n8n-mcp-guard
This server exposes a read-only set of n8n workflow tools (no write tools are registered in this schema), letting you inspect, diff, back up, and plan changes to workflows without mutating the n8n instance.
Get a workflow (
n8n_get_workflow): read one workflow byworkflow_id, returning a compact summary or, withinclude_definition: true, the full updateable definition (never credential secrets).Back up a workflow (
n8n_backup_workflow): save a checksum-verified local backup of any workflow; writes nothing to n8n, but is required before any guarded apply.Plan an update (
n8n_plan_workflow_update): phase 1 of a guarded change — reads the live workflow, backs it up, diffs it against your proposed definition, and returns aplan_idplus structured diff. Changes nothing in n8n.Diff a workflow (
n8n_diff_workflow): compare a proposed definition against the live workflow and get a structured diff; read-only and stores nothing.List test clones (
n8n_list_test_clones): find leftover temporary rehearsal clones so nothing is left running.What you can't do here: create, apply, clone, delete, or restore workflows — the write tools (
n8n_create_workflow,n8n_apply_workflow_update,n8n_create_test_clone,n8n_delete_test_clone,n8n_restore_workflow_backup) are only registered whenMCP_WRITE_AUTH_TOKENis set.
Provides tools for safely creating and modifying n8n workflows via the n8n API. Supports fetching and diffing workflow definitions, planning updates with a two-phase commit (backup, fingerprint-based staleness check, then apply with readback verification), creating inactive test clones with triggers and outbound nodes disabled for rehearsal, deleting those clones with proof of removal, checksum-verified local backups, and restoring workflows from backup as a reviewable plan. Write operations are gated behind an auth token and explicit approval, with mutating tools unregistered entirely unless enabled.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@n8n-mcp-guardadd a Slack alert to my order sync workflow, rehearse it first"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
n8n-mcp-guard
Let an AI agent build and change your n8n workflows — with a guaranteed way back.
Agents are good at writing workflow logic and bad at knowing when they have
broken something. n8n-mcp-guard sits in between. Every change is backed up
before it happens, checked against the exact version it was designed for, and
verified against the live instance after saving. If anything does not line up,
the write is refused rather than attempted and hoped for.
Set it up once, use it from any MCP-capable agent, in every repository.
Who it's for
You're building something new. Describe the automation you want, let the agent write it, and create it as an inactive workflow you can inspect before anything runs. Iterate with a reviewable diff at every step. You never have to read raw JSON to know what changed, and you can always get back to the last version that worked.
You have something already running. The workflow that quietly emails your customers or syncs your orders is the one you least want an agent improvising on. Here, a change to it is a two-phase commit: plan it, review the diff, rehearse it on a disposable clone with every trigger and outbound call disabled, then commit — and only if nothing moved underneath you in the meantime.
Related MCP server: n8n MCP Server
Why you can trust it
68 unit tests covering every path where a write is supposed to be refused, plus a live integration suite that drives the write tools through the real MCP surface against a real n8n instance: create, plan, apply, stale-plan refusal, clone neutralization, the delete guard, and verified cleanup. Run it yourself with
npm run test:integration.Validated against a real instance: workflow fingerprinting, diffing, clone construction and the backup gate were run across 99 real production workflows spanning 40 distinct node types, correctly neutralizing 114 triggers and 304 outbound nodes — zero failures.
Nothing can write until you say so. With no write token configured, the mutating tools are not merely unused, they are never registered at all.
CI on Node 22 and 24. MIT licensed. No telemetry, no network calls except to your own n8n instance.
Quick start
1. Install
npm install -g n8n-mcp-guard2. Configure once, for every project
Create one file and every repository is covered:
Windows:
%APPDATA%\n8n-mcp-guard\.envmacOS / Linux:
~/.config/n8n-mcp-guard/.env
N8N_BASE_URL=https://your-instance.example.com
N8N_API_KEY=your-api-key
# Set this to enable the write tools. Leave empty for a read-only server.
MCP_WRITE_AUTH_TOKEN=a-long-random-valueCreate the API key in n8n under Settings → n8n API.
