n8n's New AI Assistant Builds Workflows For You — Self-Hosted on a $5 VPS (2026)
Automation2026-08-31

n8n's New AI Assistant Builds Workflows For You — Self-Hosted on a $5 VPS (2026)

n8n Just Shipped an AI That Builds Workflows For You

Building workflows manually is dead. n8n 2.37 shipped an AI Assistant that creates, edits, tests, and troubleshoots entire workflows from natural language — and very few people are running it the right way yet. In this guide (and the 23-minute video above) I set it up on a $5 Contabo VPS: free models instead of OpenAI, the required sandbox service deployed step by step, SearXNG web search self-hosted, and a working AI agent running 24/7.

The full command list is below — everything I typed on camera, ready to copy.

What the AI Assistant Actually Does

The assistant lives inside the n8n editor and works from a chat panel. It builds complete workflows from a prompt, explains what any node does, fixes broken nodes, and — new in 2.37 — shows session traces, so you can see every step it took. It's officially in Preview, so review what it generates before production use.

One catch most tutorials skip: on a self-hosted instance, the assistant needs a sandbox service — an isolated environment where it safely runs the code it writes. No sandbox, no assistant. I'll deploy it below.

Why Self-Host It on a VPS

Three reasons: your agents run 24/7 even with your laptop off, your data stays on hardware you control, and it costs about $5 a month. The assistant builds it — the VPS runs it.

Step 1 — Get a VPS

I use Contabo — the VPS 6 tier easily clears n8n's official requirement of 4 GB RAM and 2 vCPUs. Pick Ubuntu 22.04/24.04, your nearest region, and you're set in minutes. (Already running n8n from a one-click install? That works too — I cover the manual sandbox path below, which is exactly what you'll need.)

Step 2 — SSH In and Install Docker

ssh root@YOUR_VPS_IP
curl -fsSL https://get.docker.com | sh

Step 3 — Install n8n

Path A — fresh install (easiest): the official one-line setup installs n8n plus the AI Assistant's sandbox and SearXNG search automatically:

curl -fsSL https://get.n8n.io | sh

Wait for ✓ Started n8n ... and sandbox services, then open http://YOUR_VPS_IP:5678. Skip to Step 6.

Path B — n8n already running (e.g. Contabo one-click): you don't have the sandbox, so deploy it manually. First, find your n8n's Docker network — you'll need its name in the files below:

docker network ls
docker inspect <network-name>

(If the sandbox runs on a different server than n8n, attach the api container manually: docker network connect --alias sandbox-api <n8n-network> n8n-sandbox-service-api-1)

Step 4 — Deploy the n8n Sandbox Service (Path B)

mkdir -p /opt/n8n-sandbox-service && cd /opt/n8n-sandbox-service

Create compose.yaml (the runner uses privileged: true instead of sysbox):

services:
  tls-init:
    image: n8nio/n8n-sandbox-service-api:latest
    user: "0:0"
    entrypoint: ["sh", "-c"]
    command:
      - >-
        bootstrap-mtls.sh
        --out-dir /tls
        --api-san n8n-sandbox-api-local
        --control-san-prefix n8n-sandbox-runner-local
        && chown -R sandbox-api:sandbox-api /tls/api
    environment:
      NUM_RUNNERS: ${NUM_RUNNERS:-1}
    volumes:
      - ./.tls:/tls
    networks:
      - sandbox-service

  api:
    image: n8nio/n8n-sandbox-service-api:latest
    restart: unless-stopped
    depends_on:
      tls-init:
        condition: service_completed_successfully
    volumes:
      - ./.tls/api:/tls:ro
      - api-data:/var/lib/n8n-sandbox-api
    env_file: .env
    environment:
      SANDBOX_API_GRPC_TLS_CERT_FILE: /tls/grpc-server.crt
      SANDBOX_API_GRPC_TLS_KEY_FILE: /tls/grpc-server.key
      SANDBOX_API_GRPC_TLS_CLIENT_CA_FILE: /tls/ca.crt
      SANDBOX_API_RUNNER_CONTROL_GRPC_TLS_CA_FILE: /tls/ca.crt
      SANDBOX_API_RUNNER_CONTROL_GRPC_TLS_CERT_FILE: /tls/control-grpc-api-client.crt
      SANDBOX_API_RUNNER_CONTROL_GRPC_TLS_KEY_FILE: /tls/control-grpc-api-client.key
      SANDBOX_API_RUNNER_CONTROL_GRPC_TLS_SERVER_NAME: n8n-sandbox-runner-local-1
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://localhost:8080/healthz"]
      interval: 5s
      timeout: 3s
      retries: 30
      start_period: 5s
    networks:
      sandbox-service:
        aliases:
          - n8n-sandbox-api
      <n8n-network>:
        aliases:
          - sandbox-api

