n8n MCP Community

io.github.drzamarianPublished by GitHub account drzamarianv0.3.1Updated Oct 24, 2026

A security-focused MCP server for self-hosted n8n Community Edition.

VerifiedSTDIODesktop onlyProductivity & WorkflowDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Security-focused MCP server that lets an AI assistant manage workflows, executions, credentials, tags, users and diagnostics on a self-hosted n8n Community…

What you can do
  • List, read, create, update, diff, archive, activate and delete workflows, and edit single nodes
  • List and inspect executions, and retry, stop or delete them
  • Create, read, update, test and delete credentials, and find where a credential is used
  • Manage tags and users, including inviting members or admins
  • Run health checks, insights summaries, security audits, workflow search, node-type inventory and offline node docs
When to use it
Useful when you run a self-hosted n8n Community Edition instance and want an assistant to inspect, build or debug workflows and manage instance objects through the Public API, with read-only access by default.
Requirements
Runs locally over stdio via npm (Node.js 22 or 24) or as a Claude Desktop MCPB extension. Needs the n8n base URL in N8N_API_URL and a dedicated n8n Public API key in N8N_API_KEY; N8N_MCP_MODE selects read-only, write or unsafe. Network access to the n8n host is required.
Before you install
The API key grants upstream permissions, so use a least-privilege key. Write and unsafe modes allow creating, changing, activating, retrying and permanently deleting workflows, executions, credentials, tags and users; unsafe mode is the only server-side gate for destructive tools. Plain HTTP to a non-loopback host requires N8N_ALLOW_INSECURE_HTTP=1 and exposes the key and data in transit. Credential tests may contact external services.

Installation

In SourceWeft

  1. Open n8n MCP Community in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

n8n MCP Community

[n8n-mcp-community MCP server]

A security-focused Model Context Protocol server for self-hosted n8n Community Edition

Give your AI client 44 tools for self-hosted n8n Community Edition. Manage workflows, nodes, runs, credentials, tags, users, and diagnostics. No paid n8n features. The server makes no external AI calls.

[Install with npm] [Download MCPB] [Read the docs]

Install

You need Node.js 22 or 24, your n8n URL, and an n8n API key.

Install

bash
npm install --global n8n-mcp-community@latest

--global installs the command once. Use npx below if you do not want a global install.

Connect

json
{  "mcpServers": {    "n8n-community": {      "command": "n8n-mcp-community",      "env": {        "N8N_API_URL": "https://n8n.example.com",        "N8N_API_KEY": "replace-with-a-dedicated-api-key",        "N8N_MCP_MODE": "read-only"      }    }  }}

Restart your client. You should see 44 tools, 5 resources, and 4 prompts.

If the client cannot find the command, run command -v n8n-mcp-community on macOS/Linux or where n8n-mcp-community on Windows. Put that full path in "command".

Want no global install? Copy this command into the client configuration shown in the full guide:

bash
npx --yes n8n-mcp-community@latest

Want the Claude Desktop app flow? Use the MCPB below. See the full installation guide for updates, rollback, and checks.

Claude Desktop: install the MCPB (no Node.js needed)

  1. Open the latest GitHub release.
  2. Download the file that ends in .mcpb.
  3. In Claude Desktop, open Settings → Extensions → Advanced settings → Install Extension….
  4. Pick the file. Enter your n8n URL, API key, and mode.

Anthropic's MCPB guide explains the same steps. Our installation guide explains how to check the download.

Install public builds only from npm or the latest GitHub release.

[Animated demo showing installation, connection, and a useful local Introspect finding]

Read the demo transcript.

