# n8n's Nod Agent: A Hands-On Look at the Dots and Grokbot Rival > Source: > Published: 2026-11-12 00:00:00+00:00 # n8n's Nod Agent: A Hands-On Look at the Dots and Grokbot Rival n8n's free personal AI agent Nod runs locally, connects 225 apps via Composio, and posts a 93.2% memory recall score. Here's how it compares. ## What is Nod, and how is it different from other personal AI agents? Nod is a free personal AI agent built by n8n Labs, a spin-off of the automation company n8n. Unlike most competitors in this space, Nod runs on your own computer (or a server you control) instead of a vendor’s cloud, and it lets you pick your own model provider rather than locking you into one. It connects to 225 apps through Composio’s OAuth infrastructure, handles full tasks (research, logins, payments, file creation) rather than just answering questions, and ships with a memory system that reportedly scored 93.2% on a long-term recall benchmark. It’s currently in early preview, available as a desktop app for Mac and Windows, with WhatsApp and Telegram access layered on top. ## TL;DR - **Local-first architecture** sets Nod apart: it runs on your own machine or your own server, not a third-party cloud, which also means it works in regions like the UK where Dots’ Pro plan and Claude Duet currently don’t. - **Model flexibility** is built in from onboarding: you can bring an Anthropic API key, sign in with a ChatGPT Plus or Pro account, route through OpenRouter, or point it at a model running locally, with Nod showing per-task cost and letting you set a monthly spending cap. - **App connectivity** comes via Composio, giving out-of-the-box access to 225 apps with one-click OAuth, and critically, support for multiple accounts of the same app (useful for people juggling several email inboxes for invoices and receipts). - **Security is handled outside the model** : payment confirmations require your card security code (never stored), sign-ins and card use go through a vault the model never directly sees, and trust decisions are deliberately separated from the LLM so a malicious prompt injection can’t push through a payment without user confirmation. - **Memory is the standout technical feature** , organized into five categories (identity, preferences, contacts, routines, past mistakes), built from direct quotes of your own messages, and tidied hourly rather than deleted outright. - **Early benchmark claims look strong** : a reported 93.2% score on a long-term memory recall test (500 questions across months of chat history) and zero successful prompt-injection attacks out of 216 attempts, versus an 87.5% attack success rate reported against Open Claw in the same test. - **It’s genuinely early** : as a preview product from n8n Labs, expect rough edges, including the lack of separate conversation threads at launch. Remy. **claims.northwind.internal** Your servers. Your domain. **1,902** **214** **17** **3.2h** **CLM-20417 · M. Alvarez**$4,120 *Approved* **CLM-20418 · D. Okafor**$880 *In review* **CLM-20419 · S. Lindqvist**$12,300 *In review* ## How does Nod handle app connections and multi-account setups? Nod uses Composio on the backend, which gives it access to roughly 225 apps right out of the box. Each connection goes through the app’s own OAuth flow, so it’s a one-click sign-on rather than manual API key wrangling. The detail that stands out is multi-account support. Many personal agents let you connect one instance of an app, say, one Gmail account. That’s a real limitation for anyone running a business where invoices and receipts land across several inboxes. Nod lets you connect multiple accounts of the same service and monitor all of them through scheduled tasks. For bookkeeping-style workflows (chasing invoices, reconciling receipts, drafting replies across inboxes) that difference matters more than it sounds. Connectivity also isn’t limited to the desktop app. Nod supports WhatsApp and Telegram, and conversations carry over between desktop and mobile as one continuous thread with shared memory. ## Is Nod secure enough to trust with payments and logins? This is where n8n’s background in business automation shows. Nod is built around what the company calls trust principles, documented publicly, covering data ownership, model choice, and “open by default” access to the source code. Three mechanics do the actual work. First, payments require the user to enter their card security code every time, and Nod never stores that code. Second, logins and card details are handled through a vault: credentials get typed directly into the target website without the underlying AI model ever seeing them. Third, and most important, trust and validation checks are deliberately separated from the model itself. That means even if a malicious email or webpage tries to instruct Nod to make a payment or send money somewhere it shouldn’t, the system pauses and waits for explicit user confirmation rather than letting the model decide on its own. Every sign-in, card use, and message sent through connected apps gets logged, and users can set a hard monthly spending cap inside the app. n8n has published its own comparison against Dots, Muse, and an agent referred to as