  runner:
    image: n8nio/n8n-sandbox-service-runner-dind:latest
    privileged: true
    restart: unless-stopped
    depends_on:
      tls-init:
        condition: service_completed_successfully
      api:
        condition: service_healthy
    volumes:
      - ./.tls/runner:/tls:ro
    env_file: .env
    environment:
      SANDBOX_RUNNER_DOCKER_SANDBOX_IMAGE: n8nio/n8n-sandbox-service-sandbox:latest
      SANDBOX_RUNNER_API_GRPC_ADDR: n8n-sandbox-api:9090
      SANDBOX_RUNNER_HTTP_BASE_URL: http://n8n-sandbox-runner-1:8080
      SANDBOX_RUNNER_CONTROL_GRPC_LISTEN_ADDR: ":9091"
      SANDBOX_RUNNER_CONTROL_GRPC_ADVERTISE_ADDR: n8n-sandbox-runner-1:9091
      SANDBOX_RUNNER_REGISTRATION_GRPC_CA_FILE: /tls/ca.crt
      SANDBOX_RUNNER_REGISTRATION_GRPC_CERT_FILE: /tls/grpc-client.crt
      SANDBOX_RUNNER_REGISTRATION_GRPC_KEY_FILE: /tls/grpc-client.key
      SANDBOX_RUNNER_REGISTRATION_GRPC_SERVER_NAME: n8n-sandbox-api-local
      SANDBOX_RUNNER_CONTROL_GRPC_TLS_CERT_FILE: /tls/control-grpc-server.crt
      SANDBOX_RUNNER_CONTROL_GRPC_TLS_KEY_FILE: /tls/control-grpc-server.key
      SANDBOX_RUNNER_CONTROL_GRPC_TLS_CLIENT_CA_FILE: /tls/ca.crt
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://localhost:8080/readyz"]
      interval: 5s
      timeout: 5s
      retries: 24
      start_period: 20s
    networks:
      sandbox-service:
        aliases:
          - n8n-sandbox-runner-1

networks:
  sandbox-service:
    driver: bridge
  <n8n-network>:
    external: true

volumes:
  api-data:

Replace <n8n-network> with your real network name from Step 3 — it appears twice in the file.

Generate the secret tokens (important: $(openssl rand -hex 32) will NOT expand inside a single-quoted heredoc — generate them first, then paste the values):

openssl rand -hex 32
# run this 4 times and save the outputs

Create .env with your generated values:

cat > .env <<'EOF'
SANDBOX_API_KEYS=<generated-hex-1>
SANDBOX_API_RUNNER_REGISTRATION_TOKEN=<generated-hex-2>
SANDBOX_API_RUNNER_API_KEY=<generated-hex-3>
SANDBOX_RUNNER_API_KEYS=<generated-hex-4>
SANDBOX_RUNNER_REGISTRATION_TOKEN=<generated-hex-5>
NUM_RUNNERS=1
EOF

SANDBOX_API_KEYS is the one that must match what you'll set on n8n in Step 6 — remember it. Start and verify:

docker compose up -d
docker compose ps
docker exec <n8n-container> sh -c 'wget -qO- http://sandbox-api:8080/healthz'
# expect {"status":"ok"}

Step 5 — SearXNG: Self-Hosted Web Search

This gives the assistant the ability to look things up on the web, self-hosted:

mkdir -p /opt/searxng/config
cd /opt/searxng

Create the settings file (generate your own secret with openssl rand -hex 32):

cat > /opt/searxng/config/settings.yml <<'EOF'
use_default_settings: true
general:
  enable_brand: false
server:
  secret_key: <YOUR-GENERATED-64-HEX-SECRET>
  limiter: false
  bot_detection:
    enabled: false
search:
  formats:
    - html
    - json
EOF
touch /opt/searxng/config/limiter.toml

