n8n-manager-mcp
This server is an MCP bridge that lets AI assistants securely manage n8n workflows through 19 tools.
Workflow management: list, get, create, update, delete, activate/deactivate workflows on n8n instances.
Execution inspection: list recent executions with status, timing, and errors.
Multi-server support: add, list, ping, and remove multiple n8n servers with isolated credentials and per-server routing.
Safety controls: toggle read-only mode, backup-before-mutation, and audit logging.
Backups & restore: automatically back up workflows before mutations, list backups, and restore from local JSON snapshots.
Export/import: export workflows as JSON and import them to another n8n server.
Offline node catalog: browse and describe common n8n node types by category to help build valid workflows.
Audit & transparency: view safety status, backup paths, audit log location, and optional n8n-workflow-manager history.
Provides tools for managing n8n workflows, including listing, creating, updating, deleting, activating/deactivating workflows, viewing execution history, exporting/importing workflows, and browsing node types.
n8n Manager MCP Server
๐ฉ๐ช Deutsche Version
Part of the ellmos-ai family and the open-bricks umbrella.
For AI Assistants & LLMs: An llms.txt index file is available in the root directory for fast context ingestion, tool catalog references, and directory listings.
MCP (Model Context Protocol) server for managing n8n workflows via AI assistants like Claude, Cursor, and Windsurf.
Quick Navigation
Nr | Section | Highlights |
01 | Local stdio transport, multi-server routing, and safety middleware | |
02 | Component Architecture flowchart TD & Safe Mutation Lifecycle sequence diagram | |
03 | Official listings on npm, Glama, PulseMCP, and Enterprise DNA | |
04 | Persona mapping | |
05 | 10-dimension evaluation vs raw REST API, shell CLI, browser UI, and cloud SaaS | |
06 | 10 formal invariants ( | |
07 | Direct REST integration, multi-server routing, backup snapshots, node catalog | |
08 | One-command setup for Claude Code, Claude Desktop, Cursor, and Windsurf | |
09 | Step-by-step workflow creation, execution inspection, and server switching | |
10 | Complete MCP tool reference across CRUD, executions, backups, and nodes | |
11 | Decision tracking and change history integration with paired manager service | |
12 | Environment variables, local backup root, and strict monotonic constraints | |
13 | Multi-OS Vitest test suite, smoke runner, and offline node catalog tests | |
14 | Sibling MCP servers, BACH agent OS, and open-bricks desktop software suites | |
15 | 100% permissive open-source dependencies (MIT, BSD, Apache-2.0) | |
16 | Comprehensive positioning log, keyword matrix, and 3-phase roadmap | |
17 | Complete release notes, security hardenings, and discoverability history | |
18 | Statutory open-source donation notice under ยงยง 516 ff. BGB and MIT disclaimer |
Related MCP server: n8n-MCP
System Architecture
The n8n Manager MCP Server operates as a local-first, stdio-connected bridge between AI development environments (Claude Code, Claude Desktop, Cursor, Windsurf) and local or remote n8n instances.
Process Model: Runs purely in user space (
RunAsInvoker) as a dedicated Node.js child process communicating via standard input/output (stdio) using JSON-RPC 2.0.Fail-Closed Safety Middleware: Every mutation tool call passes through an immutable safety gate before contacting n8n APIs or touching the filesystem.
Multi-Instance Router: Seamlessly targets independent n8n instances (development, staging, production) with isolated API credentials and atomic configuration persistence.
Offline Node Catalog: Provides instantaneous node schema introspection (
n8n_describe_nodes) without incurring API latency or network calls.
