Nod n8n: Open-Source Personal Agent with Its Own PC

On a Friday afternoon, an email reminds you a supplier payment is due. The invoice sits inside a customer portal: log in, download the PDF, forward it to accounting. A trial is about to expire, too. You ask a chatbot to draft the invoice request and a meeting outline. It does that well — in words. But the invoice is still not downloaded, and the trial is still not cancelled. The rest is still on you.

That is the gap Nod n8n aims to fill: an open-source personal agent from n8n Labs, announced on 10/11/2026, that runs everyday errands on real websites — requesting invoices, preparing meetings, cancelling trials, booking appointments. It has its own Linux computer and Chromium browser, separate from your machine, and asks before acting on your behalf. Checked on 12/11/2026; I have not run it hands-on.

What is Nod n8n?

Nod is a standalone personal agent from n8n Labs, repo n8n-io/nod, under the Apache 2.0 license. As of 12/11/2026, the repo had 574 stars and 78 forks, and the latest release was nod-v0.6.2 (11/11/2026). The cadence is intense — v0.6.0 on 09/11, v0.6.1 on 10/11, v0.6.2 on 11/11 — a sign this is still a research preview.

Using it is fairly simple: you assign work in natural language, for example “request this month’s invoice from supplier X”. Nod plans the task, then asks again before acting. Only after you approve does it open its own browser and finish the job. Each task shows its cost; you can set a monthly spending limit, and Nod asks again when a task exceeds 5 USD — a threshold you can change.

How Nod differs from n8n, chatbots, and coding agents

The easiest mistake is to treat Nod as another version of n8n. It is not: n8n is a workflow platform where you draw flows, attach nodes, and connect triggers to actions. Nod has no workflows, no nodes, and needs no n8n account — you assign work in words, and it decides the steps itself.

A chatbot answers in text and stops there. Nod acts on real websites through its own browser — logging in, searching, filling forms, downloading files. If a chatbot is a good drafter, Nod is an executor that must ask permission before each step.

Compared with coding agents, Nod heads in a different direction. Orkas runs several local-first agents on the desktop and T3 Code controls coding agents from a phone — both revolve around writing code. Nod writes no code and manages no multi-agent workspace: it handles personal errands for a single owner, on its own computer.

Nod’s architecture: why “its own computer” is the key point

Main components

• Nod server (Node.js 24, Fastify, React, Electron): coordination hub — trust check, Vault, and long-term memory run here.
• Linux workspace container: the agent’s own computer.
• Separate Chromium container (agent-browser): its own browser for operating on real websites.
• PostgreSQL + pg-boss: durable storage and job queue.
• Pi agent runtime, MCP, and Composio: connections to external apps (Gmail, Calendar, Slack, Notion, Linear).
• Decoupled model provider: OpenAI, Anthropic, Gemini, OpenRouter, Bedrock, Vertex, Azure, ChatGPT Plus/Pro, or local models (Ollama, LM Studio, vLLM, llama.cpp).

Data flow and control flow

An errand goes like this: you assign the work, the Nod server checks trust, looks up memory and the Vault, makes a plan, and asks before acting. Only after you approve does it call the workspace container, browser container, or an external app. The model provider only receives the filtered task — keys never enter the container.

The key principle is untrusted-by-default: every result returned from an app, the web, or the browser is data, not an instruction. A malicious page could insert the words “send this email”, but for Nod that is only data to read, not a command to follow.

flowchart LR
    U[User<br/>assigns work, approves actions] --> S[Nod Server<br/>Trust Check, Vault, Memory<br/>PostgreSQL + pg-boss]
    S -->|asks before acting| U
    S --> W[Workspace Container<br/>Linux sandbox]
    S --> B[Browser Container<br/>Separate Chromium]
    S --> A[Apps via MCP / Composio<br/>Gmail, Calendar, Slack, Notion]
    W <--> S
    B <--> S
    A <--> S
    S -->|filtered prompt;<br/>keys never enter sandbox| M[Model Provider<br/>OpenAI / Anthropic / Gemini / Ollama]
    B -->|untrusted data,<br/>not instructions| S

