n8n nod: The Open-Source Personal Agent That Runs on Your Computer, Explained

The n8n nod announcement on November 10 brought a new kind of release from the workflow-automation company: Nod, a standalone, open-source personal agent from n8n Labs that runs on your own computer with its own sandbox and browser, connects to your accounts, and does multi-step jobs end to end while asking before it acts. It is a research preview, it is free under Apache 2.0, and it is deliberately separate from n8n itself. For anyone watching how personal agents are being productized, the design choices here are worth a close read. Source

What Nod is

Nod is a desktop app for Mac and Windows, with the code on GitHub, that gives you one ongoing conversation with an agent that has its own Linux workspace and browser. Because it operates a real computer and browser locally, it can finish jobs that a chat assistant would hand back to you as a to-do list: it works in connected apps like Gmail, Calendar, Drive and Slack, and on websites that have no integration at all. The same conversation shows in the app, in a web browser, and on Telegram or WhatsApp, so a task started on a laptop can be checked from a phone. Source Source

Two architectural decisions define it. First, your model, your hosting: Nod sends model requests to the provider you choose, via an API key or a ChatGPT plan, or to an OpenAI-compatible server such as Ollama running on your own hardware. Second, no n8n account is required: Nod lives outside n8n, though if you run n8n you can connect your instance so Nod can work with your workflows. Source Source

Why n8n built a single-player agent

n8n's framing is that most of what people build in n8n is multiplayer: shared processes a team runs on a shared instance. Nod is built for one person. It connects to that person's accounts and takes the ongoing jobs that are theirs alone, business or household. Early testers, in n8n's telling, slotted it into a clear division of labor: the chat assistant is where they think and write, n8n runs shared processes, and Nod takes their personal queue. n8n is explicit that Nod is a Labs experiment and does not change the core product's direction. Source

What it does day to day

The jobs n8n lists are concrete: cancel a subscription and push through the retention offers for a refund; watch a price and flag the drop; find a hotel and book it once you approve; sign in to supplier portals monthly, download invoices, and file them for an accountant; pull numbers out of a dashboard with no export and put them in a weekly report. Nod also works ahead of you, reading connected apps and proposing jobs it could take over. It runs several jobs in parallel in the background, and repeating work like a morning brief can run on a schedule. Source

On memory, n8n says Nod retains months of conversation and scored 93.2% on LongMemEval, a public benchmark for long-term memory, which the company describes as among the best published memory systems. It also checks how you write when you connect Gmail so its drafts sound like you, and it writes down how it completed a task so it can repeat the procedure and repair its notes when a site changes. Everything Nod keeps about you is viewable, editable, and deletable. Source

The trust architecture

An agent that can send email and pay with your card lives or dies on its permission model, and n8n has clearly thought about it. Nod is open source under Apache 2.0, so every rule it follows is inspectable in the code. It works inside a private virtual machine on your computer with its own browser; its data, memory, and saved logins stay on the machine running it, and your model provider receives only what each task needs. Before Nod sends, pays, posts, or deletes anything you did not ask for, a separate check confirms you asked for it, and a web page or an email cannot give Nod orders. Saved logins and cards are encrypted locally and entered through private forms the model cannot read. Every sign-in, card use, and app action is logged with its cost. Source

The honest part of the announcement deserves attention: the permission check is itself a model and can make mistakes, which is why Nod asks when your words do not cover an action. The docs add that background work Nod starts on its own only reads and drafts, unless you have explicitly told it what to do autonomously. That is a real boundary, stated in plain language, with the failure mode named. Source Source

What it costs and the guardrails

Nod itself is free; you pay your model provider for usage, or run an open-source model locally. n8n is candid that early testers found tasks cost more than they expected and says recent releases brought cost down substantially. The guardrails: every task shows its cost and ends with a receipt, you can set a monthly spending limit, Nod checks in with you once a task passes five dollars (a threshold you can change), and each schedule displays its estimated monthly cost. Source

What it does not do yet

The limitations are plainly listed. When Nod runs on your laptop, it stops when the laptop sleeps; some testers keep it on an always-on Mac mini or their own server, and a hosted version is on the roadmap. Each installation has exactly one owner. It cannot make phone calls. The docs also warn this is an early preview with rough edges and breaking changes, and the GitHub repository confirms how new it is, created in late September 2026 with a small early community. Source Source Source

Our read

This section is our assessment, not n8n's claims. Nod is the clearest example yet of the local-first personal agent pattern: the agent, its memory, and its credentials stay on hardware you own, and only task content flows to the model provider. That inverts the cloud-agent default and removes an entire class of data-residency questions for solo operators. It also shifts the operational burden to you: an agent that stops when your laptop sleeps is an availability problem you now own.

Second, the permission design tracks the discipline we argue for in least-privilege for AI agents: a distinct check before consequential actions, read-and-draft defaults for self-started work, credentials the model can never see, and a complete action log. The named caveat, that the permission check is a model and can be wrong, is the right instinct; treat it as one control, and keep irreversible actions behind your own confirmation, the same argument we made in ungoverned agentic AI.

Third, the cost guardrails are the part other agent products skip. Per-task receipts, spending limits, check-ins past a threshold, and schedule cost estimates map directly onto the practices in AI agent cost control. If a personal agent cannot show you what it spent, you are the cost-control mechanism.

Practical bottom line: if you are comfortable connecting your own API key, Nod is worth one real job from your week, run with the spending limit set and the action log open. Watch whether its task notes actually survive the sites you use changing.