Dual Mermaid Diagrams
Component Architecture
flowchart TD
Client["AI Client (Claude Code / Desktop / Cursor / Windsurf)"] -->|"MCP Stdio Protocol (JSON-RPC 2.0)"| Router["Tool Router (19 Tools)"]
subgraph MCPServer["n8n Manager MCP Server (Local Stdio Process)"]
Router --> Safety["Safety Layer (Read-Only Gate & Traversal Guard)"]
Safety --> Backup["Pre-Mutation Snapshot Engine"]
Safety --> MultiServer["Multi-Server Manager"]
Safety --> Catalog["Offline Node Catalog (n8n_describe_nodes)"]
Backup --> Audit["Append-Only Audit Logger"]
end
MultiServer -->|"REST API (API Key / Auth Header)"| LocalInst["Local n8n Instance (127.0.0.1:5678)"]
MultiServer -->|"REST API (HTTPS / Token)"| CloudInst["Remote / Cloud n8n Instance"]
Backup --> BackupFS[("Backups (~/.n8n-manager-mcp/backups/)")]
Audit --> AuditFS[("Audit Log (~/.n8n-manager-mcp/audit.log)")]Safe Workflow Mutation Lifecycle
sequenceDiagram
autonumber
actor AI as AI Assistant (Claude / Cursor)
participant MCP as n8n-manager-mcp Router
participant Safety as Safety & Read-Only Gate
participant Snapshot as Backup Engine
participant Store as Local Storage (~/.n8n-manager-mcp)
participant N8N as n8n REST API Instance
participant Audit as Forensic Audit Logger
AI->>MCP: Call Mutation Tool (n8n_update_workflow / n8n_delete_workflow)
MCP->>Safety: Check N8N_MANAGER_READ_ONLY
alt Read-Only Active (INV-READ-02)
Safety-->>AI: Blocked: Read-only mode active (Fail-Closed)
Safety->>Audit: Record blocked mutation attempt
else Mutation Permitted
Safety->>Snapshot: Trigger Pre-Mutation Snapshot (INV-BACK-03)
Snapshot->>N8N: GET /workflows/{id} (Fetch current state)
N8N-->>Snapshot: Current Workflow JSON
Snapshot->>Store: Save timestamped backup (~/backups/{server}/{id}-{timestamp}.json)
Snapshot-->>Safety: Backup verified & path resolved
Safety->>N8N: Execute Mutation (PUT / DELETE / PATCH)
N8N-->>Safety: Mutation Response (200 OK / Updated ID)
Safety->>Audit: Append structured forensic receipt (INV-AUDIT-04)
Safety-->>AI: Success response with backup path & rollback receipt
end
Directory Status
npm package: published as
n8n-manager-mcpGlama listing: public directory page for the ellmos-ai repo
Enterprise DNA directory: additional public directory entry for
ellmos-ai/n8n-manager-mcpPulseMCP listing: indexed as
ellmos-ai-n8n-managerMCP namespace status: this repo contains
server.jsonandmcpNamemetadata forio.github.ellmos-ai/n8n-manager-mcp; some ecosystem directories still expose the legacyio.github.lukisch/n8n-manager-mcpname until their indexes refresh.Search context: best matched by
n8n MCP server,n8n workflow management MCP,AI assistant n8n workflows, andellmos-ai n8n-manager-mcp.
Target Personas & Discoverability
Persona | Core Needs | Pain Points Solved | Target Discovery Terms |
[PERSONA-01] Autonomous AI Agents & Swarms | Non-destructive workflow manipulation, pre-mutation snapshots, deterministic receipts | LLM hallucination breaking active production workflows; inability to inspect node connections offline |
|
[PERSONA-02] DevOps & Multi-Environment Engineers | Safe multi-server routing, export/import synchronization across stages | Manual JSON export friction; staging-to-production drift; unversioned workflow copies |
|
[PERSONA-03] SecOps, Compliance & Risk Teams | Monotonic read-only locks, local audit trail, zero external data leakage | Unregulated agent mutations; unvetted API calls; loss of forensic mutation history |
|
[PERSONA-04] Ecosystem Builders & Tool Integrators | Standardized MCP schemas, validated manifests, reliable TypeScript SDK seam | Schema mismatch across MCP directories; missing regression and contract test suites |
|
High-Intent Search Queries
n8n mcp server claude codeai assistant n8n workflow managementlocal-first n8n mcp stdiosafe n8n automated workflow mutationn8n multi-server workflow sync mcpn8n describe nodes offline catalogzero-egress n8n agent automationmodelcontextprotocol n8n typescript
Comparative Matrix & Alternatives
Dimension |
| Direct n8n REST API | Standard Agent Shell | Manual n8n Web UI | Generic Cloud SaaS |
Primary Interface | Native MCP Stdio (JSON-RPC) | Raw HTTP REST (Curl/Axios) | Ad-hoc CLI / Bash Scripts | Interactive Web Canvas | Proprietary Web Portal |
