Skip to main content
Glama
FarazHayder

n8n-mcp-guard

by FarazHayder

n8n-mcp-guard

npm version License: MIT Node CI

Let an AI agent build and change your n8n workflows — with a guaranteed way back.

Agents are good at writing workflow logic and bad at knowing when they have broken something. n8n-mcp-guard sits in between. Every change is backed up before it happens, checked against the exact version it was designed for, and verified against the live instance after saving. If anything does not line up, the write is refused rather than attempted and hoped for.

Set it up once, use it from any MCP-capable agent, in every repository.

Who it's for

You're building something new. Describe the automation you want, let the agent write it, and create it as an inactive workflow you can inspect before anything runs. Iterate with a reviewable diff at every step. You never have to read raw JSON to know what changed, and you can always get back to the last version that worked.

You have something already running. The workflow that quietly emails your customers or syncs your orders is the one you least want an agent improvising on. Here, a change to it is a two-phase commit: plan it, review the diff, rehearse it on a disposable clone with every trigger and outbound call disabled, then commit — and only if nothing moved underneath you in the meantime.

Related MCP server: n8n MCP Server

Why you can trust it

  • 68 unit tests covering every path where a write is supposed to be refused, plus a live integration suite that drives the write tools through the real MCP surface against a real n8n instance: create, plan, apply, stale-plan refusal, clone neutralization, the delete guard, and verified cleanup. Run it yourself with npm run test:integration.

  • Validated against a real instance: workflow fingerprinting, diffing, clone construction and the backup gate were run across 99 real production workflows spanning 40 distinct node types, correctly neutralizing 114 triggers and 304 outbound nodes — zero failures.

  • Nothing can write until you say so. With no write token configured, the mutating tools are not merely unused, they are never registered at all.

  • CI on Node 22 and 24. MIT licensed. No telemetry, no network calls except to your own n8n instance.

Quick start

1. Install

npm install -g n8n-mcp-guard

2. Configure once, for every project

Create one file and every repository is covered:

  • Windows: %APPDATA%\n8n-mcp-guard\.env

  • macOS / Linux: ~/.config/n8n-mcp-guard/.env

N8N_BASE_URL=https://your-instance.example.com
N8N_API_KEY=your-api-key

# Set this to enable the write tools. Leave empty for a read-only server.
MCP_WRITE_AUTH_TOKEN=a-long-random-value

Create the API key in n8n under Settings → n8n API.

3. Register with your agent, once

# Claude Code
claude mcp add --transport stdio --scope user n8n-guard -- n8n-mcp-guard

# Codex
codex mcp add n8n-guard -- n8n-mcp-guard

Both register at user scope, so the server is available in every repository without adding anything to any project. Nothing goes in your project's package.json — an MCP server is a process your agent launches, not a dependency you install per repo.

How a change actually works

n8n_plan_workflow_update    backs up, diffs, hands you a plan_id
      ↓                     you read the diff and agree to it
n8n_create_test_clone       rehearse: no triggers, no outbound calls
n8n_delete_test_clone       cleaned up, verified gone
      ↓
n8n_apply_workflow_update   commits only if nothing moved; verifies by readback

What that buys you, concretely:

  • Plan and apply are separate. The plan records a fingerprint of the exact live state your change was designed against. If a colleague edits the workflow in the n8n UI while you are reviewing the diff, the apply aborts — including the case where the content changed but the version ID did not.

  • A backup must exist to write. Not advice in a document: the apply step looks for a checksum-verified backup of that exact version and refuses without one. Tampered backups do not count.

  • The result is proven, not assumed. After saving, the graph is re-fetched and fingerprinted. An instance that stores something other than what it was sent fails loudly instead of reporting success.

  • Rehearsals cannot reach the outside world. A test clone has every trigger and every outbound node — HTTP, email, Slack, Telegram, shell — disabled unless you name an exception. The deleter refuses to touch any workflow that isn't one of these clones.

Tools

Read-only, always available:

Tool

Description

n8n_get_workflow

Workflow summary, or the full updateable definition. Never returns credential secrets.

n8n_diff_workflow

Structured diff of a proposed definition against the live one. Stores nothing.

n8n_plan_workflow_update

Phase 1: backs up, diffs, returns a plan_id. Changes nothing in n8n.

n8n_backup_workflow

Writes a checksum-verified local backup.

n8n_list_test_clones

Finds leftover rehearsal clones so nothing is left running.