Instinct. According to that comparison, Nod is the only one of the four that runs on the user’s own computer, allows free choice of model and provider, documents a hard spending limit, and is fully open source. Muse reportedly also has a solid audit trail and permission system. Dots, by contrast, hasn’t published much documentation, making it hard to evaluate directly. ## How good is Nod’s memory system, really? Memory is arguably Nod’s most technically interesting feature. Instead of a flat chat log, Nod keeps what’s described as a private notebook split into five sections: who you are, how you like things done, the people you deal with, your routines, and lessons from past mistakes. Before responding to any message, it pulls only the notes relevant to that specific request, rather than dumping the entire memory store into context. *Nothing gets lost.* The notable design choice is that a separate memory model writes each note, and every note has to be traceable to something you actually said. That’s meant to prevent hallucinated or inferred “memories” from creeping in. A background worker runs hourly to archive outdated or duplicate notes rather than deleting them outright, and after a complicated multi-step task, Nod reportedly writes itself a short how-to guide for next time, with personal details stripped out, functioning like a self-built skill library. On the long-term memory evaluation benchmark (500 questions asked about months of prior conversation in a fresh session), Nod scored 93.2%. n8n also ran an adversarial test: 216 attempts to slip false information into memory via emails read by the agent. None succeeded, reportedly because the system requires a direct quote from the actual user before accepting something as memory. The same attack type run against Open Claw succeeded 87.5% of the time, according to n8n’s testing. Users can view and edit every stored memory note from inside the app’s settings. ## How does Nod compare to Dots, Muse, and Grokbot in practice? Direct side-by-side testing is limited by availability. At the time of testing, Dots’ Pro plan wasn’t available in the UK, Switzerland, or the EEA, Claude Duet was a US-only research preview with a waitlist, and Muse was still rolling out in the US. Grokbot, however, was accessible in the UK, allowing a direct comparison. In one test, both Nod and Grokbot were given the same vague task: find an Apify scraper suitable for generating SEO and AI-search-agency leads for a specific business. Both agents read the target website for context, searched Apify, compared scraper options, and landed on the same tool based on user count and rating. Both then paused to run a small paid pilot before asking for explicit approval, correctly recognizing that running the scraper would cost money. The core difference isn’t task quality so much as where the work happens. Grokbot runs tasks on its own cloud infrastructure. Nod runs on the user’s own computer by default (with the option to move to a dedicated server later), keeping data ownership local rather than on a third-party server. ## What are Nod’s current limitations? As an early preview from n8n Labs, Nod has rough edges the team itself acknowledges. The most immediate gap is the lack of separate conversation threads, meaning everything currently lives in one continuous running conversation rather than organized, distinct task threads. For a tool positioned around handling discrete, multi-step jobs (chasing invoices, booking travel, clearing a Slack backlog), the absence of thread separation is a usability gap likely to get addressed as the product matures out of preview. ## Frequently Asked Questions ### What is n8n’s Nod agent? Nod is a free personal AI agent from n8n Labs that runs on your own computer or server, connects to around 225 apps via Composio, and can complete full tasks like research, bookings, and payments rather than just answering questions. ### Is Nod free to use? The Nod application itself is free and open source. You pay your chosen model provider directly (Anthropic, OpenAI, OpenRouter, or a local model), and Nod displays per-task costs plus lets you set a monthly spending limit. ### How does Nod compare to Grokbot? *Enterprises have Remy.* **⌂** Self-hosted **✓** SOC 2 **✚** HIPAA **☰** Audit log Both can complete similar research and shopping-style tasks with comparable results, as shown in a side-by-side scraper-selection test. The main difference is infrastructure: Grokbot runs tasks on its own cloud servers, while Nod runs locally on the user’s own machine by default. ### Can Nod work outside the US? Yes. Because it runs on your own computer, Nod worked in the UK during testing, whereas Dots’ Pro plan was unavailable in the UK, Switzerland, and the EEA, and Claude Duet was limited to a US research preview with a waitlist at the time. ### How does Nod protect against prompt injection or data leaks? Nod separates trust and validation logic from the AI model itself, so payments always require manual confirmation and a card security code, and credentials are handled through a vault the model never sees directly. In adversarial testing, 216 attempted memory-injection attacks reportedly all failed.