Dify vs Sim (2026)

Stands at F on re-retrieved evidence; the April basis cited only an internal research report. Breadth is across classes rather than deep in one ecosystem, which is what the axis asks for: model providers, SaaS tools, data sources and arbitrary HTTP all have first-class surfaces. The auto-generated versus manual tool parameter distinction is worth carrying to comparison pages, since it is a control most builders in this lane do not expose.

Stands at F on re-retrieved evidence. Multi-agent composition here is workflow-as-tool and agent-as-node rather than a peer-to-peer agent society: one flow calls another, and an Agent node is a bounded autonomous step inside a deterministic harness. That is a meaningfully different shape from crewai or langgraph and should be described that way on comparison pages rather than levelled flat. The max-iterations ceiling on Agent nodes is a real containment property and doubles as a cost control.

P>F. All three trigger classes the axis asks for are documented as first-class nodes: events (webhook and plugin), schedules, and channels. The April P looks like an accurate reading of an older product rather than an error; the Trigger node family and the Workflows Can Start Themselves framing both postdate that build. The pricing-page corroboration is the strongest part of the evidence, since a metered quota with per-tier caps is a shipped feature in a way a product-page claim is not.

Stands at F on re-retrieved evidence. Relevant to the open Knowledge convention question: Dify sits squarely on the maintained-retrieval-structure side of the line rather than per-request assembly. The knowledge base is a durable, managed, separately quota'd artifact with its own build pipeline, versioning and lifecycle, and the retrieval settings are configured once and reused, not assembled per call. If that line is drawn as ratified, Dify is a clean positive example to calibrate against.

Stands at F, strengthened, and it is now among the best-evidenced Know cells in the lane because the retrieval stack is native rather than an integration. THE MECHANISM IS DOCUMENTED, WHICH ALMOST NOTHING ELSE THIS SESSION MANAGED. Sim's Knowledge Base is described as a native feature using ADVANCED AI EMBEDDINGS AND VECTOR SEARCH TECHNOLOGY, with VECTOR EMBEDDINGS, AUTOMATIC CONVERSION OF TEXT INTO HIGH-DIMENSIONAL VECTORS FOR INTELLIGENT SIMILARITY MATCHING, and semantic search that understands meaning and context rather than matching keywords. THE CONTRAST WITH THE OTHER FULL CELLS TODAY IS WORTH RECORDING. joget and autogpt both reached Full on a Pinecone connector, where the vector store is a customer-supplied dependency and chunking, embedding and refresh are the customer's problem. Here the store is the platform's own and the surrounding controls are documented as their own pages: CONNECTORS, TAGS AND FILTERING, DEBUGGING RETRIEVAL and CHUNKING STRATEGIES. A vendor publishing a chunking strategies page and a retrieval debugging page has built a retrieval product, not a database binding. DEBUGGING RETRIEVAL IS THE PAGE THAT STANDS OUT and it is rare across the index. Most grounding failures are silent: the agent answers confidently from the wrong passage and nobody knows. A documented surface for inspecting what was retrieved and why is the difference between a knowledge base a team can operate and one they have to trust. MULTIPLE KNOWLEDGE BASES PER WORKSPACE are supported for different purposes or departments, and tag-based filtering scopes retrieval within one, so a single corpus can serve several agents with different views of it. The vendor's own framing on the product page is that data stored semantically in Sim is THE MEMORY YOUR AGENTS REASON OVER; that is grounding and is graded here, with agent state graded separately on Mem, and the record keeps the two distinct.

Stands at P on re-retrieved evidence, and the absence side is now properly evidenced rather than assumed: the complete first-party documentation index was enumerated and contains no memory product. The mechanism is a bounded token-buffer window plus conversation-scoped variables, which is retained state, not memory that accumulates or is learned from. That keeps it clearly below the F bar applied in Coding agent to cognition, cosine and greptile, all of which document an agent improving from its own prior runs. Confidence is high on both halves because the node reference and the full docs index were both reached.

Stands at F, and the July self-flag is resolved. That basis noted THE MEMORY PAGE ITSELF WAS NOT OPENED IN THIS PASS SO CROSS SESSION SEMANTICS ARE GRADED FROM THE SURROUNDING DOCUMENTATION. The Agent block documentation settles it in one sentence. THE DECIDING LINE: MEMORY REQUIRES A CONVERSATION ID TO PERSIST ACROSS RUNS. Persisting across runs is the ruled Full condition, stated by the vendor, with the mechanism named. That is the exact question the July pass left open. FOUR MEMORY MODES ARE DOCUMENTED AS AGENT CONFIGURATION rather than as an integration a customer wires: NONE where each request is independent, CONVERSATION holding full history keyed by a conversation ID, SLIDING WINDOW BY MESSAGES keeping the N most recent, and SLIDING WINDOW BY TOKENS keeping messages up to a token limit. Offering the retention policy as a first-class setting is unusual in this lane, where memory is normally on or absent; here a builder chooses how much history persists and pays for it in context accordingly. THE ACCUMULATION LIMB IS SERVED BY MEM0, documented as enabling agents to MAINTAIN PERSISTENT MEMORY ACROSS WORKFLOW EXECUTIONS, RECALL PAST CONVERSATIONS, REMEMBER USER PREFERENCES, AND BUILD UPON PREVIOUS INTERACTIONS, with add, semantic search and retrieve operations. Zep ships alongside as a second external memory option. SO BOTH LIMBS ARE PRESENT BY DIFFERENT ROUTES: native session-keyed persistence configurable per agent, and accumulating long-term memory through integrations. Tables hold durable structured rows workflows read and write, and Variables carry in-run state, so the platform distinguishes three kinds of state cleanly rather than conflating them. WORTH RECORDING FOR CONSISTENCY: this is the third record today crediting Mem0, after autogpt and joget. In each case it is credited as a documented first-class primitive the customer wires, which the 31 August ruling permits explicitly.

RESOLVED FROM U. The April build left this Unspecified; it is now decisively F. The mechanism is the vendor's own approve-and-edit surface inside the run, not a delivery convention borrowed from a system the customer already owns, so it clears the 30 August ruling that a gate the customer already owns is not the vendor's mechanism. Approve, edit, comment, forward and timeout are named as the available human actions, which is a wider set than the approve/reject pattern most vendors ship. Second, separable guardrail: a Sensitive Content Moderation API extension sits outside the HITL node. Grade rests on the shipped node, not on governance prose.

P>F. The April basis cited only an internal research report, so nothing could be checked. The section 7 conjunction is met twice over: two attestations with a named audit firm, plus five separately named customer-facing controls. Graded strictly on the control surface. THE VPC, ON-PREM AND AIR-GAPPED DELIVERY OPTIONS ARE DELIBERATELY EXCLUDED FROM THIS BASIS and carried on Dep instead, per the 30 August ruling that sovereign delivery never reaches Security. AGGREGATOR OVERSTATEMENT RECORDED, same shape as the Motion precedent: a vendor-risk profile site lists Dify as FedRAMP and CSA STAR Level 1 compliant, neither of which appears on any Dify page; the vendor's own claim is SOC 2, ISO 27001:2022 and GDPR only. The aggregator was not used as evidence. Reports are gated behind a paid plan and a support email rather than a self-serve trust portal, which is a notch below the best disclosure in the index but well above the P floor.

Stands at P. The July basis carried an explicit instruction, RECHECK BEFORE ANY UPGRADE, and this pass performed that recheck and found nothing new. Recording the negative result so the next reviewer does not repeat it. WHAT WAS SEARCHED: sim.ai, docs.sim.ai and the enterprise documentation, anchored on trust centre, SOC 2 and compliance terms. No trust centre, no report request path, no named audit firm, no observation period and no compliance page was found. The SOC 2 and HIPAA claims remain confined to the ai4.sim.ai marketing microsite with type unspecified. The July grade and reasoning stand unchanged. THE CONTROL HALF IS THE STRONGEST OF ANY PARTIAL IN THIS LANE, which is what makes the cell frustrating rather than weak. SAML 2.0 and OIDC single sign-on across Okta, Entra ID, Google Workspace and ADFS. Workspace roles and permission groups enforced at execution time rather than only in the interface. Secrets management. Organisation-wide audit logs. Configurable data retention. Session policies and verified domains. And data drains continuously exporting logs to a customer-owned S3 bucket. THAT LAST ONE IS A GENUINE DIFFERENTIATOR and worth carrying: a customer's security team can pipe activity into their own SIEM rather than reading the vendor's dashboard, which is the form of auditability that survives a vendor outage or a contract ending. WHY IT STILL SITS AT PARTIAL. The bar is a conjunction: an attestation or certification alongside a named control. The controls half is met several times over; the attestation half is asserted on a marketing microsite and nowhere else. Under the hedge ladder that is the asserted-with-no-report rung, the same position as agentx today, and one rung below aigensei's SOC 2-aligned only in that a type is claimed rather than alignment. ONE STRUCTURAL POINT IN THE VENDOR'S FAVOUR, recorded but not credited: the platform is open source under Apache 2.0 and self-hostable, so a customer can inspect the code and run it inside their own controls. That is a different kind of assurance from an attestation and it is graded on Dep and Ext, not here.