Write tools, registered whenever MCP_WRITE_AUTH_TOKEN is set:

Tool

Description

n8n_create_workflow

Creates a new workflow from an agent-authored definition. Always inactive, read back and verified, backed up immediately.

n8n_apply_workflow_update

Phase 2: commits a plan only if the live workflow still matches it and a verified backup exists, then confirms by readback.

n8n_create_test_clone

Inactive clone with every trigger and outbound node disabled unless explicitly allowed.

n8n_delete_test_clone

Deactivates, deletes, verifies removal. Refuses anything that isn't a rehearsal clone.

n8n_restore_workflow_backup

Restores from a backup as a normal plan, so it still shows a diff and needs an explicit apply.

Every write additionally requires approved: true and the token on each call, so an agent cannot mutate anything by accident. To keep the server strictly read-only even with a token present, set ENABLE_N8N_WORKFLOW_WRITE_TOOLS=false.

Configuration

Variable

Required

Default

Purpose

N8N_BASE_URL

Yes

Instance root URL, or an explicit /api/v1 URL.

N8N_API_KEY

Yes

Created under Settings → n8n API.

MCP_WRITE_AUTH_TOKEN

For writes

Long random value. Setting it is what enables the write tools.

ENABLE_N8N_WORKFLOW_TOOLS

No

true

Registers the read-only tools.

ENABLE_N8N_WORKFLOW_WRITE_TOOLS

No

true

Set false to force writes off even with a token configured.

N8N_MCP_BACKUP_DIR

No

<user config>/backups

Where verified backups are written.

ENABLE_EXAMPLE_TOOLS

No

false

Registers two topology-specific reference tools (see below).

Values resolve in this order, first match wins:

  1. The process environment — what your client passes in its env block.

  2. N8N_MCP_ENV_FILE — an explicit path to a dotenv file.

  3. A .env beside the package — how a cloned checkout is set up.

  4. A user-level .env — the path from the quick start above.

Option 4 is recommended: your API key never appears in a client config file or a project repository. On startup the server reports which source it used, on stderr.

Never commit a real .env. It is git-ignored here and excluded from the published npm package.

Client setup

Any client that speaks MCP over stdio works. Cursor, Windsurf, Claude Desktop and most others use this shape — check your client's docs for the file location:

{
  "mcpServers": {
    "n8n-guard": {
      "command": "npx",
      "args": ["-y", "n8n-mcp-guard"]
    }
  }
}

With a user-level .env in place, no env block is needed. VS Code uses the same entry shape under a servers key instead of mcpServers; add it through MCP: Add Server in the Command Palette.

The division of labour

The server owns recoverability. Backups, version matching, readback verification, clone neutralization and cleanup are enforced in code and covered by tests. You can always get back to the version that worked.

You own judgement. Whether the new routing is the routing you wanted, and whether the test email read correctly, are calls only you can make. CLAUDE.md, AGENTS.md and the bundled agent skill encode that review procedure so your agent walks you through it rather than skipping it.

Bundled examples

n8n_test_supplier_email_action_routing and n8n_configure_supplier_email_action_routing are worked examples of a workflow-specific guarded tool built on the generic layer. They target one exact Shopify-triggered order-email topology, so they stay unregistered unless you set ENABLE_EXAMPLE_TOOLS=true. Read src/n8n/emailActionRouting.ts and src/n8n/emailActionTestClone.ts if you want to build your own.

Install from source

git clone https://github.com/FarazHayder/n8n-mcp-guard.git
cd n8n-mcp-guard
npm ci          # also builds, via the prepare script
npm run check   # typecheck, tests, build, MCP handshake

Then point your client at the absolute path to dist/index.js.

Development

npm run dev        # run from TypeScript source
npm run typecheck
npm test
npm run build
npm run smoke      # MCP handshake against the built server
npm run check      # all of the above

Run npm run check before opening a pull request.

Roadmap

  • Run the integration suite in CI against an ephemeral n8n container.

  • Generic execution rehearsal: drive a clone with synthetic input and assert which nodes ran, without workflow-specific code.

  • Richer diffs, including expression-level changes inside Code nodes.

Contributing

Bug fixes, documentation, tests, safety hardening, and new generic n8n tools are all welcome. Please read CONTRIBUTING.md first.