3. Register with your agent, once
# Claude Code
claude mcp add --transport stdio --scope user n8n-guard -- n8n-mcp-guard
# Codex
codex mcp add n8n-guard -- n8n-mcp-guardBoth register at user scope, so the server is available in every repository
without adding anything to any project. Nothing goes in your project's
package.json — an MCP server is a process your agent launches, not a
dependency you install per repo.
How a change actually works
n8n_plan_workflow_update backs up, diffs, hands you a plan_id
↓ you read the diff and agree to it
n8n_create_test_clone rehearse: no triggers, no outbound calls
n8n_delete_test_clone cleaned up, verified gone
↓
n8n_apply_workflow_update commits only if nothing moved; verifies by readbackWhat that buys you, concretely:
Plan and apply are separate. The plan records a fingerprint of the exact live state your change was designed against. If a colleague edits the workflow in the n8n UI while you are reviewing the diff, the apply aborts — including the case where the content changed but the version ID did not.
A backup must exist to write. Not advice in a document: the apply step looks for a checksum-verified backup of that exact version and refuses without one. Tampered backups do not count.
The result is proven, not assumed. After saving, the graph is re-fetched and fingerprinted. An instance that stores something other than what it was sent fails loudly instead of reporting success.
Rehearsals cannot reach the outside world. A test clone has every trigger and every outbound node — HTTP, email, Slack, Telegram, shell — disabled unless you name an exception. The deleter refuses to touch any workflow that isn't one of these clones.
Tools
Read-only, always available:
Tool | Description |
| Workflow summary, or the full updateable definition. Never returns credential secrets. |
| Structured diff of a proposed definition against the live one. Stores nothing. |
| Phase 1: backs up, diffs, returns a |
| Writes a checksum-verified local backup. |
| Finds leftover rehearsal clones so nothing is left running. |
Write tools, registered whenever MCP_WRITE_AUTH_TOKEN is set:
Tool | Description |
| Creates a new workflow from an agent-authored definition. Always inactive, read back and verified, backed up immediately. |
| Phase 2: commits a plan only if the live workflow still matches it and a verified backup exists, then confirms by readback. |
| Inactive clone with every trigger and outbound node disabled unless explicitly allowed. |
| Deactivates, deletes, verifies removal. Refuses anything that isn't a rehearsal clone. |
| Restores from a backup as a normal plan, so it still shows a diff and needs an explicit apply. |
Every write additionally requires approved: true and the token on each call,
so an agent cannot mutate anything by accident. To keep the server strictly
read-only even with a token present, set
ENABLE_N8N_WORKFLOW_WRITE_TOOLS=false.
Configuration
Variable | Required | Default | Purpose |
| Yes | — | Instance root URL, or an explicit |
| Yes | — | Created under Settings → n8n API. |
| For writes | — | Long random value. Setting it is what enables the write tools. |
| No |
| Registers the read-only tools. |
| No |
| Set |
| No |
| Where verified backups are written. |
| No |
| Registers two topology-specific reference tools (see below). |
Values resolve in this order, first match wins:
The process environment — what your client passes in its
envblock.N8N_MCP_ENV_FILE— an explicit path to a dotenv file.A
.envbeside the package — how a cloned checkout is set up.A user-level
.env— the path from the quick start above.
Option 4 is recommended: your API key never appears in a client config file or a project repository. On startup the server reports which source it used, on stderr.
Never commit a real
.env. It is git-ignored here and excluded from the published npm package.
Client setup
Any client that speaks MCP over stdio works. Cursor, Windsurf, Claude Desktop and most others use this shape — check your client's docs for the file location:
{
"mcpServers": {
"n8n-guard": {
"command": "npx",
"args": ["-y", "n8n-mcp-guard"]
}
}
}With a user-level .env in place, no env block is needed. VS Code uses the
same entry shape under a servers key instead of mcpServers; add it through
MCP: Add Server in the Command Palette.