Safety Guardrails | Monotonic Read-Only Gate ( | None (Unchecked API execution) | Shell exit code heuristics | Human confirmation modals | Remote vendor RBAC |
Mutation Backups | Automated Pre-Mutation JSON Snapshots ( | None (Overwrites live instance) | None (Script dependent) | None (Live canvas modifications) | Vendor-dependent snapshots |
Rollback Facility | 1-Click | Manual JSON reconstruction via POST | Manual script rollback logic | Manual node rebuilding on canvas | Vendor rollback UI (Paywalled) |
Forensic Audit Log | Append-Only Structured | Generic webserver access logs | Ephemeral terminal stdout | Canvas execution logs only | Cloud vendor log retention |
Node Introspection | Built-in Offline Catalog ( | Manual online documentation | Guesswork & parameter trials | Visual palette browsing | Online API documentation |
Multi-Server Isolation | Isolated Stored Profiles ( | Manual token switching in scripts | Shell history token exposure | Multi-tab credential clutter | Cloud workspace switching |
Privacy & Zero-Egress | 100% Local Stdio Transport, Zero Telemetry | Direct HTTP client traffic | Local shell execution | Browser telemetry & analytics | Remote third-party hosting |
Workflow Migration | Built-in | Custom Python/Curl ETL scripts | Complex bash/jq pipelines | Download / Upload JSON dialog | Cloud enterprise paywall |
License & Audited Security | 100% Permissive MIT (Audited, 48h Security SLA) | Fair-Code (n8n source available) | Mixed / Ad-hoc licenses | Commercial / Fair-Code | Closed Proprietary SaaS |
Core Capabilities & Safety Invariants
Invariant ID | Capability / Invariant | Technical Guarantee | User Benefit |
| 100% Local-First & Zero-Egress | MCP Stdio transport; binds only to | Complete privacy; no workflow logic or credentials ever leave your host |
| Monotonic Read-Only Enforcement |
| Provable air-gapping against accidental workflow deletions or alterations |
| Automated Pre-Mutation Backups | Full workflow JSON snapshots stored under | Instant 1-click rollback via |
| Local Audit Trail | Append-only structured JSON log in | Complete forensic visibility over all agent actions and execution outcomes |
| Multi-Server & Isolated Credentials | Encrypted/isolated server configs in | Seamless cross-instance workflow migration between staging and production |
| Strict Input & Path Traversal Guard | Bounded numeric limits (1..1000), connection indices (0..1000), path escape rejection | Immune to directory traversal, prototype pollution, and malformed payload crashes |
| Non-Elevation & User-Space Security | Operates strictly as unprivileged user process | Zero root/administrator privilege requirements for local or CI execution |
| Opt-In Decision History Seam | Clean adapter to | Bridges human decision logs and versioning without corrupting standard MCP mode |
| Built-in Node Catalog & Introspection | Comprehensive offline catalog for triggers, actions, logic, transform, and AI nodes | LLMs formulate valid node connections without trial-and-error network calls |
| Multi-Node CI & 48h Security SLA | Automated GitHub Actions CI across Node.js 20, 22 with Concurrency cancellation; 48h response / 5d triage SLA | Guaranteed cross-platform stability, verified security responsiveness, and regression-free distribution |
Features
19 Tools for complete n8n workflow management
List, create, update, delete, and activate/deactivate workflows
Safety controls: read-only mode, backup-before-delete/update, local restore, and audit log
Multi-server support (connect to multiple n8n instances)
Export/Import workflows between servers
View execution history and status
Built-in node catalog with descriptions
Zero dependencies on Python -- connects directly to n8n REST API
Installation
Claude Desktop
Add to claude_desktop_config.json:
{
"mcpServers": {
"n8n-manager": {
"command": "npx",
"args": ["-y", "n8n-manager-mcp"]
}
}
}Claude Code
claude mcp add --scope user n8n-manager npx -y n8n-manager-mcpManual
npm install -g n8n-manager-mcp
Quick Start
After installation, use these commands in your AI assistant:
Add your n8n server:
"Add my n8n server at http://localhost:5678 with API key abc123"
List workflows:
"Show me all workflows on my n8n server"
Create a workflow:
"Create an n8n workflow that triggers on a webhook, fetches data from an API, and sends a Slack message"
Check executions:
"Show me the last 10 workflow executions"
Available Tools
Tool | Description |
| List all workflows on a server |
| Get workflow details (nodes, connections) |
| Create a new workflow from nodes + connections |
| Update an existing workflow |
| Delete a workflow |
| Activate or deactivate a workflow |
| List recent executions with status |
| Export workflow as importable JSON |
| Import workflow JSON onto a server |
| Show local safety settings, backup directory, and audit log path |
| Toggle read-only mode, backup-before-mutation, and audit logging |
| List local workflow backups created before mutations |
| Restore a workflow from a local backup |
| Add/update n8n server connection |
| List configured servers |
| Test server connection |
| Remove a server |
| Browse available n8n node types |
| Read version history, recorded decisions, and sync history from an optional n8n-workflow-manager (opt-in, read-only) |
Optional: n8n-workflow-manager seam
n8n itself keeps no record of why a workflow changed. The sibling project
n8n-workflow-manager does: it
stores versions, a mandatory decision per mutation, and a sync history in a local
database. n8n_manager_history makes that record readable from this MCP server.
The seam is opt-in and read-only:
Without
N8N_MCP_MANAGER_URL, nothing changes โ every tool talks to n8n directly, as before.With it set (for example
http://127.0.0.1:8100),n8n_manager_historyreads from the running manager. Omitworkflow_idto list the manager's workflows, pass it for full history.IDs are manager IDs, not n8n instance IDs. The manager stores that mapping but exposes no route to resolve it, so this server does not guess a translation.
If the manager is configured but unreachable, the tool fails with an explicit message instead of quietly answering from the n8n instance โ that store has no decision history, so a substituted answer would be a different answer.
n8n_safety_statusreports the measured state of the seam (configured, reachable, manager version), not just the environment variable.
Setup: pip install n8n-workflow-manager, then n8n-manager serve (binds 127.0.0.1:8100).
The manager API is unauthenticated and loopback-only by design; a non-loopback URL is
flagged in n8n_safety_status.
Numeric guardrails are part of the MCP schemas: workflow, execution, and
backup list limits are finite positive integers from 1 to 1000 (the existing
defaults remain 100, 20, and 20), and workflow connection from_output/
to_input indices are finite non-negative integers from 0 to 1000. Invalid
values are rejected before any n8n API, filesystem, or workflow-array access.
Configuration
Server connections and safety settings are stored in ~/.n8n-manager-mcp/servers.json.
Safety defaults:
backup_before_mutations: truesaves workflow JSON before update, delete, activate/deactivate, and overwrite-restore operations.audit_log: trueappends mutation outcomes to~/.n8n-manager-mcp/audit.log.read_only: falsecan be enabled withn8n_set_safety_modeorN8N_MANAGER_READ_ONLY=1. The environment flag is an enforcement ceiling: while it is enabled, persisted settings andn8n_set_safety_modecannot turn read-only mode off.Backups are stored under
~/.n8n-manager-mcp/backups/and can be listed/restored with the backup tools. Server/workflow names are reduced to safe single path segments; reserved names, separators, traversal, and symlink/reparse escapes cannot leave that root, and listing exposes only regular.jsonbackups.n8n_add_servervalidates server connection input before saving: URLs must behttporhttpsbase URLs without embedded credentials, query strings, or fragments, and API keys must not contain whitespace.n8n_add_serverdefault semantics are explicit: the first server becomes default; an update withoutis_defaultpreserves the existing flag;truepromotes the server;falseintentionally removes its flag, after which default lookup falls back to the first configured server.