Technical limits to know before installing

• Research preview v0.6.x: features and APIs are still changing fast — pin the exact version that was verified.
• Stops when the laptop sleeps: when the laptop sleeps, the task stops — for scheduled runs, keep it on a Mac mini or an always-on server.
• One owner per Nod; no phone calls; no Linux desktop app yet; Windows 11 preview, requires WSL 2.
• App connections go through a connection service hosted by n8n — a cloud dependency on the most sensitive part.
• Usage data is shared with n8n, enabled by default, and can be turned off at Settings → Privacy & data.
• Dependencies: Docker, PostgreSQL, and an external model provider.

How to install and self-host Nod n8n

Prerequisites and version

The verified version is nod-v0.6.2, released 11/11/2026. Three install methods: desktop on macOS 14+ via .dmg, Windows 11 preview via .exe (requires WSL 2); self-hosting via Docker Compose; or running from source (Node.js 24.21+, pnpm, Docker). Prepare a model provider first, and decide whether to try it on a laptop or an always-on server.

Installation: desktop, Docker Compose, running from source

Method 1 — Desktop: download nod-arm64.dmg or nod-Setup-x64.exe from GitHub Releases, install it like a normal app, then connect a model provider and your apps.

Method 2 — Self-hosted Docker Compose: on a Linux server (AMD64/ARM64) or a Mac mini with Docker Desktop, you need Docker Engine 25+ with Compose v2, at least 2 CPUs, 8 GB RAM, and 50 GB disk. The setup follows the official docs:

git clone https://github.com/n8n-io/nod.git
cd nod/deployment/self-host
sh setup.sh
docker compose up -d --build --wait

setup.sh creates a separate .env file with the server token, Vault key, and database password. Once the stack runs, open http://localhost:4310 (or use an SSH tunnel if the server is remote), enter the NOD_AUTH_TOKEN from .env, and complete onboarding to connect a model. A prebuilt bundle server-<commit> is also downloadable from GitHub Releases — see the self-hosting docs.

Method 3 — Run from source, commands verified from the repo’s README:

git clone https://github.com/n8n-io/nod.git
cd nod
corepack enable
pnpm start

After installation, connect models and apps: pick a provider (your own API key, or a local model via Ollama), connect Gmail, Calendar, Slack, Notion, and Linear via MCP/Composio, and set your monthly spending limit.

Post-installation checks

Check in this order: the Nod interface loads and the server runs; the workspace and browser containers have started (Docker must be running — the most common failure); PostgreSQL is reachable and the model provider responds. Then assign a simple, low-risk errand. Expected result: Nod asks before acting, completes the task, and shows the cost.

Common errors

• Docker not running: start Docker first, then restart Nod.
• Node.js below 24.21+: upgrade Node.js.
• Windows missing WSL 2: install WSL 2 first.
• Model provider not configured: check the API key and provider in Settings.
• Laptop sleep stops tasks: behaviour by design — move Nod to an always-on machine.

Backup and rollback if you need to remove it

Nod changes three things: data in PostgreSQL, files in the workspace container, and credentials connected through the connection service. Before upgrading, back up the PostgreSQL database and note the connected apps and model provider configuration. To remove it cleanly: stop Nod, revoke the connected credentials, and delete the workspace/browser containers and PostgreSQL data. To roll back: reinstall the exact old release tag (for example nod-v0.6.2) and restore the backup. I have not run this myself — try it on a test machine first.

Technical assessment

Pros

• Open source under Apache 2.0, self-hostable, with no lock-in to an n8n account.
• A genuinely separate computer and browser, able to do work on real websites.
• A clear security model: untrusted-by-default, trust check and Vault on the server, asks before acting, keys kept out of the sandbox.
• Model flexibility: commercial APIs or local models via Ollama, LM Studio, vLLM, llama.cpp; per-task cost shown.

