n8n vs Sim (2026)

Stands at F on an enumerated catalogue of several hundred individually documented app nodes, which makes this checkable rather than a headline count. Breadth across classes is comprehensive: CRM, marketing, ITSM, HR, databases and warehouses, cloud infrastructure, storage, messaging, security tooling, payments and finance all have named nodes, with several nodes carrying separate documentation per operation family. Three properties raise the ceiling above the catalogue. Tool Mode converts an ordinary app node into an agent-callable tool, so integration breadth becomes agent capability directly. The MCP Client node lets an agent consume any external MCP server, which is the client direction credited here rather than on Ext. And HTTP Request, GraphQL, SSH and custom nodes cover anything uncatalogued. Recorded per section 7: nodes such as Airtop and PhantomBuster reach third-party browser and scraping services, which counts as integration breadth here and is not credited as n8n's own computer use, graded on Comp.

Stands at F. Multi-step control flow is complete and documented page by page: conditionals through If and Switch, merging, looping, waiting, error handling, and an explicit page on how execution order is decided in multi-branch workflows, which is the kind of detail that only exists once a product has been used at scale. Multi-agent works through sub-workflows: a workflow can call another workflow, sub-workflows can be exposed to an agent as tools, and nodes can be extracted into a sub-workflow with their attached AI sub-nodes carried across automatically. That last behaviour is a good sign the composition model is real rather than bolted on. The root-node and sub-node architecture is itself the orchestration primitive, with language models, tools, memory and output parsers attaching to an agent as typed connections rather than being configured inside it.

Stands at F and is the best-evidenced Trig cell reviewed in this lane. All three classes are covered by named, individually documented trigger nodes rather than inferred from a product description. Schedules go beyond a cron field: a durable scheduler runs time-based workflows from a database-backed queue, which means scheduled runs survive restarts, a reliability property almost nothing else here documents. The event surface is unusually broad, including IMAP email, RSS, local filesystem changes, server-sent events and n8n's own lifecycle events. Channels span chat, embedded forms, and agents published so people reach them through chat, channels and schedules. The MCP Server Trigger is a fourth class worth naming, since it lets an external AI assistant invoke a workflow as a tool; that is credited on Ext as extensibility and noted here only as a route in.

Stands at F. Retrieval is documented as a first-class concept area with its own conceptual pages rather than only as a node list, covering vector stores, embeddings, retrievers and document loaders, plus a dedicated page on retrieval-augmented generation as a technique. Because vector stores attach as sub-nodes from a provider catalogue, the index can live in whichever database the customer already runs, which pairs with self-hosting to keep the entire knowledge layer inside their boundary. Data tables add structured tabular storage scoped to a project for the non-vector case, and a worked example documents scraping a site into Pinecone and querying it from a chat workflow end to end. Relevant to the open Knowledge convention: this sits on the maintained-structure side but exposes the construction, the same shape as langflow, where the customer builds and owns the index rather than receiving a managed one.

Stands at F, strengthened, and it is now among the best-evidenced Know cells in the lane because the retrieval stack is native rather than an integration. THE MECHANISM IS DOCUMENTED, WHICH ALMOST NOTHING ELSE THIS SESSION MANAGED. Sim's Knowledge Base is described as a native feature using ADVANCED AI EMBEDDINGS AND VECTOR SEARCH TECHNOLOGY, with VECTOR EMBEDDINGS, AUTOMATIC CONVERSION OF TEXT INTO HIGH-DIMENSIONAL VECTORS FOR INTELLIGENT SIMILARITY MATCHING, and semantic search that understands meaning and context rather than matching keywords. THE CONTRAST WITH THE OTHER FULL CELLS TODAY IS WORTH RECORDING. joget and autogpt both reached Full on a Pinecone connector, where the vector store is a customer-supplied dependency and chunking, embedding and refresh are the customer's problem. Here the store is the platform's own and the surrounding controls are documented as their own pages: CONNECTORS, TAGS AND FILTERING, DEBUGGING RETRIEVAL and CHUNKING STRATEGIES. A vendor publishing a chunking strategies page and a retrieval debugging page has built a retrieval product, not a database binding. DEBUGGING RETRIEVAL IS THE PAGE THAT STANDS OUT and it is rare across the index. Most grounding failures are silent: the agent answers confidently from the wrong passage and nobody knows. A documented surface for inspecting what was retrieved and why is the difference between a knowledge base a team can operate and one they have to trust. MULTIPLE KNOWLEDGE BASES PER WORKSPACE are supported for different purposes or departments, and tag-based filtering scopes retrieval within one, so a single corpus can serve several agents with different views of it. The vendor's own framing on the product page is that data stored semantically in Sim is THE MEMORY YOUR AGENTS REASON OVER; that is grounding and is graded here, with agent state graded separately on Mem, and the record keeps the two distinct.