The division of labour
The server owns recoverability. Backups, version matching, readback verification, clone neutralization and cleanup are enforced in code and covered by tests. You can always get back to the version that worked.
You own judgement. Whether the new routing is the routing you wanted, and
whether the test email read correctly, are calls only you can make. CLAUDE.md,
AGENTS.md and the bundled agent skill encode that review procedure so your
agent walks you through it rather than skipping it.
Bundled examples
n8n_test_supplier_email_action_routing and
n8n_configure_supplier_email_action_routing are worked examples of a
workflow-specific guarded tool built on the generic layer. They target one
exact Shopify-triggered order-email topology, so they stay unregistered unless
you set ENABLE_EXAMPLE_TOOLS=true. Read src/n8n/emailActionRouting.ts and
src/n8n/emailActionTestClone.ts if you want to build your own.
Install from source
git clone https://github.com/FarazHayder/n8n-mcp-guard.git
cd n8n-mcp-guard
npm ci # also builds, via the prepare script
npm run check # typecheck, tests, build, MCP handshakeThen point your client at the absolute path to dist/index.js.
Development
npm run dev # run from TypeScript source
npm run typecheck
npm test
npm run build
npm run smoke # MCP handshake against the built server
npm run check # all of the aboveRun npm run check before opening a pull request.
Roadmap
Run the integration suite in CI against an ephemeral n8n container.
Generic execution rehearsal: drive a clone with synthetic input and assert which nodes ran, without workflow-specific code.
Richer diffs, including expression-level changes inside Code nodes.
Contributing
Bug fixes, documentation, tests, safety hardening, and new generic n8n tools are all welcome. Please read CONTRIBUTING.md first.
Never include API keys, .env files, production workflow exports, customer
data, or anything from n8n-workflow-backups/ in an issue or pull request.
Security
See SECURITY.md. Report suspected vulnerabilities privately through GitHub's private vulnerability reporting, not a public issue.
License
MIT © Faraz Hayder
Available Tools
5 toolsn8n_backup_workflowA
Save a verified local backup of any n8n workflow. Writes nothing to n8n. The backup is read back and checksum-verified, and n8n_apply_workflow_update refuses to run without one matching the exact version being changed.
| Name | Required | Description | Default |
|---|---|---|---|
| workflow_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses that nothing is written to n8n, that the backup is read back and checksum-verified, and that a downstream tool enforces its presence. It omits storage location, naming/overwrite behavior, and failure modes, which keeps it from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each load-bearing: what it does, the safety guarantee, and the verification/dependency contract. Front-loaded with the core action and no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool with no output schema and no annotations, the description covers purpose, side-effect profile, verification, and inter-tool dependency. It does not say what the call returns (backup id, path, or checksum), which is the main remaining gap since no output schema exists.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
One parameter with 0% schema description coverage, but workflow_id is self-explanatory and the description's 'any n8n workflow' implicitly confirms it accepts an arbitrary workflow identifier. No additional format or constraint details are offered beyond the schema's minLength.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Save a verified local backup of any n8n workflow') with an added qualifier (verified, local) that separates it from siblings like n8n_get_workflow and n8n_diff_workflow. An agent can tell immediately this creates a durable artifact rather than reading or comparing workflows.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear context for use by tying it to n8n_apply_workflow_update: the backup is a prerequisite that must match the exact version being changed. It lacks explicit when-not guidance (e.g. no need for a backup on read-only operations), so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
n8n_diff_workflowA
Compare a proposed workflow definition against the live one and return a structured diff. Read-only, and unlike planning it stores nothing.
