io.github.czlonkowski/n8n-mcp
A MCP for Claude Desktop / Claude Code / Windsurf / Cursor to build n8n workflows for you
Security Findings
Known vulnerabilities/risks reported
GHSA-j6r7-6fhx-77wx (Critical, CVSS 9.9): Cross-tenant access to workflow version backups in multi-tenant HTTP deployments. Authenticated users could access or delete other tenants' backup snapshots, exposing credential references and authorization headers stored in node definitions. Affects n8n-mcp <= 2.56.0; patched in 2.56.1. https://github.com/czlonkowski/n8n-mcp/security/advisories/GHSA-j6r7-6fhx-77wx
Tools
24 tools exposed by this MCP server
get_node
Get node info with progressive detail levels and multiple modes. Detail: minimal (~200 tokens), standard (~1-2K, default), full (~3-8K). Modes: info (default), docs (markdown documentation), search_properties (find properties), versions/compare/breaking/migrations (version info). Use format='docs' for readable documentation, mode='search_properties' with propertyQuery for finding specific fields.
get_template
Get template by ID. Use mode to control response size: nodes_only (minimal), structure (nodes+connections), full (complete workflow).
n8n_audit_instance
Security audit of n8n instance. Combines n8n's built-in audit API (credentials, database, nodes, instance, filesystem risks) with deep workflow scanning (hardcoded secrets via 50+ regex patterns, unauthenticated webhooks, error handling gaps, data retention risks). Returns actionable markdown report with remediation steps using n8n_manage_credentials and n8n_update_partial_workflow.
n8n_autofix_workflow
Automatically fix common workflow validation errors. Preview fixes or apply them. Fixes expression format, typeVersion, error output config, webhook paths, connection structure issues (numeric keys, invalid types, ID-to-name, duplicates, out-of-bounds indices).
n8n_create_workflow
Create workflow. Requires: name, nodes[], connections{}. Created inactive. Returns workflow with ID.
n8n_delete_workflow
Permanently delete a workflow. This action cannot be undone.
n8n_deploy_template
Deploy a workflow template from n8n.io directly to your n8n instance. Deploys first, then auto-fixes common issues (expression format, typeVersions). Returns workflow ID, required credentials, and fixes applied.
n8n_executions
Manage workflow executions: get details, list, or delete. Use action='get' with id for execution details, action='list' for listing executions, action='delete' to remove execution record.
n8n_generate_workflow
Generate an n8n workflow from a natural language description using AI. Call with just a description to get workflow proposals. Then call again with deploy_id to deploy a chosen proposal, or set skip_cache=true to generate a fresh workflow. Use confirm_deploy=true to deploy a previously generated workflow.
n8n_get_workflow
Get workflow by ID with different detail levels. n8n has a draft/publish model: the workflow body holds the draft (latest edits); use mode='active' to see the published graph that is actually running. Modes: 'full' (draft + metadata), 'details' (full + execution stats), 'active' (published graph only), 'structure' (nodes/connections topology), 'minimal' (id/name/active/tags).
n8n_health_check
Check n8n instance health and API connectivity. Use mode='diagnostic' for detailed troubleshooting with env vars and tool status.
n8n_list_workflows
List workflows (minimal metadata only). Returns id/name/active/dates/tags. Check hasMore/nextCursor for pagination.
n8n_manage_credentials
Manage n8n credentials. Actions: list, get, create, update, delete, getSchema. Use getSchema to discover required fields before creating. For list, page beyond 100 results with cursor (from the previous responses nextCursor). SECURITY: credential data values are never logged.
n8n_manage_datatable
Manage n8n data tables and rows. Actions: createTable, listTables, getTable, updateTable, deleteTable, getRows, insertRows, updateRows, upsertRows, deleteRows.
n8n_test_workflow
Test/trigger workflow execution. Auto-detects trigger type (webhook/form/chat). Supports: webhook (HTTP), form (fields), chat (message). Note: Only workflows with these trigger types can be executed externally.
n8n_update_full_workflow
Full workflow update. Requires complete nodes[] and connections{}. For incremental use n8n_update_partial_workflow.
n8n_update_partial_workflow
Update workflow incrementally with diff operations. Types: addNode, removeNode, updateNode, patchNodeField, moveNode, enable/disableNode, addConnection, removeConnection, updateSettings, updateName, add/removeTag, activate/deactivateWorkflow, transferWorkflow. patchNodeField requires fieldPath (dot path, e.g. "parameters.jsCode") and patches: [{find, replace}]. See tools_documentation("n8n_update_partial_workflow", "full") for details.
n8n_validate_workflow
Validate workflow by ID. Checks nodes, connections, expressions. Returns errors/warnings/suggestions.
n8n_workflow_versions
Manage workflow version history, rollback, and cleanup. Versions are scoped to your n8n instance. Five modes: - list: Show version history for a workflow - get: Get details of specific version - rollback: Restore workflow to previous version (creates backup first) - delete: Delete specific version or all versions for a workflow - prune: Manually trigger pruning to keep N most recent versions Old backups are also pruned automatically (10 most recent per workflow, plus an age-based retention window).
search_nodes
Search n8n nodes by keyword with optional real-world examples. Pass query as string. Example: query="webhook" or query="database". Returns max 20 results. Use includeExamples=true to get top 2 template configs per node.
search_templates
Search templates with multiple modes. Use searchMode='keyword' for text search, 'by_nodes' to find templates using specific nodes, 'by_task' for curated task-based templates, 'by_metadata' for filtering by complexity/setup time/services, 'patterns' for lightweight workflow pattern summaries mined from 2700+ templates.
tools_documentation
Get documentation for n8n MCP tools. Call without parameters for quick start guide. Use topic parameter to get documentation for specific tools. Use depth='full' for comprehensive documentation.
validate_node
Validate n8n node configuration. Use mode='full' for comprehensive validation with errors/warnings/suggestions, mode='minimal' for quick required fields check. Example: nodeType="nodes-base.slack", config={resource:"channel",operation:"create"}
validate_workflow
Full workflow validation: structure, connections, expressions, AI tools. Returns errors/warnings/fixes. Essential before deploy.