Stands at P, and unusually the vendor settles it in its own words: the Tools Agent documentation states plainly that MEMORY DOESN'T PERSIST BETWEEN SESSIONS. That is a first-party statement of the exact limit this axis measures, and it is the anchor for the grade. What keeps it at P rather than N is real: memory attaches as a typed sub-node, session identity is a genuine construct with session IDs resolved from input or a custom key and scoped per node to prevent cross-talk between memory nodes in one workflow, and external chat-memory backends can be attached so history outlives a single run. But persistence is then something the BUILDER assembles by choosing and wiring a store, not something the agent has, and the default Simple Memory is a window buffer. Same shape as dify and make. Confidence is high because both the capability and its limit are documented explicitly rather than inferred.

Stands at F, and the July self-flag is resolved. That basis noted THE MEMORY PAGE ITSELF WAS NOT OPENED IN THIS PASS SO CROSS SESSION SEMANTICS ARE GRADED FROM THE SURROUNDING DOCUMENTATION. The Agent block documentation settles it in one sentence. THE DECIDING LINE: MEMORY REQUIRES A CONVERSATION ID TO PERSIST ACROSS RUNS. Persisting across runs is the ruled Full condition, stated by the vendor, with the mechanism named. That is the exact question the July pass left open. FOUR MEMORY MODES ARE DOCUMENTED AS AGENT CONFIGURATION rather than as an integration a customer wires: NONE where each request is independent, CONVERSATION holding full history keyed by a conversation ID, SLIDING WINDOW BY MESSAGES keeping the N most recent, and SLIDING WINDOW BY TOKENS keeping messages up to a token limit. Offering the retention policy as a first-class setting is unusual in this lane, where memory is normally on or absent; here a builder chooses how much history persists and pays for it in context accordingly. THE ACCUMULATION LIMB IS SERVED BY MEM0, documented as enabling agents to MAINTAIN PERSISTENT MEMORY ACROSS WORKFLOW EXECUTIONS, RECALL PAST CONVERSATIONS, REMEMBER USER PREFERENCES, AND BUILD UPON PREVIOUS INTERACTIONS, with add, semantic search and retrieve operations. Zep ships alongside as a second external memory option. SO BOTH LIMBS ARE PRESENT BY DIFFERENT ROUTES: native session-keyed persistence configurable per agent, and accumulating long-term memory through integrations. Tables hold durable structured rows workflows read and write, and Variables carry in-run state, so the platform distinguishes three kinds of state cleanly rather than conflating them. WORTH RECORDING FOR CONSISTENCY: this is the third record today crediting Mem0, after autogpt and joget. In each case it is credited as a documented first-class primitive the customer wires, which the 31 August ruling permits explicitly.

Stands at F on three separable mechanisms, which is more than most vendors in this lane manage. Runtime approval is per tool: a documented pattern requires human approval before an AI Agent executes SPECIFIC tools, so the gate is placed on the dangerous action rather than the whole run, matching the granularity langflow and stackai offer. A dedicated Guardrails node handles automated policy checks separately from human approval, so the two oversight modes are distinct rather than conflated. And a human fallback pattern routes to a person when the AI cannot help, which is escalation rather than approval and is a third distinct control. Change-time oversight is separate again: workflow reviews let a version be submitted before publishing, compared with a visual diff, discussed in comments, and approved or sent back. Wait and Stop And Error nodes provide the primitives underneath.

Stands at F on an exceptionally deep control surface. Fifteen documented security topics is more than any other vendor reviewed in this lane, and several are controls most platforms never expose: encryption key rotation, JWE-encrypted OAuth token decryption so the identity provider encrypts tokens only the instance can read, blocking specific nodes instance-wide, hardening task runner isolation, and redacting execution data to keep sensitive values out of run history. A self-service security audit the customer runs against their own instance is rarer still. VERIFICATION FLAG, applied per the standing convention rather than a downgrade: no certification or attestation was retrieved this pass, and none appears in the documentation index, which is expected for a self-hosted product where the customer owns the perimeter but leaves the managed Cloud offering's posture unverified. The convention is explicit that a deep documented control surface without a retrievable attestation is not downgraded on sight; a fetch of n8n's trust or security marketing page would close it.