Why this project

  • Community Edition first. The release surface is designed for self-hosted n8n Community Edition, without presenting paid-only capabilities as available.
  • 44 useful tools, one explicit contract. Every tool has bounded inputs, documented side effects, MCP safety annotations, and contract tests.
  • Safe by default. Read-only mode is the default. You choose when to allow writes or the full tool set.
  • Deterministic Introspect. n8n_introspect runs a local 23-rule engine; it does not execute workflows, call an agent, or contact an external model.
  • Surgical node updates. n8n_update_node changes one validated node path while preserving the rest of the workflow and disclosing the Public API's non-atomic limitation.
  • Truthful discovery. n8n_list_node_types reports only types observed in accessible workflows. It does not claim to be a complete installed catalog.
  • Data minimization. Credential values, raw execution values, pin data, and static workflow data are not returned by the generic public tools.
See verification evidence

Current verification

The current source candidate has been verified with:

  • exactly 44 tools, 5 resources, and 4 prompts over real stdio;
  • 320 passing tests locally on Node.js 24.21.0; CI and release gates require the pinned Node.js 22.23.1 and 24.18.0 matrix;
  • zero findings from Gitleaks, Semgrep, Trivy, and both project-root production/full npm audit runs; all three source scanners are reproduced in CI, with immutable scanner/action identities;
  • a separate no-override consumer install that resolves the patched @hono/node-server 2.x line, requires a zero-finding production audit, and proves the stdio runtime and exact 44/5/4 inventory;
  • a reproducible dependency-license gate covering 187 installed package paths;
  • bounded same-origin HTTP contracts and zero-request policy-denial tests;
  • all 44 compiled tool lifecycles on disposable n8n Community 2.30.5 and 2.30.7 instances with egress isolation, revoked keys, cleanup, and zero residue; and
  • a reviewed offline npm-tarball installation under the project's committed dependency policy, plus a byte-reproducible unsigned MCPB with the same compiled runtime and complete production dependency notices.

Publication proceeds only through the reviewed release procedure: the repository-pinned MCPB signing identity, a human artifact-baseline receipt, tag-scoped protected-environment approval, and an externally signed MCPB handoff verified byte for byte against the reviewed unsigned candidate.

Safety modes

ModeWhat it allowsRequired configuration
Read-onlyRead-only tools onlyDefault, or N8N_MCP_MODE=read-only
WriteRead-only and ordinary mutation toolsN8N_MCP_MODE=write
UnsafeAll tools, including destructive or external-contact operationsN8N_MCP_MODE=unsafe

Selecting unsafe mode is the complete server-side authorization gate for unsafe tools. MCP safety annotations remain accurate so compatible clients can apply their native approval UX, and the n8n API key remains the final upstream permission boundary.

Plain HTTP is accepted automatically only for loopback URLs. A non-loopback HTTP instance additionally requires N8N_ALLOW_INSECURE_HTTP=1, which accepts the risk of exposing the API key and data in transit.

Tool catalog

Every entry links to its complete input, output, endpoint, compatibility, failure, and security reference.

Workflows

ToolModePurpose
n8n_workflows_listRead-onlyList accessible workflows with bounded filters and pagination.
n8n_workflows_getRead-onlyRead one workflow while withholding pin and static data values.
n8n_workflows_createWriteCreate a validated workflow through the Public API.
n8n_workflows_updateWriteGuard and update selected fields while preserving omitted fields.
n8n_update_nodeWriteChange one validated node property with non-atomic concurrency guards.
n8n_workflows_deleteUnsafePermanently delete one workflow.
n8n_workflows_activateUnsafeActivate one workflow.
n8n_workflows_deactivateUnsafeDeactivate one workflow.
n8n_workflows_get_versionRead-onlyRetrieve one retained historical workflow version.
n8n_workflows_get_tagsRead-onlyList tags assigned to a workflow.
n8n_workflows_update_tagsWriteReplace a workflow's complete tag assignment.
n8n_workflows_archiveUnsafeArchive one workflow.
n8n_workflows_unarchiveUnsafeRestore one archived workflow.
n8n_workflows_diffRead-onlyCompare nodes and connections without returning raw values.

Executions

ToolModePurpose
n8n_executions_listRead-onlyList execution metadata with value-free data-presence summaries.
n8n_executions_getRead-onlyRead one execution's metadata without returning workflow payloads.
n8n_executions_deleteUnsafePermanently delete a saved execution.
n8n_executions_retryUnsafeRetry an eligible saved execution.
n8n_executions_stopUnsafeStop one stoppable execution and bind identity from validated input.

