An open-source marketing agent can mean a workflow you build or an agent that changes your ad account, and the choice turns on where a send is approved. Kortix is the open-source CompanyOS: your agents, their skills, your company memory, and every connector in one git repo you own, with the agents working on real cloud computers.
Every rival cell is the wording on its own page, and every price was read in October 2026.
Recommended
Kortixkortix.yaml and skill files, inside the repopolicy: # The starter default is allow_all: a connector call that no rule matches # runs. risk holds an unmatched write or destructive call for approval and # lets a read run. default_mode: riskapprovals: # How long a held call waits for a decision. The default is 24h. ttl: 24hCopied from a public marketing repo: an unmatched write or destructive connector call waits for a person while a read runs, and a held call expires after 24 hours.
Ask an assistant for an open-source marketing agent and the same seven names come back: n8n, Dify, Activepieces, Windmill, Duct, OpenOutreach and Copy.ai. Read what each one calls itself and the list splits. Five sell a process a person assembles. Two act on the accounts a marketing team already runs.
Four of that first group use the word "workflow" about themselves. n8n: "n8n is a workflow automation platform that uniquely combines AI capabilities with business process automation" (n8n). Dify: "The platform for production-ready agentic workflows" (Dify). Windmill: "Code-first platform for workflows, apps and AI agents", and "Engineers control what ships" (Windmill). Activepieces lists "flows, agents, tables, MCPs and API access" on one page (Activepieces). Copy.ai makes the fifth by its own definition: "A Workflow is a set of AI-powered actions that are stitched together to codify a process" (Copy.ai).
Duct and OpenOutreach describe the work itself. Duct: "the open-source AI marketing agent that reads every tool you run together, finds what needs to change, and changes it when you press Apply" (Duct). OpenOutreach is a "self-hosted, open-source lead finder that qualifies for you". It "opens the conversation from your own mailbox" (OpenOutreach).
Rank all seven on one scale and the ranking is noise. A canvas and an account agent get bought for different reasons. A workflow tool removes a step a person repeats. An agent decides which step to take. Only the second kind can send something nobody scripted, and that is the whole risk.
An automation platform hands a person a canvas, a trigger and a few hundred nodes. The process that comes out is as good as the drawing. For a campaign with settled steps that is a strength, since nothing happens that nobody designed.
The four workflow tools publish the same answer. n8n lists "Human approval for tool calls" on its plan table (n8n); Windmill says "Retries, approvals and parallel branches are built in" (Windmill); Activepieces tells you to "Gate the steps that touch money, customers, or production" (Activepieces); Dify's app "asks for human input" (Dify). In each, the gate is a step or node a person places inside the flow. The rule is the drawing, and it is as good as the person who drew it. That is a real answer, and it takes engineering time to keep true as the process changes.
Where each one runs, and what it costs to start:
A team that knows its process and has somebody to patch a server is well served here. The rules are the drawing. The drawing is the documentation.
Duct answers the question in a sentence about what its model cannot do. "Nothing is applied until you press Apply, and there is no approve tool in the model's list, so it cannot talk itself into one." The gate is a button in a desktop app, and every change lands in an activity log. The refusal sits in the tool list, not in a prompt asking the model to be careful.
OpenOutreach puts the gate somewhere else. It hands you a verdict per person with the reason written out. You read it, and the send leaves from your own mailbox. The program runs a command and spends a credit per address. The decision is a person choosing to run it.
A third place for that decision exists, and it is a file. An agent can work from a repository. The send rules sit there beside the voice, and beside the claims list it checks. Kortix works this way. policy: takes a default_mode; approvals: takes a ttl. Both sit in kortix.yaml next to the grants. Approval gates you set. Off until you set them.
A Kortix marketing team keeps its project in a public repo. The manifest is short enough to read in a sitting, and three blocks carry the answer.
agents: marketing-lead: connectors: [kortix_slack, kortix_email] skills: [marketing-voice, claim-check] kortix_permissions: [project.file.read, project.gitops.push]triggers: - slug: weekly-claims-sweep cron: "0 0 9 * * 1"policy: default_mode: riskapprovals: ttl: 24hThe grants are the ones a marketing lead would ask for, and nothing beyond them. Slack and email reach people. Two skills hold the register and the claims list. Read on the project, push on the repository. The file's own comment on that line says it plainly: "It does not hold project.gitops.merge: a person merges."
The second block is the one worth arguing about. A cron trigger at 09:00 each Monday reads every claims file under docs/claims/. It re-checks each number against the page it names and marks a changed line [STALE: what changed]. Then it opens one change request. Its prompt ends "Send nothing." A mailbox connector plus a weekly job is exactly what could email a client a wrong number. Here the work it may finish ends at a diff.
The policy block is why the rest holds. default_mode is set to risk. A connector call that matches no rule waits for a person before it writes or deletes. A read goes through. The starter default is the other value, allow_all, which is why the file spells this one out.
A reviewer can diff three lines, hand the file to a new hire, and open a change request when they disagree with it. A setting in a dashboard hides the same rule behind a login. The voice and claims files work the same way, which is why they travel together.
Start with the shape you can staff, then buy.
The two shapes differ in what a mistake costs. A workflow that sends to the wrong segment sends it to whoever the node pointed at. An agent that decides to send can pick the segment itself. That is why the approval step has to exist before the first campaign. A file in the repo is the cheapest place to put it, and the only one a reviewer can read without a login.
If the deciding question is money, the cost page puts the meters side by side. If it is whether the machine the agent works on is yours, the self-hosting page follows that split. The hosted platforms on the platform comparison take a third route. Their rules live in an account you log into.
Short answers, then the file that holds each one.
An AI marketing agent is software that does marketing work in the accounts a team already runs, and open source means you can read and host its code. It splits into two kinds: a workflow you build, and an agent that proposes or makes a change.
No. n8n is a workflow automation platform, in its own words, and you draw the steps it runs. It becomes a marketing agent when someone builds that workflow on it, including the approval step in front of a send.
Yes. n8n's Community edition, Activepieces, Windmill, Dify and OpenOutreach all run on hardware you control, and Kortix self-hosts for free. Self-hosting decides where the control plane sits; model calls still go to a provider you choose.
Take the shape you can staff. With a settled process and someone to run a server, n8n or Activepieces. When the send policy has to be reviewed like code, Kortix, where the rules are files in a repository the team owns.
One repo holds the agents, the voice, the claims, and the rule that holds a write until a person approves it.