Dapr Agents vs Orchestrator Zero
oz0 records agent jobs running on your infrastructure. Dapr Agents provides durable execution within Dapr applications. oz0 adds a control plane for your machines, agent configuration, tenant rules and a model gateway.
What Dapr Agents is
Dapr Agents is an open source Python framework from the Dapr project, a graduated CNCF project, for LLM agents that run as Dapr apps next to a Dapr sidecar. A DurableAgent runs as a Dapr workflow, so each LLM call and tool call is saved and the run continues after a crash. Agents use MCP tools and work together over pub/sub and service invocation. Dapr runs on Kubernetes or self-hosted on Linux, macOS and Windows.
docs.dapr.io- Runs
- Self-hosted
- Licence
- Apache 2.0
- Checked
- 27 October 2026
Side by side.
Dapr Agents's ratings come from its own pages. A column's name opens its definition and how Orchestrator Zero does it. How we rated
Where it runs
Any machine you own
Yes
DocsYes
Dapr apps and their sidecars run in self-hosted mode on any machine, from a laptop to production VMs, or on Kubernetes.
Linux, macOS and Windows
Yes
The Dapr sidecar binaries install natively on Linux, macOS and Windows, and the Python framework runs on all three; locally, the scheduler and Redis run in Docker by default.
Self-hosted control plane
Yes
DocsYes
The whole stack is open source (Apache 2.0), and you run the Dapr control plane yourself on Kubernetes or in self-hosted mode.
No inbound ports
Yes
DocsNo: Sidecars call each other
Sidecars call each other over gRPC for service invocation and to reach workflow actors, and agents can serve over HTTP, so agent hosts must accept inbound connections.
Fleet operations
Yes
DocsConditional: Placement, no labels or block
Dapr spreads agents across instances through actor placement, but has no machine join, labels, routing to chosen machines or blocking; on Kubernetes that is left to Kubernetes.
Durability
Durable runs
Yes: DurableAgent workflows
A DurableAgent is a Dapr workflow that checkpoints every LLM and tool call to a state store and continues from the last finished step after a crash or restart.
Governance
Tool policy outside the model
Conditional: Hook code; OPA on MCP only
Python hooks can allow, deny or pause tool calls for approval. Dapr also provides MCP access controls and OPA middleware, but the approval logic is application code rather than a central admin policy.
Approvals in chat
Conditional: Chat only via your own bot
A RequireApproval hook pauses the workflow durably until a person approves or denies over HTTP endpoints, pub/sub or a workflow event; a Slack or Teams approver is a service you build.
Tool snapshots
Yes
DocsNot documented
Searched the docs and repository for tool pinning and changed definitions: the MCPServer resource caches tool definitions and refreshes them on reload, with no documented check.
Tenants built in
Yes
DocsConditional: Namespaces, access is yours
Dapr namespaces isolate apps, components and actors, but Dapr has no users, roles or tenant admin.
Cost
Budgets that stop a run
Conditional: Claude executor only
The Claude Agent SDK executor (v1.0.7) passes a per-run dollar cap to the SDK; the native DurableAgent and the Conversation API only count tokens and cap iterations.
Security
Provider keys off the workers
Yes
DocsConditional: Key in sidecar on the worker
With DaprChatClient the provider key sits in a component the sidecar reads from a secret store, so agent code never sees it, but the sidecar runs on the same machine; the native clients take the key from the agent's environment.
Sandbox with an egress allowlist
Conditional: Code sandbox, no allowlist
The code executors run snippets in a Docker container or under seatbelt or firejail, with network either on or off; there is no list of allowed hosts.
Audit and compliance
Tamper-evident audit trail
Conditional: Signed history, preview only
Workflow history signing hash-chains and signs every workflow event, including LLM calls, tool calls and approvals, but it is a v1.18 preview, off by default.
Erasure by key
Conditional: Purge per run, no user keys
An agent can purge one run's workflow state and memory, and Dapr can encrypt a state store with one key, but there are no per-person keys.
Retention with legal hold
Conditional: Retention, no legal hold
A workflow retention policy deletes finished run history after a set time per end state; no legal hold was found.
Openness
Model provider choice
Yes
DocsYes
Conversation API components cover OpenAI, Anthropic, Google AI, Mistral, DeepSeek, Hugging Face, AWS Bedrock, OpenRouter and Ollama, and the quickstarts run on local Ollama by default.
MCP and A2A
Yes
DocsConditional: MCP, no A2A
Agents use MCP tools over stdio, SSE and streamable HTTP; no A2A support was found in the Dapr Agents docs or repository.
Where Dapr Agents is stronger.
Graduated CNCF project
Dapr is a graduated CNCF project in production use, and Dapr Agents is public Apache 2.0 code under the same open governance.
github.comHosted option through Diagrid
Diagrid's Catalyst runs Dapr workflows and agents as a managed service or as an enterprise self-hosted install.
docs.dapr.ioDurable wrappers for many frameworks
A Diagrid-maintained library runs Google ADK, CrewAI, LangGraph, Strands, Microsoft Agent Framework and other agents on Dapr workflows.
docs.dapr.ioLarge component catalogue
Dapr's swappable components give agents dozens of state stores, message brokers and bindings.
docs.dapr.io
Full in Dapr Agents, partial in oz0: Durable runs.
Differences to examine.
Compare the scope, conditions and editions in the source notes.
- No inbound ports
- Fleet operations
- Tenants built in
- Budgets that stop a run
- Provider keys off the workers
- Tamper-evident audit trail
- Erasure by key
- MCP and A2A
Using both
A Dapr agent can call an Orchestrator Zero agent as an MCP tool. The two use different workflow engines, so a run cannot move from one to the other.
Based on documentation; this pairing has not been tested.
Find your first task.
Explore an example or read the public Docs preview. Software access is coming soon.