Semaphore proved a one-binary Ansible UI is the right shape. SwitchTender keeps that shape and adds what teams go looking for next. Every run paints as a live host-by-task matrix instead of scrollback. Go joins the tool list, and Ansible check mode or a Terraform or OpenTofu plan previews a change before it runs, while a script's dry run only checks the script without running it. RBAC, teams, and an approval bound to the content that runs are in the core. External secret managers plug in, from HashiCorp Vault to 1Password and CyberArk, where Semaphore reaches Vault, OpenBao, AWS, Azure, and Devolutions Server. And there's an audit trail you can prove offline. Your Semaphore backup imports in one command.
Semaphore's workflow approval node pauses a run until a user with task-run access approves or rejects it. SwitchTender's approval commits a digest of the inventory snapshot, the resolved container image, the pinned commit, and for Terraform or OpenTofu the saved plan. The executor recomputes that digest before it runs and refuses anything that moved after sign-off. An AI agent here is a principal with a ceiling below admin: it proposes runs, never approves them, and every receipt names the human it acted for. The audit trail is a signed hash chain that an Apache-2.0 verifier checks offline, with no account on the server.
What Semaphore sells in paid tiers ships in SwitchTender's free build, in the same binary: container execution for every tool, external secret managers, and per-object grants, which Semaphore offers as custom roles in Enterprise. Workflows with a graphical editor are free here too; Semaphore's docs and roadmap list them as Pro while its pricing page checks them in every tier. Distributed workers and active-active HA are Team here. Semaphore's global runners are free, so that row is theirs.
Three gaps, in Semaphore's own words. Its approval node "pauses the run until a user with permission approves or rejects," and no page documents what content that approval covers. Its roadmap says "approval decisions are logged with the approver's identity and timestamp"; its workflow docs do not describe approval logging. Its audit events record the acting user, the affected object, the action, the client IP address, and the user agent, and ship by syslog, by webhook as JSON or Splunk HEC, or by API pull, with no hashing or signing documented. Its MCP server lets an AI assistant "inspect and update projects, templates, inventories, repositories, schedules, and task context," in every tier. Here, an agent gets one credential and a ceiling instead.
A Semaphore run is a timestamped log stream with, for Ansible, a count of hosts that finished OK or failed and a table of failed tasks per server; the execution summary is Pro. SwitchTender paints every host and task live as a matrix, with the failed host highlighted, per-task timing, and drill-down. Six hundred hosts stay readable.
Pro pricing: Semaphore from $20 a month or $199 a year for 50 managed nodes and 500 managed resources, configurable by node count with an unlimited tier, and SwitchTender at $500 a year for up to 500 hosts, with five approval policies included. The unit differs, and in their favor or ours depending on your shape: ours is flat per organization, while one Semaphore Pro license covers up to three instances, and Enterprise is unlimited. That is a fair fight and we are not going to pretend otherwise. What is free here and not there: organizations, teams, per-object grants, a digest-bound approval gate, and a tamper-evident hash-chained audit trail with signed receipts that verify offline. Semaphore ships four fixed project roles in its free build, reserves custom per-template roles for its enterprise tier, pauses a workflow at an approval node for any user with task-run access, documents no binding of that approval to a commit, inventory, or plan, and documents no hashing or signing of its audit at any tier.
Semaphore's task view shows per-task output, and inventory change history is on its roadmap for 2.22. SwitchTender tracks every host across runs: flaky hosts flagged, durations trended, drift detected from a dry run, and big jobs split across shards balanced by measured host cost.
The full three-way table including AWX is on the comparison page.