| Name | Required | Description | Default |
|---|---|---|---|
| definition | Yes | ||
| workflow_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It usefully discloses two traits: "Read-only" and that it "stores nothing," which rules out mutation or side effects. Beyond that it says nothing about whether the live workflow could change mid-diff, how large diffs are returned, or any auth requirements, leaving real gaps for a no-annotation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler, with the core action front-loaded and the disambiguating clause second. Every phrase earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description correctly names the return value ("a structured diff"), and it covers the read-only/no-persistence behavior that annotations would otherwise supply. The nested definition parameter is left under-specified, but the description is otherwise sufficient to call the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% on two parameters, so the description must compensate. It does clarify the role split — "definition" is the proposed workflow, and the comparison target is the live workflow identified by workflow_id — but adds no format detail for the nested definition object (name/nodes/connections) that the schema leaves undescribed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ("Compare") and resource ("a proposed workflow definition against the live one") plus the return artifact ("a structured diff"), and explicitly contrasts itself with the planning sibling. An agent can distinguish it from n8n_plan_workflow_update and n8n_get_workflow without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The clause "unlike planning it stores nothing" implies the condition for choosing this tool over n8n_plan_workflow_update, but the guidance is indirect and never states when this tool should be used versus n8n_get_workflow or the backup sibling. Usage is inferable rather than spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
n8n_get_workflowA
Read one n8n workflow through the official REST API. Returns a compact summary by default; include_definition returns the updateable workflow definition but never credential secrets.
| Name | Required | Description | Default |
|---|---|---|---|
| workflow_id | Yes | ||
| include_definition | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and does meaningful work: it discloses the default versus expanded return modes and, importantly, that the definition never includes credential secrets — a security-relevant guarantee an agent could not infer from the schema. It does not cover failure behavior for a missing workflow_id or any auth/permission requirements, so it falls short of a full 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with no filler, and the default behavior plus the include_definition escalation are front-loaded in the first, most relevant clause.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter read tool with no output schema and no annotations, the description covers the essential decision (summary vs full definition) and the critical security caveat. What the compact summary actually contains, and error handling for an unknown id, remain unspecified, so it is strong but not exhaustive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, and it does for include_definition: it explains the flag's effect (returns the updateable workflow definition) and its security boundary (no credential secrets). workflow_id is only implied by 'Read one n8n workflow', which is adequate but not explicit about format or where the id comes from.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Read'), a bounded resource ('one n8n workflow'), and the transport ('official REST API'). The singular read scope clearly separates it from n8n_diff_workflow, n8n_backup_workflow and n8n_list_test_clones, which compare, persist, or enumerate rather than fetch a single record.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use each mode ('Returns a compact summary by default; include_definition returns the updateable workflow definition'), which is useful implied guidance. However, it never states when to prefer this tool over the siblings (e.g., before diffing or planning an update), so no explicit routing guidance exists.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
n8n_list_test_clonesA
List leftover temporary test clones created by this server, so nothing is left running. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full behavioral burden. It does disclose the key trait by stating "Read-only" and clarifies that the clones are temporary artifacts created by this server, but it omits pagination, result ordering, or what an empty result means.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the core action and purpose, with the read-only guarantee tacked on efficiently. Nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only list tool with no output schema, the description covers what is listed and why. The absence of any return-shape detail is acceptable since no output schema exists, though a hint about empty results would round it out.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline of 4 applies; there is nothing for the description to add and no schema gap to compensate for.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description pairs a specific verb (List) with a well-scoped resource (leftover temporary test clones created by this server), which no sibling tool touches. It is clear what the tool returns, though it never explicitly contrasts itself with the workflow-oriented siblings (n8n_get_workflow, n8n_backup_workflow, etc.).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"so nothing is left running" implies a cleanup/verification context, which is a reasonable usage hint. However, there is no explicit statement of when to call this versus other listing or cleanup tools, and no prerequisites are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
n8n_plan_workflow_updateA
Phase 1 of a guarded update. Reads the live workflow, backs it up, diffs it against your proposed definition, and returns a plan_id plus a structured diff to review. Changes nothing in n8n. Pass the plan_id to n8n_apply_workflow_update to commit.