Stands at F on re-retrieved evidence. Clears the reporting-is-not-auditing line comfortably: the dashboard alone would be reporting, but per-node inputs, outputs, variable values, execution path and typed error metadata let a run be reconstructed rather than merely counted, and the OpenTelemetry export means the trace leaves the vendor's perimeter in a form the customer controls. Tamper-evident audit logging is the strongest single claim and is Enterprise-tier; the trace and log surface below it is available on the self-serve plans, so the grade does not depend on the gated tier.

Stands at F on re-retrieved evidence and is now one of the best-evidenced Dep cells reviewed so far. This is genuine residency under the section 7 test, not legal cover: the customer chooses the region, or runs the software inside its own account, or runs it offline. Per the 30 August ruling the sovereign delivery properties live here and only here; the Security cell was written on the control surface alone and deliberately excludes air-gap and VPC. Worth noting for lane comparisons that free self-hosting puts full deployment control at the zero-price point, which almost no commercial vendor in this lane matches.

P>F, and the weakest of the four upward moves on this record, so the limit is recorded plainly. The catalogue's existence, navigation and type filters are confirmed first-party, but THE ITEM LISTINGS RENDER CLIENT-SIDE AND CAME BACK EMPTY, so no individual template was enumerated and the catalogue's depth is unmeasured. Graded to the browsable-catalogue bar carried over from Coding agent, which this clears. Flagging it against the open Prebuilt packs question: the templates are largely community-published rather than vendor-authored, and if the bar is later set at a curated vendor-maintained pack set rather than a browsable catalogue, this cell should be revisited along with the rest of the Agent builder lane, where the same marketplace pattern will recur on n8n, make, zapier, flowise and langflow.

Stands at F on re-retrieved evidence. This is the strongest form of the axis: the customer chooses the model, chooses the provider, brings its own key, and can run a local model with no external inference at all. Per-node model selection is the detail worth carrying, since it means model choice is a workflow design decision rather than an account-level setting. Not to be confused with the Ext credit for Dify publishing MCP servers, which is the opposite direction of travel and is graded there.

Stands at F and the provider list is broader than the July basis recorded, now taken from the Agent block reference rather than summarised. THIRTEEN PROVIDERS ARE NAMED IN THE BLOCK DOCUMENTATION: OpenAI, Anthropic, Google Gemini, xAI Grok, DeepSeek, Groq, Cerebras, AZURE OPENAI, AZURE ANTHROPIC, GOOGLE VERTEX AI, AWS BEDROCK, OpenRouter, and local models through Ollama or VLLM. Selection is per Agent block from a model combobox where the builder can type or select any supported model. THE THREE HYPERSCALER ROUTES ARE THE ENTRIES THAT MATTER MOST and were not in the July list. Azure OpenAI, Azure Anthropic, Vertex AI and Bedrock let a customer consume frontier models through a cloud contract they already hold, under their existing data processing terms and commit spend. For a regulated buyer that is frequently the only permitted route to a given model, and a platform that omits it forces a procurement conversation that has already been had. THE ECONOMICS ARE DOCUMENTED AND UNUSUALLY CLEAN: bring your own key bills at base provider pricing WITH NO MARKUP, while hosted keys carry a 1.1x multiplier, and local models through Ollama or VLLM incur no API cost at all. Publishing the exact spread between routes lets a customer decide on cost rather than guess, and no-markup BYOK means the platform takes nothing on inference. THE GOVERNANCE LAYER IS THE PART FEW COMPETITORS HAVE: enterprise permission groups restrict WHICH PROVIDERS ARE ALLOWED, enforced at execution time and not only in the interface. So an organisation can permit Bedrock and forbid direct OpenAI across every agent its teams build, which is model choice bounded by policy rather than left to each builder. Combined with the fully offline self-hosted path credited on Dep, a customer can run the platform and its models entirely inside their own infrastructure.

Stands at F on re-retrieved evidence and clears Mike's 30 August Ext bar decisively, since the platform is callable from outside through a documented REST API with a published OpenAPI spec, which is the thing zencoder and baz lacked when they were corrected down to P. MCP is present as corroboration rather than as the bar. Under the section 7 axis rule the MCP server credits Ext and not Model, because the customer picks the assistant that reads Dify; the model-choice credit is graded separately and independently on its own evidence. No Dify API rate limit on the paid cloud tiers is a commercially relevant detail for anyone building on top.

Stands at P on re-retrieved evidence, and the absence half is evidenced from a complete first-party documentation index rather than from a failed search. Real debugging and manual testing, no evals product: the customer can step a node, inspect variables and annotate outputs, but nothing scores a change against a dataset or catches a regression automatically. That is the P shape applied throughout Coding agent, where F required a harness the customer points at its own workload, as goose and openhands ship. Annotation is the nearest thing to a quality loop and is genuinely useful, but it curates answers rather than measuring them. This is the cell most likely to move if Dify ships evaluation, and it is worth re-checking each sweep.

