NodePilot

NodePilot

Open-source Windows and PowerShell workflow automation. Self-hosted, agentless execution over WinRM, with an import path for System Center Orchestrator runbooks.

Multi-step automation is designed, scheduled, debugged and observed in the browser. PowerShell, file, registry and service operations, REST calls, SQL and further activities are executed across a Windows estate over WinRM, without agents on the targets.

🌐 Website · ▶️ Live demo · 📚 Documentation · ⬇️ Download · 🚀 Install

Live demo

Open the live demo to try the actual web UI with sample data. It runs entirely in the browser, requires no installation and sends no data anywhere. Each visitor has a private copy, which resets on reload. Workflows can be built, published and run, while the canvas updates live.

It is the product's own frontend on an in-memory backend, so anything that genuinely needs a server (PowerShell on a host, a WinRM test, mail, a restore) reports that limitation instead of pretending.

Product tour

Watch product video

Table of Contents

• Product tour
• Why NodePilot
• Install, pick one of three paths
• Coming from System Center Orchestrator
• Documentation
• Project Structure
• Testing
• Contributing
• License

Why NodePilot

NodePilot is agentless workflow orchestration for Windows, built in the browser and running PowerShell on remote machines over WinRM. It is meant for sysadmins automating Windows estates, for organizations looking for a modern alternative to SCOrch, as well as for private users who rely heavily on PowerShell.

Highlights

• Visual designer: drag-and-drop canvas with 29 activity types, 6 triggers and a visual condition builder.
• Custom Activities: your own PowerShell-based activities, reusable from the palette like the built-in ones.
• Sub-workflows: a workflow calls another with parameters and gets its return values back.
• Parallel engine: branches really run in parallel and meet again at a junction.
• Step debugger: breakpoints, step-over, variable inspection and overrides at runtime, replay in the timeline.
• Live UI: step status and output appear in real time while a workflow runs.
• Agentless remote execution: WinRM and PowerShell, nothing is installed on target machines.
• Alerting: notification rules for run events and system conditions, delivered by email or signed webhook.
• AI features (opt-in): scripts and workflows generated from natural language, also with local models; a read-only chat that answers from the documentation, operational data and, if enabled, the database; and bounded agent/team workflow steps with evidence and reviews. Agent guide.
• CLI (np): every operation from the command line, for scripts and pipelines.
• MCP server for AI agents: nodepilot-mcp lets Claude Code and other MCP clients drive NodePilot — 116 tools over 12 groups, destructive operations gated.
• Observability: OpenTelemetry, Prometheus and a Grafana stack with 10 dashboards.
• Edit lock: a workflow is checked out by one user at a time and published atomically, as in SCOrch.
• Versioning: every edit is saved as a version, which can be compared and rolled back.
• Backup and export: an encrypted backup of the whole configuration, plus workflow export and import for sharing.
• SCOrch import: existing .ois_export runbooks become NodePilot workflows. How it works.
• Security: Admin, Operator and Viewer roles, encrypted credentials, secret redaction in output and an audit trail.
• Folder permissions: access to workflows can be granted per folder, on top of the global roles.
• Enterprise (preview): AD SSO via LDAP/Kerberos, OIDC and SCIM, Active/Passive HA and SIEM logging. See docs/enterprise-features.md.
• Deployment: installer for a Windows service under a gMSA, in-place upgrades with automatic rollback.
• Desktop app: a single installer for one Windows 11 machine, offline and with its own database.

Install, pick one of three paths

NodePilot runs in three supported shapes. Each one leads to a working login on its own.

NodePilot is Windows-only by design, because the engine drives PowerShell remoting over WinRM and protects credentials with DPAPI.

On every path the first login creates the Admin account with a one-time setup token. Where the token comes from is noted per path.

Path 1: Desktop app

A local application for Windows 11 x64. One .exe bundles the app, the .NET 10 runtime and a local PostgreSQL, installs them as background services and opens a native window. It works fully offline.

NodePilot-Desktop-Setup-<version>.exe is downloaded from the latest release and run with local admin rights. The installer hands the setup token straight to the login screen. Since the backend runs as a service, scheduled and webhook triggers keep firing while the window is closed. Help with problems is in docs/desktop-troubleshooting.md, and all log files are listed under Logs & diagnostics.

deploy\desktop\Build-DesktopInstaller.ps1 -PgBinariesPath 'C:\Packages\pgsql' -Version 1.2.0
# -> deploy\desktop\out\NodePilot-Desktop-Setup-1.2.0.exe

Path 2: Windows service

NodePilot runs as a Windows service under a gMSA, with HTTPS directly in Kestrel and in-place upgrades that can roll back.

Prerequisites, all checked by the installer's pre-flight:

• Windows Server 2022 or 2025, domain-joined for the gMSA path (-UseLocalSystem works without a domain)
• .NET Runtime and ASP.NET Core Runtime 10.0.11+, both x64. The wizard carries both and installs them if missing. The script path needs both installed beforehand, the standalone runtimes and not the Hosting Bundle
• PostgreSQL 16+ or SQL Server 2022 CU1+ (build ≥ 16.0.4003.1, required for Encrypt=Strict / TDS 8.0)
• a TLS certificate in Cert:\LocalMachine\My with its private key
• antivirus exclusions, see docs/av-exclusions.md

With the wizard. NodePilot-Server-Setup-<version>.exe from the latest release checks every prerequisite before changing anything and can install the runtimes, create the database or issue a lab certificate. It also runs unattended: Setup.exe /VERYSILENT /SUPPRESSMSGBOXES /ANSWERFILE=answers.json. Details are in deploy/server/README.md.

With the scripts, which the wizard uses as well. The signed NodePilot-<version>.zip is downloaded with its manifest files, verified against NodePilot-<version>.SHA256SUMS.txt and installed:

.\deploy\Install-NodePilot.ps1 `
    -ArtifactPath 'C:\Packages\NodePilot-1.2.0.zip' `
    -TrustedArtifactSignerThumbprint '<publisher thumbprint from the release notes>' `
    -CertThumbprint '<your TLS cert thumbprint>' `
    -ServiceAccount 'CONTOSO\svc-nodepilot$' `
    -PublicHostname 'nodepilot.corp.example.com'

The installer refuses unsigned or tampered artifacts. The pinned thumbprint is the trust decision, so no certificate has to be imported beforehand.

Further reading: the Windows Server deployment walkthrough, verification and troubleshooting in docs/deployment-guide.md, and every parameter in deploy/README.md.

Path 3: From source

For contributors and for evaluation on a workstation.

Prerequisites

• Windows 10 / 11 or Windows Server
• .NET 10 SDK (download), band pinned in global.json
• Node.js, at least the version in each package.json engines field
• PostgreSQL 16+, or SQL Server 2022 CU1+ with Database:Provider: sqlserver

1. Create the database

winget install PostgreSQL.PostgreSQL
$psql = "C:\Program Files\PostgreSQL\16\bin\psql.exe"
& $psql -U postgres -c "CREATE ROLE nodepilot WITH LOGIN PASSWORD 'ChangeMe!';"
& $psql -U postgres -c "CREATE DATABASE nodepilot OWNER nodepilot;"

2. Start the backend (port 5000)

The password is passed through the environment, so that it never lands in a tracked file:

$env:ConnectionStrings__Postgres = "Host=127.0.0.1;Port=5432;Database=nodepilot;Username=nodepilot;Password=ChangeMe!;SSL Mode=Disable"
cd src\NodePilot.Api
dotnet run

On first start the setup token is written to src\NodePilot.Api\admin-setup.token. The login screen asks for it on the first attempt and then creates the Admin account.

3. Start the frontend (port 5173)

cd src\nodepilot-ui
npm install
npm run dev

http://localhost:5173 serves the app and proxies /api, /healthz and /hubs to port 5000.

4. (optional) Bring up Grafana

cd grafana
Copy-Item .env.example .env     # then set NODEPILOT_GRAFANA_ADMIN_PASSWORD
docker compose up -d
# Grafana    -> http://localhost:3000   (user "admin", the password you just set)
# Prometheus -> http://localhost:9090

Startup requires a unique NODEPILOT_GRAFANA_ADMIN_PASSWORD. Compose fails closed while the password is missing. On the API side, these three variables enable the Prometheus endpoint:

$env:OpenTelemetry__Enabled = "true"
$env:OpenTelemetry__Exporters__PrometheusScrape = "true"
$env:OpenTelemetry__Exporters__PrometheusScrapeAllowAnonymous = "true"

More in grafana/README.md and in the installation guide on the documentation site, in English and German.

Example workflow

scripts/readme-showcase-workflow.json is a nightly health check that runs three probes in parallel, gathers them at a junction and then either sends an alert or logs that all is well. It is imported on the Workflows page via Import or through POST /api/workflows/import.

Coming from System Center Orchestrator

SCOrch is not going anywhere. System Center 2025 Orchestrator is supported until 2035, so an existing installation is not on a deadline. The exception is System Center 2016 Orchestrator, whose extended support ends on January 11, 2027. The options side by side are on the SCOrch alternative page.

What has not moved is authoring. Runbooks are still built in the desktop Runbook Designer, without version history, diff or rollback. NodePilot keeps the agentless model and moves the editor, the debugger and the version history into the browser.

Existing runbooks come across. NodePilot reads SCOrch's .ois_export XML (2012, 2016 and 2019) and turns runbooks into workflows:

• around forty activity types are mapped, including the Runbook Control set
• Published Data references are rewritten to NodePilot's {{...}} syntax
• links, conditions, global variables and the folder tree are preserved, as well as the canvas layout
• unmappable activities become disabled placeholders, and the import report lists every lossy translation

np workflow import-scorch --file .\runbooks.ois_export

Import also runs from the UI and from POST /api/workflows/import-scorch. The result is a draft to be reviewed: imported workflows arrive disabled, and credentials are not reconstructed because SCOrch encrypts them. Details are in the import documentation.

How the two compare

NodePilot provides the source and no support contract, and it is to be judged on that basis.

Documentation

Everything below the surface lives on the documentation site, 45 pages in English and German, with search and deep links. This README deliberately stops at "installed and logged in".

The API also documents itself. The OpenAPI spec is served at GET /openapi/v1.json, with Swagger UI at GET /swagger, in Development by default.

Production deployment

A real server rollout follows Windows Server deployment on the documentation site, a lab-validated walkthrough covering service identity, both database prov