Dify vs Nocobase
Dify leads on trust: 76.8/100 (Grade B) against 60.1/100 (Grade C), a 16.7-point gap. Dify leads on transparency and adoption, and rests on broader evidence.
Build Agentic workflows, RAG pipelines, with rich AI model and tool support on one collaborative workspace. Deploy on cloud, VPC, or self-hosted, so teams move from prototype to production without rebuilding the stack.
Choose Dify if transparency and adoption matter most.
- +9.6Transparency: OSSF Scorecard 5.2 against 3.9
- +7.5Adoption: 25.6M weekly downloads against 27
- +1.6Safety / Integrity: OSSF Scorecard 5.2 against 3.9
- A vs BEvidence coverage: 4 of 5 independent signal types, against 3
NocoBase is the open-source platform for building, running, and evolving business systems with AI. Agents write the code and do the work, NocoBase provides the foundation and governance, and people make the decisions.
Nocobase doesn't lead on any scored dimension in this pair.
Where they differ
2 dimensions identical: Identity 10.8 · Maintenance 19.9 · Full evidence table
An independent, evidence-based trust comparison of Dify and Nocobase, two Workflow Platforms projects in the HVTracker registry. Scores come from public, checkable signals — supply-chain provenance, OSSF Scorecard, maintenance, and adoption — not popularity.
Full evidence
| Signal | Difylanggenius/dify | Nocobasenocobase/nocobase |
|---|---|---|
| HVTrust score | 76.8 | 60.1 |
| Evidence grade | B | C |
| Coverage grade | A | B |
| Overall rank | #230 | #694 |
| Rank in Workflow Platforms | #6 | #16 |
| GitHub stars | 160.3k | 24.8k |
| Last updated | 1d ago | 1d ago |
| Build provenance | No | No |
| OSSF Scorecard | 5.2 / 10 | 3.9 / 10 |
| License | NOASSERTION | — |
| Downloads | 25.6M/wk | 27/wk |
| Trust dimensions (points earned) | ||
| Safety / integrity / 25 | 11.5 | 9.9 |
| Identity & provenance / 18 | 10.8 | 10.8 |
| Transparency / 17 | 12.9 | 3.3 |
| Maintenance / 20 | 19.9 | 19.9 |
| Adoption / 20 | 20.0 | 12.5 |
| Runtime capability surface (full matrix) | ||
| MCP server | Declared | Declared |
| External providers | — | — |
| Requires API keys | No | No |
| Plugin surface | plugins | plugins |
| Provenance drift | Partial | Match |
How to read this: HVTrust (0–100) weighs supply-chain signals (provenance, OSSF Scorecard, signed commits, open license) alongside real-world adoption, scaled by an evidence-confidence factor. Grade bands: A ≥ 80, B ≥ 65, C ≥ 50, D < 50. Signals refresh daily. Full methodology v4.4 →