| Name | Required | Description | Default |
|---|---|---|---|
| definition | Yes | ||
| workflow_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses that it reads the live workflow, takes a backup, computes a diff, returns a plan_id plus structured diff, and critically that it 'Changes nothing in n8n.' It omits auth/permission requirements and any rate or size considerations, so it stops short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences, zero waste, and the most decision-relevant facts (phase, read-only, next step) are front-loaded. Nothing is repeated from the schema or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, and the description helpfully states what comes back (plan_id + structured diff) and that state is unchanged, which is the key decision input for an agent. The remaining gap is parameter/definition shape, which neither the schema nor the description explains.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and 'definition' is a required nested object, so the description must compensate but largely does not. It only alludes to 'your proposed definition' and never explains workflow_id, nor the required name/nodes/connections shape the nested object expects.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('plan workflow update') and delimits it with a precise scope: reads, backs up, diffs, returns a plan_id. It explicitly separates itself from the commit phase by naming n8n_apply_workflow_update, so an agent can distinguish it from n8n_diff_workflow and n8n_backup_workflow without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit two-phase workflow: call this first ('Phase 1'), then 'Pass the plan_id to n8n_apply_workflow_update to commit.' The condition that selects this tool over its siblings is stated outright, and the follow-on action is named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v1.2.1- First observed
n8n_backup_workflow - First observed
n8n_diff_workflow - First observed
n8n_get_workflow - First observed
n8n_list_test_clones - First observed
n8n_plan_workflow_update
TDQS
Scored across 5 tools
n8n_plan_workflow_update is effectively a superset of n8n_diff_workflow and n8n_backup_workflow (it reads, backs up, and diffs), so boundaries overlap. The descriptions do a good job disambiguating — diff is read-only and stores nothing, backup is standalone, plan orchestrates the guarded update — so an agent can mostly pick correctly.
Every tool follows the same n8n_ prefix plus snake_case verb_noun pattern (diff_workflow, list_test_clones, get_workflow, backup_workflow, plan_workflow_update). Fully predictable and consistent.
Five tools is lean and each earns its place within a guarded-update workflow. It is slightly thin because the commit stage is referenced but absent from the listed surface.
The descriptions repeatedly reference n8n_apply_workflow_update as the commit step, yet it is not in the tool set, leaving the guarded-update lifecycle without its terminal operation. Test-clone management is also only half-present (list exists, no create/cleanup), creating dead ends for agents.
Maintenance
Related MCP Connectors
- mcp-serverOAuthcom.make
Give your AI agents the tools to build, manage, and run automation workflows.
Security scanner for n8n workflows + live MCP Trust-Check. 18 rules, OWASP mapped. Paid x402 API.
Create, browse, remix, collaborate on, and run durable AI workflow nodes from MCP hosts.
Create, test, publish, and manage Dreamlit notification workflows from AI clients.
Related MCP Servers
- AlicenseCqualityAmaintenanceEnables AI agents to create, retrieve, update, and manage n8n workflows through the n8n API. Supports full workflow lifecycle management including activation, deactivation, and deletion operations.3923 npmMIT
- AlicenseNot gradedqualityDmaintenanceEnables AI models to manage n8n workflow automation through a standardized interface. Supports creating, reading, updating, and deleting workflows with comprehensive access to workflow nodes, connections, and configurations.12 npmMIT
- AlicenseNot gradedqualityDmaintenanceEnables AI agents to manage n8n workflow automation instances through tools for workflow CRUD operations, execution monitoring, and webhook triggering. It facilitates programmatic interaction with n8n instances via the n8n API with AI-optimized descriptions and error handling.62MIT
- AlicenseBqualityDmaintenanceAllows AI clients to list, inspect, and manage n8n workflows.1154 npmMIT