Stands at P. The July basis carried an explicit instruction, RECHECK BEFORE ANY UPGRADE, and this pass performed that recheck and found nothing new. Recording the negative result so the next reviewer does not repeat it. WHAT WAS SEARCHED: sim.ai, docs.sim.ai and the enterprise documentation, anchored on trust centre, SOC 2 and compliance terms. No trust centre, no report request path, no named audit firm, no observation period and no compliance page was found. The SOC 2 and HIPAA claims remain confined to the ai4.sim.ai marketing microsite with type unspecified. The July grade and reasoning stand unchanged. THE CONTROL HALF IS THE STRONGEST OF ANY PARTIAL IN THIS LANE, which is what makes the cell frustrating rather than weak. SAML 2.0 and OIDC single sign-on across Okta, Entra ID, Google Workspace and ADFS. Workspace roles and permission groups enforced at execution time rather than only in the interface. Secrets management. Organisation-wide audit logs. Configurable data retention. Session policies and verified domains. And data drains continuously exporting logs to a customer-owned S3 bucket. THAT LAST ONE IS A GENUINE DIFFERENTIATOR and worth carrying: a customer's security team can pipe activity into their own SIEM rather than reading the vendor's dashboard, which is the form of auditability that survives a vendor outage or a contract ending. WHY IT STILL SITS AT PARTIAL. The bar is a conjunction: an attestation or certification alongside a named control. The controls half is met several times over; the attestation half is asserted on a marketing microsite and nowhere else. Under the hedge ladder that is the asserted-with-no-report rung, the same position as agentx today, and one rung below aigensei's SOC 2-aligned only in that a type is claimed rather than alignment. ONE STRUCTURAL POINT IN THE VENDOR'S FAVOUR, recorded but not credited: the platform is open source under Apache 2.0 and self-hostable, so a customer can inspect the code and run it inside their own controls. That is a different kind of assurance from an attestation and it is graded on Dep and Ext, not here.

Stands at F and clears the reporting-is-not-auditing line decisively. Every workflow run is an execution object the customer can open, filter across all workflows, and inspect node by node, so the why of a run is reconstructable rather than merely counted. OpenTelemetry tracing of workflow AND node executions to the customer's own collector is the strongest single item, because the trace leaves n8n in a vendor-neutral format the customer controls, and it sits alongside Prometheus metrics, a Grafana visualisation guide, configurable logging and an insights metrics layer. Two governance-adjacent details worth carrying: custom data can be attached to executions and then used to filter them, which makes run history queryable on business keys rather than only timestamps, and execution data can be redacted for compliance. LangSmith connection is documented separately for LLM-level tracing.

Stands at F and is among the strongest Dep cells in the index. Self-hosting under a fair-code licence means residency is answered by construction rather than negotiated: the customer picks the host, the database and the region, so there is no vendor-side data location at all. Two details lift it above ordinary self-hosting. An ISOLATE N8N configuration is documented specifically to prevent the instance from connecting to n8n's own servers, which is the air-gap story stated as a supported configuration rather than inferred. And the deployment surface is unusually wide for a single product: one-line setup, Docker, Docker Compose, npm, seven named cloud providers including Kubernetes and OpenShift, plus queue mode, external binary and execution data storage, and a documented OEM path. Managed n8n Cloud sits alongside for customers who want none of that.

Stands at F, and it is worth noting that under the wider Pack bar this is a clean case rather than a marginal one: the customer receives assets ready to adopt by several routes at once. A template library is documented as a way of building workflows in its own right, sitting alongside the AI Assistant and the AI Workflow Builder as one of the named ways to start. Self-hosted instances can point at a CUSTOM template library, which is unusual and lets an organisation ship its own internal starter set to its own users. The AI Starter Kit is a curated bundle of AI elements for standing up AI workflows quickly, which is the bundled-toolkit shape the 31 August ruling explicitly names as qualifying. And .n8np packages make a finished set of workflows plus its dependencies portable between instances, so packaged assets can be distributed rather than only downloaded from a catalogue.

P>F, and like Ext this was clearly understated rather than borderline. Model choice is structural in n8n rather than a setting: the AI Agent node cannot run without a Chat Model sub-node attached, and the docs describe clicking the Chat Model connector to open a selection of possible models to pick from. Because models are sub-nodes, a workflow can attach different models to different agents or chains, so per-step routing is the default rather than a premium feature. The provider roster documented as first-class app nodes is unusually wide and includes several outside the usual set: OpenAI, Anthropic, Google Gemini, Mistral, Perplexity, Qwen Cloud, MiniMax and Moonshot Kimi, alongside local models. Self-hosting plus local models means the whole stack, inference included, can run inside the customer's own boundary, which pairs with the Dep grade and is the strongest form of this axis.

Stands at F and the provider list is broader than the July basis recorded, now taken from the Agent block reference rather than summarised. THIRTEEN PROVIDERS ARE NAMED IN THE BLOCK DOCUMENTATION: OpenAI, Anthropic, Google Gemini, xAI Grok, DeepSeek, Groq, Cerebras, AZURE OPENAI, AZURE ANTHROPIC, GOOGLE VERTEX AI, AWS BEDROCK, OpenRouter, and local models through Ollama or VLLM. Selection is per Agent block from a model combobox where the builder can type or select any supported model. THE THREE HYPERSCALER ROUTES ARE THE ENTRIES THAT MATTER MOST and were not in the July list. Azure OpenAI, Azure Anthropic, Vertex AI and Bedrock let a customer consume frontier models through a cloud contract they already hold, under their existing data processing terms and commit spend. For a regulated buyer that is frequently the only permitted route to a given model, and a platform that omits it forces a procurement conversation that has already been had. THE ECONOMICS ARE DOCUMENTED AND UNUSUALLY CLEAN: bring your own key bills at base provider pricing WITH NO MARKUP, while hosted keys carry a 1.1x multiplier, and local models through Ollama or VLLM incur no API cost at all. Publishing the exact spread between routes lets a customer decide on cost rather than guess, and no-markup BYOK means the platform takes nothing on inference. THE GOVERNANCE LAYER IS THE PART FEW COMPETITORS HAVE: enterprise permission groups restrict WHICH PROVIDERS ARE ALLOWED, enforced at execution time and not only in the interface. So an organisation can permit Bedrock and forbid direct OpenAI across every agent its teams build, which is model choice bounded by policy rather than left to each builder. Combined with the fully offline self-hosted path credited on Dep, a customer can run the platform and its models entirely inside their own infrastructure.

P>F, and the April P was clearly wrong rather than marginal. n8n clears Mike's 30 August Ext bar by every available route at once. The MCP Server Trigger node makes the platform itself an MCP server, exposing n8n tools and workflows to any MCP client, which is the server direction that section 7 says credits Ext; the MCP Client node is the opposite direction and is graded on Int rather than double-counted. Beyond MCP there is a public REST API concrete enough that the docs include a page on DISABLING it, community and custom nodes written in TypeScript, npm packages usable inside the Code node, and .n8np packages that bundle workflows and their dependencies into a portable file with its own manifest, API key scopes and import resolution. The OEM path goes further than almost anything in this lane: n8n documents embedding its interface inside another product with OAuth 2.0 token exchange, iframe SSO and delegated API access, which is extensibility as a business model rather than a feature.

Stands at F and is one of the two or three strongest Eval cells in the index. This is a shipped evaluation product, not a debugging surface: dedicated Evaluation and Evaluation Trigger nodes, a four-page documentation section on testing and improving AI workflows, and explicitly metric-based evaluation that scores production workflow quality over time rather than only comparing a run to expectations once. The two-tier design is the distinguishing part and is rare: light evaluations during development for fast iteration, and metric-based evaluation in production for measuring quality trends. That is the shape lyzr and stackai earn F for, reached from the opposite direction, and it sits well above the debugging-only surfaces that took langflow, mindstudio and make to P on this axis. Alongside it the ordinary debugging affordances are complete: pin and mock data, debug executions by copying prior execution data into the canvas, partial executions, and dirty-node tracking.

Stands at F, and the July self-flag is resolved. That basis recorded honestly that THE EVALUATOR PAGE ITSELF WAS NOT OPENED IN THIS PASS SO DEPTH IS GRADED FROM ITS FIRST CLASS PLACEMENT IN THE BLOCK SET. The page is now open and the depth holds up. WHAT THE BLOCK ACTUALLY DOES: it USES AI TO SCORE AND ASSESS CONTENT QUALITY AGAINST CUSTOM METRICS, where the customer defines each metric with a name, a description and a numeric range, the documented examples being accuracy, clarity and relevance on one-to-five scales. THE SCHEMA ENFORCEMENT IS THE DETAIL THAT MAKES IT AN INSTRUMENT RATHER THAN A PROMPT. The Evaluator GENERATES A JSON SCHEMA RESPONSE FORMAT BASED ON YOUR METRICS AND ENFORCES STRICT MODE, SO THE LLM IS CONSTRAINED TO RETURN ONLY THE EXPECTED METRIC SCORES AS NUMBERS, NO EXTRA TEXT OR EXPLANATIONS. Numbers rather than prose is what makes a score comparable at all, and it is the difference between this and the model-as-judge pattern held at Partial on snaplogic. THE COMPARISON LIMB IS DOCUMENTED EXPLICITLY: the block is described as suited to QUALITY CONTROL, A/B TESTING, and one of its named use cases is A/B TESTING CONTENT, COMPARE MULTIPLE AI-GENERATED RESPONSES. The guidance also states CONNECT WITH AGENT BLOCKS: USE EVALUATOR BLOCKS TO ASSESS AGENT BLOCK OUTPUTS AND CREATE FEEDBACK LOOPS, so the subject being scored is the agent's own behaviour on the customer's own work, which is exactly what the ruled bar asks. A WORKED PATTERN IS PUBLISHED: Agent generates, Evaluator scores, Condition checks a threshold, then publish or revise. That is a quality gate with a readable numeric result driving control flow. THE HONEST LIMIT, and it is why this is not the strongest Eval cell in the index: comparison is between candidate outputs within a run, not across agent versions over time. No retained test set, stored expected outputs or regression run history is documented, which is what agentx has and this does not. Debugging is separately strong through block-by-block run traces, knowledge base retrieval debugging and per-run cost.

Stands at N. No first-party browser or computer-use node exists in the core catalogue; n8n acts on the world through app nodes, HTTP, GraphQL, SSH and MCP, all programmatic interfaces. TWO NEAR-MISSES CHECKED AND REFUSED, both instructive. Airtop is a browser-automation service with an n8n app node, and PhantomBuster is a scraping service with another; under section 7 those are the third parties' capabilities reached through an integration, the same reasoning that refused Apify for langflow. And the SSH and Execute Command nodes run commands on remote machines, which is command execution rather than operating a rendered interface, the distinction that took thirteen June-cohort Coding agent records from F to N. Confidence is medium rather than high because the app catalogue runs to several hundred nodes and was not enumerated exhaustively; a first-party browser node could be added, and the community node ecosystem certainly contains browser wrappers, though neither would change the grade under the current rules.

P>F, and this is a consistency correction rather than new evidence. The July basis found the capability and then withheld Full on a bar that does not exist. ITS REASONING, VERBATIM: the browser engine is AN INTEGRATED THIRD PARTY RATHER THAN SIM'S OWN, SO THE CAPABILITY IS DELIVERED BUT NOT FIRST PARTY. That test appears nowhere in the axis definition, which asks whether an agent operates software the vendor does not control because no programmatic interface exists. It asks what the customer can do, not who wrote the driver. THE INDEX DOES NOT APPLY THAT BAR ANYWHERE ELSE, which is what makes it an invented one. Model cells credit vendors for OpenAI and Anthropic models they did not build. Know cells credited joget and autogpt for Pinecone integration. Mem cells credit Mem0 across three records including this one. Penalising a third-party engine only on Comp would single out one axis for a rule the other thirteen do not carry. THE DECIDING PRECEDENT IS FROM EARLIER TODAY AND IS THE SAME ENGINE. autogpt moved N>F on a Stagehand Blocks section in its documentation, Stagehand being Browserbase's framework built on act, extract and observe. Sim ships FIRST CLASS BROWSER USE AND STAGEHAND INTEGRATIONS in its tools catalogue, with Apify and Bright Data alongside. Same engine, same integration shape, same product category, reviewed the same day. Grading them differently would have been indefensible. WHAT THE CUSTOMER ACTUALLY RECEIVES is the test that matters: a workflow block that drives a real browser against an interface with no API, composable beside the other thousand integrations. Browser Use and Stagehand both perform navigation and action rather than retrieval alone, which is the line held against scraping on ai-library, pickaxe and joget this session. Recorded for the lane: fifth genuine Comp positive in Agent builder, after sema4-ai, kalcend, integrail and autogpt, and the second resting on Stagehand.