Cons

• Research preview, changing fast, no Linux desktop app yet, Windows only in preview; stops when the laptop sleeps; one owner; no phone calls.
• App connections still depend on a connection service hosted by n8n; usage data enabled by default.
• A young repo — 574 stars on 12/11/2026 — with a community still small compared with n8n.

Security: how far can it be trusted?

The strengths are clear: the trust boundary sits on the server, web data is only data, keys stay out of the sandbox, it asks before acting, and spending is capped. But before handing sensitive work to Nod, remember: safety depends on the model too, not just the architecture.

In n8n’s internal test of 240 decisions, GPT-6.1 Sol and Claude Opus 5.5 answered everything correctly, while Claude Haiku 5.5 let 8 unsafe actions through. Same pipeline, only the model changed — and the safety result differed sharply. A cheaper model may trade safety for money; choose consciously.

Operational advice: start with low-risk tasks; always approve sensitive actions manually; and keep the credentials you give Nod separate from your most important accounts.

Performance — only numbers with a source

These figures are all from n8n and have not been independently verified: 93.2% LongMemEval is a long-term memory benchmark, not task-completion reliability; 98% of 226 test errands completed, 0 unsafe actions in 678 runs is n8n’s internal evaluation; setup in about 10 minutes is an n8n blog claim; 227 connected apps comes from a secondary hands-on article. Do not infer speed or scalability from them.

Comparing Nod with alternatives in the same space

Orkas runs several local-first agents on the desktop; OpenBot is a self-hosted AI coworker; Cindy is a multi-device agent. Nod focuses on one thing: personal errands on the real web, with a separate browser container and an ask-before-acting step.

Nod in real use

• IT admin / sysadmin: requesting invoices, preparing meeting materials, cancelling trials, tracking the calendar — hand over repetitive work and approve before sending.
• Homelab self-hoster: run Nod on an always-on server via Docker Compose with a local model via Ollama — noting it still depends on the connection service hosted by n8n.

Conclusion: who should use Nod n8n, and who should wait

Use it now if you like self-hosting, accept a research preview, need a personal agent for errands on the real web, and are willing to approve each sensitive action. Try it this way: install the desktop build, assign one low-risk errand, then decide whether to connect more apps.

Wait if you need production stability, multiple owners, a Linux desktop app, or you have no always-on machine. Follow the next v0.6.x releases before handing over sensitive work.

Lessons learned

1. A chatbot only answers; a personal agent must act — Nod’s value lies in its separate browser container.
2. The safety boundary must sit outside the prompt: a trust check and Vault on the server are what stop prompt injection.
3. A cheap model can be expensive on safety: Haiku let 8 unsafe actions through, while Opus 5.5 and GPT-6.1 Sol got them all right.
4. “Self-hosted” does not yet mean “fully self-sovereign”.
5. One owner, one always-on machine: do not expect Nod to run scheduled tasks on a sleeping laptop.

Verification scope

Check date: 12/11/2026. Verified directly from the README of repo n8n-io/nod, the GitHub API, and the n8n blog. The evaluation figures (93.2% LongMemEval; 98% of 226 errands; 0 unsafe actions in 678 runs; 240 test decisions by model) are n8n’s own, not independently verified; 227 connected apps comes from a secondary hands-on article. Setup in about 10 minutes is an n8n blog claim. Not tested hands-on: this article does not claim Nod was installed or run. Cost and monthly limits are user-set configuration, not benchmarks.

References

• Meet Nod: a standalone personal agent from n8n Labs
• n8n-io/nod on GitHub
• Nod — product page and docs
• n8n releases open-source personal agent Nod for Mac and Windows
• Grok Bot vs n8n Nod: Paid vs Free