| Capability | SwitchTender | Semaphore |
|---|---|---|
| Approval bound to the content that runs: inventory, image, commit, plan | a digest recomputed before execution | Workflow approval node; docs say Pro, pricing lists it in every tier; binding not documented |
| Hard ceiling on AI agents: cannot approve its own run or touch identity or secrets | agents are principals capped below admin | MCP server inspects and updates projects, templates, inventories, repositories, schedules; no ceiling documented |
| Evidence a third party verifies offline, without trusting the server | signed hash chain, Apache-2.0 verifier | |
| Deploy without Kubernetes | ||
| Live host-by-task matrix | Log stream; per-host OK and failed counts for Ansible, Pro | |
| Tools | Ansible, Terraform, OpenTofu, Bash, PowerShell, Python, Go | Ansible, Terraform, OpenTofu, Terragrunt, Bash, PowerShell, Python; any executable as a custom app |
| Per-object grants | Four fixed roles free, custom roles enterprise | |
| External secret managers: Vault, AWS, Azure, GCP, CyberArk, 1Password | Vault, OpenBao, AWS, Azure, Devolutions Server | |
| Enforced approval policies | Workflow approval node, manual, binding not documented; docs say Pro, pricing lists every tier | |
| Tamper-evident, signed audit | Activity log of acting user, affected object, action, IP, and user agent; syslog over TLS and Splunk HEC webhook in paid tiers; no hashing or signing documented | |
| Duration-balanced job splitting | ||
| Fleet memory: flaky hosts, trends | ||
| Drift detection from a dry run | Dry-run tasks, no drift report or reconcile | |
| Drag-and-drop workflow editor | Shipped in 2.19 as beta; docs say Pro, pricing lists every tier | |
| Distributed workers in the core | Team | global runners free, isolated runners and tag routing Pro |
| Active-active HA on PostgreSQL | creating the schema is Team, opening an existing one is never gated | With Redis, per its documentation |
| Advisory AI triage and fleet answers | MCP server that inspects and updates projects, templates, inventories, repositories, and schedules | |
| Drop-in Go plugins: tools, secrets, AI, notifiers | ||
| Import from other tools | One command | Its own project export only |
Checked against Semaphore's own documentation on 2026-10-08, for Semaphore 2.19.16, with 2.20.0-alpha3 in prerelease. Semaphore 2.19 added workflows with approval nodes, a graphical editor, Docker and Kubernetes executors, and per-task JWT identity tokens. A comparison decays the day it is written, so check a row against the current release before you rely on it. Full table and sources.
Semaphore has years of production use, a large installed base, and packaged distributions everywhere. If the features above matter more to you than that history, the import brings your projects across in one command and you can see for yourself.
Export a Semaphore backup, import it into SwitchTender. Projects, inventories, templates with their survey variables, schedules, and keys as credential shells come across, with a dry run first so you see the plan before anything is written.
switchtender import semaphore backup.json --db switchtender.dbswitchtender import semaphore backup.json --db switchtender.db --applyThe migration reference maps every Semaphore concept to its SwitchTender equivalent.
The five asked most often when somebody is comparing this against what they already run.
No. It reaches the machines it manages over SSH, the same way Ansible does, and installs no agent on them. There is no per-host daemon to deploy, patch, or account for. You run the one server binary. Worker processes for extra throughput are a Team feature, and they are pool members rather than agents belonging to a host.
All three, resolved at launch rather than copied into this database. Vault dynamic secrets go further: a short-lived credential is minted for each run and revoked when the run ends. Azure authenticates from the attached managed identity with no stored key, AWS takes an access key from the credential or the standard AWS environment variables, and anything else resolves through a command whose output is the secret.
Yes, and it is what pipelines are for here. Steps mix tools freely on a dependency graph with parallel branches, built on a drag-and-drop canvas, and an approval step holds the pipeline for a person before the steps after it run. A policy decides which runs are held, and an agent's run is held unless a written policy exempts it. When the approval has to bind an exact Terraform plan, run the apply on its own: it plans first, and the approval binds the saved plan, so it cannot be approved as one thing and executed as another. By default an admin may approve a run they launched. Requiring a different person is a Team rule.
An install keeps running as it is. There is no license server and no phone-home, a paid license keeps verifying offline through its term, and your data and receipts stay yours, checked by an open verifier that does not depend on us. Every release converts to Apache 2.0 two years after it ships, and at once if KordLoom ceases business.
Then the market wanted them, which is better news for us than the alternative. Nothing in a hash chain is hard to build and we have never claimed otherwise. But a receipt signed by the same product whose runs it describes is still that system's word about itself, and at this tier ours is no different. The property neither of us can self-provide is an outside party watching the chain and countersigning what it saw, which is what our Enterprise tier includes and what the hosted witness add-on brings to Team. Until then, judge us on the seven engines and on whether the receipt verifies with an open-source verifier, published separately, that you can read and run yourself.