Create the compose file (n8n_default is the typical network name for one-click n8n installs — verify yours with docker network ls):

cat > /opt/searxng/docker-compose.yml <<'EOF'
services:
  searxng:
    image: searxng/searxng:latest
    container_name: searxng
    restart: unless-stopped
    networks:
      - n8n_default
    environment:
      - SEARXNG_BASE_URL=http://searxng:8080
      - SEARXNG_SECRET_KEY=<SAME-SECRET-AS-ABOVE>
    volumes:
      - ./config/settings.yml:/etc/searxng/settings.yml:ro
      - ./config/limiter.toml:/etc/searxng/limiter.toml:ro
      - searxng_cache:/var/cache/searxng
    stop_grace_period: 30s

volumes:
  searxng_cache:

networks:
  n8n_default:
    external: true
EOF

Start and verify:

docker compose up -d
docker ps --filter name=searxng
docker exec <n8n-container> sh -c 'wget -qO- http://searxng:8080/healthz'
# expect: OK

Step 6 — Turn On the AI Assistant

The official way: open the editor → instance AI settings → add your model key. Or wire everything through ./n8n/.env:

N8N_INSTANCE_AI_MODEL_API_KEY=<your-provider-key>
# supported providers: anthropic, openai, openrouter
# default model: anthropic/claude-opus-4-8

# Sandbox — REQUIRED (must match SANDBOX_API_KEYS from Step 4):
N8N_INSTANCE_AI_SANDBOX_ENABLED=true
N8N_INSTANCE_AI_SANDBOX_PROVIDER=n8n-sandbox
N8N_SANDBOX_SERVICE_URL=http://n8n-sandbox-api:8080
N8N_SANDBOX_SERVICE_API_KEY=<same value as SANDBOX_API_KEYS>

# Web search via your self-hosted SearXNG:
N8N_INSTANCE_AI_SEARXNG_URL=http://searxng:8080

Restart n8n, open a workflow, and the assistant panel is live. Walk through its three modes: build (workflow from a prompt), explain (what a node does), and fix (repairs broken nodes, with the new session trace timeline showing every step it took).

Step 7 — Run the Assistant on FREE Models

This is the part that kills the API bill. n8n officially supports custom OpenAI-compatible endpoints for the assistant, so point it at OmniRoute (see my OmniRoute setup guide):

N8N_INSTANCE_AI_MODEL_URL=http://YOUR_VPS_IP:20128/v1
N8N_INSTANCE_AI_MODEL_API_KEY=<your-omniroute-api-key>

Restart n8n once more. Your assistant now reasons over free models (DeepSeek, GLM-5.3) via AgentRouter — check OmniRoute's /v1/models for the exact model IDs. The workflows it builds can use the same endpoint via an OpenAI credential with your OmniRoute base URL.

Step 8 — Test It Live

Type a real prompt: a Telegram bot that summarizes articles, an email auto-responder — whatever you actually need. The assistant generates the nodes, you review them, tweak one thing manually (it gets you 90% there — the manual touch builds trust in what it made), then save and activate. Your AI agent now runs 24/7 on a server that costs less than lunch.

One Warning About Small Models

Free models are brilliant for the assistant and most agent work, but they're smaller models — for heavy reasoning tasks, keep one paid or premium model in your OmniRoute combo as a fallback. The combo feature routes automatically when one model can't cope.

The Full Cost

  • Contabo VPS: ~$5–7/month
  • n8n + sandbox + SearXNG: free, self-hosted
  • Models via AgentRouter free tier: $0

Total: about $5/month for an AI that builds and runs your automations around the clock. That's the DIY way — your server, your data, your agents.

More Guides

Related Posts

Self-Host n8n and OmniRoute on a $5 VPS: The Complete 2026 Guide
Automation

Self-Host n8n and OmniRoute on a $5 VPS: The Complete 2026 Guide

Self-Hosted Coding Agents Are Going Mainstream in 2026 — Here's the Stack That Works
Automation

Self-Hosted Coding Agents Are Going Mainstream in 2026 — Here's the Stack That Works

From a $500 Project to $3k/Month Retainer: The n8n Freelancer Playbook
Automation

From a $500 Project to $3k/Month Retainer: The n8n Freelancer Playbook

← Back to Knowledge Hub