Development
npm install
npm run build # One-time build
npm run dev # Watch mode
npm start # Start server
npm test # Run test suite (vitest)
npm run smoke # Start the built MCP server and verify tool discoveryTesting
The test suite covers URL building, server input validation, server management, safety settings, backup path handling, workflow JSON construction, export/import validation, i18n language packs, repository hygiene, and error handling. The manager seam is tested against a local stub HTTP server, including its refusal to fall back to a direct n8n query.
npm test # Run all tests
npx vitest run # Same as above
npx vitest --watch # Watch mode
npm run smoke # Manual stdio MCP smoke test (requires npm run build first)The current verification record covers Windows locally and Ubuntu Linux in GitHub Actions; GitHub Actions runs build, test, and npm package checks on Node.js 20, 22, and 24. The commit-specific local record is kept in CHANGELOG.md. The smoke runner starts dist/index.js through the MCP SDK client, verifies all 19 tool registrations, and calls the safe n8n_describe_nodes catalog tool without requiring n8n credentials.
Related
n8n-workflow-manager โ the state & history layer for humans (Web UI + REST API, Python): per-workflow change history and decision log, visual graph viewer, multi-server sync. Designed as a pair with this MCP server โ the MCP is the AI action layer (create/update/delete/activate), the manager is where you review, document, and roll back. Memory & context (roadmap): an MCP server alone can't guarantee an agent checks prior context before a destructive change โ that enforcement belongs in the manager (client-agnostic), with conversational context optionally from a pull-based history index like ctx (Apache-2.0). Planned: a shared history/decision store + a check-history-before-mutating guard.
n8n -- The workflow automation platform
License
MIT
ellmos-ai Ecosystem
This MCP server is part of the ellmos-ai ecosystem โ AI infrastructure, MCP servers, and intelligent tools.
MCP Server Family
Server | Tools | Focus | npm |
46 | Filesystem, process management, interactive sessions, cloud-lock-safe operations | ||
22 | Code analysis, JSON repair, imports, diffs, regex | ||
12 | File repair, format conversion, batch operations | ||
19 | n8n workflow management via AI assistants | ||
20 | MCP stack discovery, profile management, control plane | ||
45 | Local-first LLM memory, knowledge, state, routing, swarm orchestration |
| |
8 | Server operations: health checks, log analysis, deploy dry-runs, mail diagnostics |
| |
3 | Headless Blender asset QA and FBX reimport verification |
| |
10 | Model-agnostic computer use: capture, safety-gated actions, Windows UIA |
|
AI Infrastructure
Project | Description |
Local-first text-based OS for LLM agents โ 113+ handlers, 550+ tools, SQLite memory | |
Model-agnostic computer-use core powering Open Compute MCP | |
Provider-neutral LLM orchestration with auto-routing and budget tracking | |
Lightweight agent memory, connectors, and automation infrastructure | |
Self-hosted AI research stack (Ollama + n8n + Rinnsal + KnowledgeDigest) | |
Autonomous agent chain framework for Claude Code | |
Minimalist database-driven LLM OS prototype (4 functions, 1 table) | |
Testing framework for LLM operating systems (7 dimensions) |
Desktop Software & Sibling Tools
Our partner organization open-bricks and sister suites bundle AI-native desktop applications and developer utilities:
Repository | Org / Suite | Focus & Functionality |
| Advanced file and asset management workbench with duplicate detection | |
| Tabbed, filterable file manager with smart batch processing | |
| MSIX packaging and Windows Store release preparation | |
| Offline Markdown editor, live preview, and document structuring workbench | |
| Offline OCR pipeline converting scanned PDF documents to searchable PDFs | |
| Birthday/date password recovery tool for protected PDF archives | |
| Automated invoice extraction and email processing | |
| Lossless formatting and typography cleanup for technical markdown | |
| Fast, reliable agent bootstrap and environment check runner | |
| Central multi-host automation orchestrator and task monitor | |
| Unified developer workspace dashboard for local tool chains | |
| Sandboxed multi-language tool execution environment | |
| Automated multi-org repository maintenance and discoverability engine | |
| Distributed multi-agent swarming framework with stigmergic coordination | |
| Enterprise AI agent backend, hybrid RAG, and multi-tenant security | |
| Umbrella portal and catalog across all local-first AI software products |
Third-Party Licenses & Transparency
This project is licensed under the MIT License with attribution declared in NOTICE. To guarantee complete supply chain integrity and compliance in enterprise and autonomous agent environments, all dependencies are continuously audited:
Dependency | Type | Version | License | Verification Status |
Runtime (Direct) |
| MIT | Permissive / Audited | |
Runtime (Direct) |
| MIT | Permissive / Audited | |
Runtime (Direct) |
| BSD-2-Clause | Permissive / Audited | |
| Dev / Compiler |
| Apache-2.0 | Permissive / Audited |
| Dev / Test Runner |
| MIT | Permissive / Audited |
| Dev / Type Definitions |
| MIT | Permissive / Audited |
Zero Copyleft / AGPL: Contains no viral copyleft or unreviewed commercial dependencies.
