Windmill vs Orchestrator Zero
oz0 records agent jobs running on your infrastructure. Windmill combines scripts, apps and visual workflows. oz0 focuses on agents across your machines, with a model gateway, reviewed tool definitions and a verifiable audit trail.
What Windmill is
Windmill is an open source workflow engine and developer platform from Windmill Labs for scripts, flows and internal apps written in TypeScript, Python, Go and other languages. AI agents run as steps inside flows: an agent step calls a chosen provider and model and can use Windmill scripts, nested agents and MCP servers as tools. Jobs run on workers that pull work from Postgres, on Windmill Cloud or on your own servers.
windmill.dev- Runs
- Self-hosted or managed
- Checked
- 27 October 2026
Side by side.
Windmill's ratings come from its own pages. A column's name opens its definition and how Orchestrator Zero does it. How we rated
Where it runs
Any machine you own
Yes
DocsYes
Workers run on hosts you choose; agent workers, an Enterprise feature, also run without Docker on Linux, Windows and Apple targets.
Linux, macOS and Windows
Conditional: Windows and Mac in Enterprise
Linux workers are in the free edition, while native Windows workers and agent workers, the documented way to run on macOS without Docker, are Enterprise features.
Fleet operations
Yes
DocsConditional: Worker tags and groups
Worker tags and groups route jobs, and agent workers authenticate over HTTP. Windmill manages worker configuration; a full machine lifecycle with node blocking and staged upgrades is not documented.
Durability
Governance
Tool policy outside the model
Conditional: Tool lists per run
An agent step's tools and MCP filters restrict what it can call; enabled_tools can narrow that list for each run. A central allow, ask or refuse policy for each call is not documented.
Approvals in chat
Yes: Slack and Teams
An approval step suspends a flow durably until it is approved through the resume endpoints or the approval page, and helpers post interactive approvals to Slack and Microsoft Teams. Approvals are flow steps; the docs show no way to gate a single tool call inside an agent step.
Tool snapshots
Yes
DocsNot documented
Agent configurations and scripts can be versioned, and MCP tools are discovered from servers. The docs do not describe detecting a changed tool description or schema and blocking it pending approval.
Tenants built in
Yes
DocsYes: 3 workspaces free
Workspaces partition the whole database; the Community Edition is capped at 3 workspaces.
Cost
Budgets that stop a run
Conditional: Metered, no cost stop
Agent steps report token usage and can cap iterations and output tokens, but no spend limit in money stops a run.
Security
Provider keys off the workers
Yes
DocsConditional: Secret store, worker reads it
Provider keys are kept in workspace resources, which the job reads on the worker at run time; the AI sandbox template puts the key in the agent process environment, and there is no gateway that adds it.
Sandbox with an egress allowlist
Conditional: nsjail, no egress allowlist
Jobs and AI coding agents can run in nsjail on Linux workers, which isolates the filesystem and can turn networking off, but no documented setting limits outbound traffic to listed hosts.
Audit and compliance
Tamper-evident audit trail
Conditional: Logs vary by edition
Audit logs cover platform actions, with plan-dependent detail, retention and export. Self-hosted Community defaults to 14 days and Enterprise to 365; a verifiable hash chain or signature is not documented.
Erasure by key
Not documented
Searched the docs for GDPR, personal data, deleting a user's data, per-user keys and crypto-shredding; only workspace-level secret encryption and removing a user account were found.
Retention with legal hold
Conditional: Retention, no legal hold
Superadmins set how long job runs and audit log entries are kept, and nothing documents a legal hold.
Openness
Model provider choice
Yes
DocsYes
Agent steps take OpenAI, Anthropic, Google, Mistral and other providers, and local models such as Ollama through a Custom AI endpoint.
MCP and A2A
Yes
DocsConditional: MCP, no A2A
Agents use MCP servers as tools and Windmill serves its scripts and flows over MCP; A2A does not appear in the docs.
Where Windmill is stronger.
Managed cloud and SOC 2
Windmill runs as a managed cloud as well as self-hosted, and Enterprise customers can download a SOC 2 Type II report.
windmill.devSAML and SCIM sign-in
Enterprise adds SAML sign-in and SCIM provisioning with group sync.
windmill.devApprovals in Microsoft Teams
Approval steps can be answered from Microsoft Teams as well as Slack; Orchestrator Zero's Teams plugin has been tested only against a stand-in so far.
windmill.devVisual flows in many languages
A low-code flow builder and app builders sit next to scripts in many languages, so agent steps live inside wider business workflows.
windmill.dev
Full in Windmill, partial in oz0: Durable runs, Approvals in chat.
Differences to examine.
Compare the scope, conditions and editions in the source notes.
- Linux, macOS and Windows
- Fleet operations
- Budgets that stop a run
- Provider keys off the workers
- Tamper-evident audit trail
- MCP and A2A
Using both
Windmill serves a workspace's scripts and flows as MCP tools, so an Orchestrator Zero agent can call Windmill workflows as a remote MCP server, with Orchestrator Zero's tool policy deciding each call.
Based on documentation; this pairing has not been tested.
Find your first task.
Explore an example or read the public Docs preview. Software access is coming soon.