Stands at F, and the July self-flag is resolved. That basis recorded honestly that THE EVALUATOR PAGE ITSELF WAS NOT OPENED IN THIS PASS SO DEPTH IS GRADED FROM ITS FIRST CLASS PLACEMENT IN THE BLOCK SET. The page is now open and the depth holds up. WHAT THE BLOCK ACTUALLY DOES: it USES AI TO SCORE AND ASSESS CONTENT QUALITY AGAINST CUSTOM METRICS, where the customer defines each metric with a name, a description and a numeric range, the documented examples being accuracy, clarity and relevance on one-to-five scales. THE SCHEMA ENFORCEMENT IS THE DETAIL THAT MAKES IT AN INSTRUMENT RATHER THAN A PROMPT. The Evaluator GENERATES A JSON SCHEMA RESPONSE FORMAT BASED ON YOUR METRICS AND ENFORCES STRICT MODE, SO THE LLM IS CONSTRAINED TO RETURN ONLY THE EXPECTED METRIC SCORES AS NUMBERS, NO EXTRA TEXT OR EXPLANATIONS. Numbers rather than prose is what makes a score comparable at all, and it is the difference between this and the model-as-judge pattern held at Partial on snaplogic. THE COMPARISON LIMB IS DOCUMENTED EXPLICITLY: the block is described as suited to QUALITY CONTROL, A/B TESTING, and one of its named use cases is A/B TESTING CONTENT, COMPARE MULTIPLE AI-GENERATED RESPONSES. The guidance also states CONNECT WITH AGENT BLOCKS: USE EVALUATOR BLOCKS TO ASSESS AGENT BLOCK OUTPUTS AND CREATE FEEDBACK LOOPS, so the subject being scored is the agent's own behaviour on the customer's own work, which is exactly what the ruled bar asks. A WORKED PATTERN IS PUBLISHED: Agent generates, Evaluator scores, Condition checks a threshold, then publish or revise. That is a quality gate with a readable numeric result driving control flow. THE HONEST LIMIT, and it is why this is not the strongest Eval cell in the index: comparison is between candidate outputs within a run, not across agent versions over time. No retained test set, stored expected outputs or regression run history is documented, which is what agentx has and this does not. Debugging is separately strong through block-by-block run traces, knowledge base retrieval debugging and per-run cost.

Stands at N on re-retrieved evidence, and the reasoning is the one thirteen June-cohort records in Coding agent got wrong. Sandboxed Code execution is present here and is NOT credited: running Python or JavaScript in a sandbox is code execution, not operating software the vendor does not control. Web crawling is likewise not computer use, since it fetches documents over a programmatic interface rather than driving a rendered UI. Confidence is medium rather than high because third-party browser-automation plugins may exist in the marketplace, whose listings render client-side and were not enumerated; under section 7 an installed third-party plugin would in any case be that plugin's capability and not Dify's.

P>F, and this is a consistency correction rather than new evidence. The July basis found the capability and then withheld Full on a bar that does not exist. ITS REASONING, VERBATIM: the browser engine is AN INTEGRATED THIRD PARTY RATHER THAN SIM'S OWN, SO THE CAPABILITY IS DELIVERED BUT NOT FIRST PARTY. That test appears nowhere in the axis definition, which asks whether an agent operates software the vendor does not control because no programmatic interface exists. It asks what the customer can do, not who wrote the driver. THE INDEX DOES NOT APPLY THAT BAR ANYWHERE ELSE, which is what makes it an invented one. Model cells credit vendors for OpenAI and Anthropic models they did not build. Know cells credited joget and autogpt for Pinecone integration. Mem cells credit Mem0 across three records including this one. Penalising a third-party engine only on Comp would single out one axis for a rule the other thirteen do not carry. THE DECIDING PRECEDENT IS FROM EARLIER TODAY AND IS THE SAME ENGINE. autogpt moved N>F on a Stagehand Blocks section in its documentation, Stagehand being Browserbase's framework built on act, extract and observe. Sim ships FIRST CLASS BROWSER USE AND STAGEHAND INTEGRATIONS in its tools catalogue, with Apify and Bright Data alongside. Same engine, same integration shape, same product category, reviewed the same day. Grading them differently would have been indefensible. WHAT THE CUSTOMER ACTUALLY RECEIVES is the test that matters: a workflow block that drives a real browser against an interface with no API, composable beside the other thousand integrations. Browser Use and Stagehand both perform navigation and action rather than retrieval alone, which is the line held against scraping on ai-library, pickaxe and joget this session. Recorded for the lane: fifth genuine Comp positive in Agent builder, after sema4-ai, kalcend, integrail and autogpt, and the second resting on Stagehand.