Never include API keys, .env files, production workflow exports, customer data, or anything from n8n-workflow-backups/ in an issue or pull request.

Security

See SECURITY.md. Report suspected vulnerabilities privately through GitHub's private vulnerability reporting, not a public issue.

License

MIT © Faraz Hayder

Available Tools

5 tools
n8n_backup_workflowA

Save a verified local backup of any n8n workflow. Writes nothing to n8n. The backup is read back and checksum-verified, and n8n_apply_workflow_update refuses to run without one matching the exact version being changed.

ParametersJSON Schema
NameRequiredDescriptionDefault
workflow_idYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses that nothing is written to n8n, that the backup is read back and checksum-verified, and that a downstream tool enforces its presence. It omits storage location, naming/overwrite behavior, and failure modes, which keeps it from a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, each load-bearing: what it does, the safety guarantee, and the verification/dependency contract. Front-loaded with the core action and no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter tool with no output schema and no annotations, the description covers purpose, side-effect profile, verification, and inter-tool dependency. It does not say what the call returns (backup id, path, or checksum), which is the main remaining gap since no output schema exists.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

One parameter with 0% schema description coverage, but workflow_id is self-explanatory and the description's 'any n8n workflow' implicitly confirms it accepts an arbitrary workflow identifier. No additional format or constraint details are offered beyond the schema's minLength.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Save a verified local backup of any n8n workflow') with an added qualifier (verified, local) that separates it from siblings like n8n_get_workflow and n8n_diff_workflow. An agent can tell immediately this creates a durable artifact rather than reading or comparing workflows.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear context for use by tying it to n8n_apply_workflow_update: the backup is a prerequisite that must match the exact version being changed. It lacks explicit when-not guidance (e.g. no need for a backup on read-only operations), so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

n8n_diff_workflowA

Compare a proposed workflow definition against the live one and return a structured diff. Read-only, and unlike planning it stores nothing.

ParametersJSON Schema
NameRequiredDescriptionDefault
definitionYes
workflow_idYes

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It usefully discloses two traits: "Read-only" and that it "stores nothing," which rules out mutation or side effects. Beyond that it says nothing about whether the live workflow could change mid-diff, how large diffs are returned, or any auth requirements, leaving real gaps for a no-annotation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no filler, with the core action front-loaded and the disambiguating clause second. Every phrase earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description correctly names the return value ("a structured diff"), and it covers the read-only/no-persistence behavior that annotations would otherwise supply. The nested definition parameter is left under-specified, but the description is otherwise sufficient to call the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% on two parameters, so the description must compensate. It does clarify the role split — "definition" is the proposed workflow, and the comparison target is the live workflow identified by workflow_id — but adds no format detail for the nested definition object (name/nodes/connections) that the schema leaves undescribed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ("Compare") and resource ("a proposed workflow definition against the live one") plus the return artifact ("a structured diff"), and explicitly contrasts itself with the planning sibling. An agent can distinguish it from n8n_plan_workflow_update and n8n_get_workflow without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The clause "unlike planning it stores nothing" implies the condition for choosing this tool over n8n_plan_workflow_update, but the guidance is indirect and never states when this tool should be used versus n8n_get_workflow or the backup sibling. Usage is inferable rather than spelled out.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

n8n_get_workflowA

Read one n8n workflow through the official REST API. Returns a compact summary by default; include_definition returns the updateable workflow definition but never credential secrets.

ParametersJSON Schema
NameRequiredDescriptionDefault
workflow_idYes
include_definitionNo

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and does meaningful work: it discloses the default versus expanded return modes and, importantly, that the definition never includes credential secrets — a security-relevant guarantee an agent could not infer from the schema. It does not cover failure behavior for a missing workflow_id or any auth/permission requirements, so it falls short of a full 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with no filler, and the default behavior plus the include_definition escalation are front-loaded in the first, most relevant clause.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter read tool with no output schema and no annotations, the description covers the essential decision (summary vs full definition) and the critical security caveat. What the compact summary actually contains, and error handling for an unknown id, remain unspecified, so it is strong but not exhaustive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it does for include_definition: it explains the flag's effect (returns the updateable workflow definition) and its security boundary (no credential secrets). workflow_id is only implied by 'Read one n8n workflow', which is adequate but not explicit about format or where the id comes from.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Read'), a bounded resource ('one n8n workflow'), and the transport ('official REST API'). The singular read scope clearly separates it from n8n_diff_workflow, n8n_backup_workflow and n8n_list_test_clones, which compare, persist, or enumerate rather than fetch a single record.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use each mode ('Returns a compact summary by default; include_definition returns the updateable workflow definition'), which is useful implied guidance. However, it never states when to prefer this tool over the siblings (e.g., before diffing or planning an update), so no explicit routing guidance exists.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