Credentials

ToolModePurpose
n8n_credentials_createWriteCreate a credential without returning its values.
n8n_credentials_deleteUnsafePermanently delete one credential.
n8n_credentials_schemaRead-onlyRead the public schema for a credential type.
n8n_credentials_listRead-onlyList credential metadata verified on n8n 2.30.5 and 2.30.7.
n8n_credentials_getRead-onlyRead one credential's public metadata.
n8n_credentials_updateWriteUpdate credential metadata or values without echoing secrets.
n8n_credentials_testUnsafeTest a stored credential, potentially contacting its external service.
n8n_credentials_usageRead-onlyFind exact credential-ID references in one bounded workflow page.

Tags

ToolModePurpose
n8n_tags_listRead-onlyList workflow tags.
n8n_tags_getRead-onlyRead one tag.
n8n_tags_createWriteCreate a tag with the live 1–24 character bound.
n8n_tags_updateWriteRename a tag with the live 1–24 character bound.
n8n_tags_deleteUnsafePermanently delete one tag.

Users

ToolModePurpose
n8n_users_listRead-onlyList users visible to the API key.
n8n_users_getRead-onlyRead one user by stable ID or exact email.
n8n_users_createUnsafeInvite a member or admin.
n8n_users_deleteUnsafeDelete one API-eligible user without unsupported transfer claims.

Diagnostics and instance metadata

ToolModePurpose
n8n_healthRead-onlyPerform a bounded same-origin health check.
n8n_insights_summaryRead-onlyRead the official insights summary with optional date filters.
n8n_audit_generateUnsafeGenerate n8n's instance security audit.
n8n_search_workflowsRead-onlySearch one workflow page locally by name, node type, or tag.
n8n_get_node_docsRead-onlyRead one of four immutable offline core-node references.
n8n_list_node_typesRead-onlyInventory node types observed in bounded accessible workflow pages.
n8n_introspectRead-onlyRun deterministic local workflow and execution diagnostics.
n8n_community_packages_listRead-onlyList installed community-package metadata without mutation paths.

Resources and prompts

The server also exposes five static resources:

  • n8n://usage-guide
  • n8n://node-docs/webhook
  • n8n://node-docs/code
  • n8n://node-docs/http-request
  • n8n://node-docs/if

Four prompts guide safe workflow creation, debugging, optimization, and credential management: create-workflow, debug-workflow, optimize-workflow, and manage-credentials.

Security model in one minute

  • The server uses local stdio; it does not expose an inbound HTTP listener.
  • Connected requests are same-origin and limited to the configured n8n host.
  • Redirects are rejected; request and response bodies are bounded to 2 MiB.
  • Generic output is validated, sanitized, bounded to 256 KiB, and wrapped as { "data": ..., "redacted": boolean, "untrusted": true }.
  • Raw credential values and generic execution payload values are never returned.
  • n8n_introspect uses fixed local rules and has no external-model code path.
  • Security controls reduce risk; they do not make untrusted n8n content safe to execute or authorize broader API-key permissions.

Read the complete security model and use SECURITY.md to report a vulnerability privately.

Documentation

Development

bash
npm cinpm run verify:contributornpm run sbom > sbom.cdx.json

npm run verify:contributor runs the complete keyless contributor gate, including formatting, dependency licenses/notices, strict TypeScript, all tests, the compiled runtime, and documentation inventory parity. See CONTRIBUTING.md before opening a change.

Scope and non-affiliation

This project is not affiliated with, endorsed by, or sponsored by n8n GmbH. “n8n” is used only to identify compatibility with the n8n product and Public API. The project does not redistribute the n8n-nodes-base catalog and does not use browser cookies, interactive session routes, or runtime package downloads to construct one.

The v0.3.x surface intentionally excludes arbitrary workflow execution, credential/workflow transfer, folders, data tables, beta evaluation endpoints, and execution annotations. See the roadmap for the annotation proposal retained outside the release target.

License and maintainer

The project is released under the MIT License. Third-party dependencies retain their own licenses.

Created and maintained by Dr. Walter Zamarian Jr..

Source: README.md at commit fd2185e

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

2
  1. v0.3.1LatestOct 4, 2026
  2. v0.3.0Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts