or keys are documented.
Retention with legal hold
Conditional: Retention period, no hold
The control plane can prune finished executions after a retention period (default: keep forever); no legal hold was found in the docs or the repository.
Openness
Model provider choice
Yes
DocsYes
The Python SDK reaches 100+ models through LiteLLM, including Anthropic, OpenAI, Google, Mistral and local Ollama models.
MCP and A2A
Yes
DocsConditional: MCP; no A2A protocol calls
MCP servers become callable skills; the docs list A2A as an adapter for imported external agents, but the control plane sends the same plain JSON POST for every adapter, with no A2A message format, and its own agents are not served over A2A.
Where AgentField is stronger.
Public and free today
The whole project, governance features included, is public under Apache-2.0 at $0 with no paid edition.
agentfield.aiSDKs in three languages
Agents can be written in Python, TypeScript or Go.
agentfield.aiAgent identities other companies verify
Every agent carries a W3C DID and every step emits a signed verifiable credential, so a partner outside your company can check a result offline with the agent's public key.
agentfield.ai
Differences to examine.
Compare the scope, conditions and editions in the source notes.
- No inbound ports
- Fleet operations
- Tenants built in
- Budgets that stop a run
- Provider keys off the workers
- MCP and A2A
Using both
AgentField turns any MCP server's tools into skills, and Orchestrator Zero serves its agents over MCP, so an AgentField agent could call an Orchestrator Zero agent as a skill.
Based on documentation; this pairing has not been tested.
Find your first task.
Explore an example or read the public Docs preview. Software access is coming soon.