n8n_list_test_clonesA

List leftover temporary test clones created by this server, so nothing is left running. Read-only.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full behavioral burden. It does disclose the key trait by stating "Read-only" and clarifies that the clones are temporary artifacts created by this server, but it omits pagination, result ordering, or what an empty result means.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the core action and purpose, with the read-only guarantee tacked on efficiently. Nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only list tool with no output schema, the description covers what is listed and why. The absence of any return-shape detail is acceptable since no output schema exists, though a hint about empty results would round it out.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the baseline of 4 applies; there is nothing for the description to add and no schema gap to compensate for.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description pairs a specific verb (List) with a well-scoped resource (leftover temporary test clones created by this server), which no sibling tool touches. It is clear what the tool returns, though it never explicitly contrasts itself with the workflow-oriented siblings (n8n_get_workflow, n8n_backup_workflow, etc.).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"so nothing is left running" implies a cleanup/verification context, which is a reasonable usage hint. However, there is no explicit statement of when to call this versus other listing or cleanup tools, and no prerequisites are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

n8n_plan_workflow_updateA

Phase 1 of a guarded update. Reads the live workflow, backs it up, diffs it against your proposed definition, and returns a plan_id plus a structured diff to review. Changes nothing in n8n. Pass the plan_id to n8n_apply_workflow_update to commit.

ParametersJSON Schema
NameRequiredDescriptionDefault
definitionYes
workflow_idYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses that it reads the live workflow, takes a backup, computes a diff, returns a plan_id plus structured diff, and critically that it 'Changes nothing in n8n.' It omits auth/permission requirements and any rate or size considerations, so it stops short of a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four short sentences, zero waste, and the most decision-relevant facts (phase, read-only, next step) are front-loaded. Nothing is repeated from the schema or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, and the description helpfully states what comes back (plan_id + structured diff) and that state is unchanged, which is the key decision input for an agent. The remaining gap is parameter/definition shape, which neither the schema nor the description explains.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and 'definition' is a required nested object, so the description must compensate but largely does not. It only alludes to 'your proposed definition' and never explains workflow_id, nor the required name/nodes/connections shape the nested object expects.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('plan workflow update') and delimits it with a precise scope: reads, backs up, diffs, returns a plan_id. It explicitly separates itself from the commit phase by naming n8n_apply_workflow_update, so an agent can distinguish it from n8n_diff_workflow and n8n_backup_workflow without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit two-phase workflow: call this first ('Phase 1'), then 'Pass the plan_id to n8n_apply_workflow_update to commit.' The condition that selects this tool over its siblings is stated outright, and the follow-on action is named.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 5 tool updatesv1.2.1
    • First observedn8n_backup_workflow
    • First observedn8n_diff_workflow
    • First observedn8n_get_workflow
    • First observedn8n_list_test_clones
    • First observedn8n_plan_workflow_update

TDQS

A3.9/5.0

Scored across 5 tools

Disambiguation4/5

n8n_plan_workflow_update is effectively a superset of n8n_diff_workflow and n8n_backup_workflow (it reads, backs up, and diffs), so boundaries overlap. The descriptions do a good job disambiguating — diff is read-only and stores nothing, backup is standalone, plan orchestrates the guarded update — so an agent can mostly pick correctly.

Naming Consistency5/5

Every tool follows the same n8n_ prefix plus snake_case verb_noun pattern (diff_workflow, list_test_clones, get_workflow, backup_workflow, plan_workflow_update). Fully predictable and consistent.

Tool Count4/5

Five tools is lean and each earns its place within a guarded-update workflow. It is slightly thin because the commit stage is referenced but absent from the listed surface.

Completeness2/5

The descriptions repeatedly reference n8n_apply_workflow_update as the commit step, yet it is not in the tool set, leaving the guarded-update lifecycle without its terminal operation. Test-clone management is also only half-present (list exists, no create/cleanup), creating dead ends for agents.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers