RunbookAI vs Shuffle
RunbookAI
userunbook.aiShuffle
shuffler.ioSide by side
| Figure | RunbookAI | Shuffle |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | — | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | — | Yes |
| Plans published | 0 | 3 |
| Spec score · Runbook Automation Software | 6.8 (#17) | 7.6 (#8) |
| Integrations | Documented integrations include AWS, Kubernetes, PagerDuty, OpsGenie, Slack and Claude Code. | Shuffle's public app catalog lists more than 2,500 apps, including integrations such as Slack, Gmail, MISP, Wazuh, Splunk, and Jira. |
| Purpose | RunbookAI investigates production incidents by forming hypotheses, gathering evidence and recommending fixes. | Shuffle is an open-source automation platform designed for the security industry, for building and executing automation workflows. |
| Support | The documentation directs users with questions or issues to GitHub Issues or Discussions. | The pricing page lists Shuffle Support with SLA and email support for Business, with on-call support and an alert mechanism additionally listed for Enterprise. |
Plans
In their own words
RunbookAI
RunbookAI is a self-hosted, MIT-licensed incident-response tool for investigating production problems. Its workflow collects incident context, ranks hypotheses, checks them against infrastructure, identifies a root cause, and recommends remediation. Users can ask natural-language questions across AWS, Kubernetes, and CloudWatch, then execute step-by-step runbooks. Queries are read-only by default; every mutating action needs explicit human approval. Investigations record hypotheses, evidence, proposed actions, approval decisions, and execution results in a local audit trail. RunbookAI indexes knowledge from local files, Confluence, and Google Drive. Documented integrations include AWS, Kubernetes, PagerDuty, OpsGenie, Slack, and Claude Code. A self-hosted shared knowledge server exposes runbooks, postmortems, and known issues through REST and an MCP endpoint for Claude Code. CLI mode is available, with no hosted service or control plane. The maker says it runs inside your infrastructure, sends no telemetry, and sends model requests directly to the configured provider without proxying or storing prompts. Requirements include Bun 1.0+ or Node.js 20+ and an Anthropic API key for Claude.
Shuffle
Shuffle is an open-source automation platform for security teams to build and run workflows. Its visual designer works with a no-code app creator that can generate integrations from Swagger or OpenAPI specifications and API documentation URLs. The public catalog contains more than 2,500 apps, including Slack, Gmail, MISP, Wazuh, Splunk, and Jira. Workflows can start through webhooks, schedules, subflows, or user input; extension triggers include AWS Lambda, AWS S3, Kafka, and Pub/Sub.
Deployment choices include self-hosted open source, self-hosted licensed software, Shuffle Cloud, and hybrid setups. Documented runtime architectures include Docker Compose, Docker Swarm, a cloud-hybrid local Orborus runner, and Kubernetes with Helm charts. Shuffle documents bcrypt password hashing, AES-256 encryption, tenant-controlled SAML/SSO and MFA, and a Bearer-token API. The free Scale plan is free and includes 2,000 app runs per month, with a hard limit, three tenants, and one location. Custom Python apps are not yet easy to create for Shuffle Cloud, though on-premises instances support local app hotloading.