Zero External Telemetry: Emits no network beacons, analytics payloads, or external phone-home pings.
Detailed Open-Source Inventory: Complete attribution notices, license texts, and transitive dependency analyses are available in
THIRD_PARTY_LICENSES.md.
Marketing & Personas Log
For marketing positioning, target persona definitions, governance invariant mappings, and the 3-phase discoverability roadmap, see MARKETING-LOG.txt.
Changelog
See CHANGELOG.md for detailed version history, release notes, and past migration milestones.
Haftung / Liability
Dieses Projekt ist eine unentgeltliche Open-Source-Schenkung im Sinne der ยงยง 516 ff. BGB. Die Haftung des Urhebers ist gemรคร ยง 521 BGB auf Vorsatz und grobe Fahrlรคssigkeit beschrรคnkt. Ergรคnzend gilt der Haftungsausschluss der MIT-Lizenz.
Nutzung auf eigenes Risiko. Keine Wartungszusage, keine Verfรผgbarkeitsgarantie, keine Gewรคhr fรผr Fehlerfreiheit oder Eignung fรผr einen bestimmten Zweck.
This project is an unpaid open-source donation under the MIT License. Liability is limited to intent and gross negligence (ยง 521 German Civil Code). Use at your own risk. No warranty, no maintenance guarantee, no fitness-for-purpose assumed.
Available Tools
19 toolsn8n_activate_workflowB
Activate or deactivate an n8n workflow.
| Name | Required | Description | Default |
|---|---|---|---|
| active | Yes | true to activate, false to deactivate | |
| server_name | No | Server name. Uses default if omitted. | |
| workflow_id | Yes | n8n workflow ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description bears full responsibility. It only states the action (activate/deactivate) without disclosing side effects (e.g., stopping executions on deactivation), authentication needs, or rate limits. The behavior beyond the verb is opaque.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that efficiently conveys the core purpose. Every word is meaningful, but it could be slightly expanded without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (3 params, no output schema), the description lacks context about the effect on workflow state (e.g., active runs triggers; deactivated pauses) and dependencies (workflow must exist). An agent might not know to validate the workflow ID or handle server_name defaults.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with each parameter already documented (e.g., 'true to activate, false to deactivate'). The description adds no extra meaning beyond what the schema provides, earning a baseline score of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Activate or deactivate an n8n workflow,' specifying the verb (activate/deactivate) and the resource (n8n workflow). This distinguishes the tool from siblings like n8n_create_workflow, n8n_delete_workflow, and n8n_set_safety_mode, which handle other operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives (e.g., n8n_update_workflow, n8n_restore_workflow). There is no mention of prerequisites such as requiring the workflow to exist or being already active/deactive, nor any exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
n8n_add_serverB
Add or update an n8n server connection. The API key can be created in n8n under Settings > API.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | n8n server URL (e.g. 'http://localhost:5678') | |
| name | Yes | Server name (e.g. 'production', 'staging') | |
| api_key | Yes | n8n API key (from Settings > API in n8n) | |
| is_default | No | Optional default policy: omitted preserves an existing server's flag; true promotes this server; false explicitly removes its default flag. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the transparency burden. It does disclose that the tool mutates state by adding or updating a server connection and mentions an auth prerequisite. However, it does not explain update semantics, idempotency, or what happens to existing server flags or connections.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: the core purpose appears in the first sentence, and the supporting API-key note is short. It is slightly redundant with the api_key schema description, but it remains efficient and readable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The definition is minimally viable for basic invocation: the purpose is clear and required parameters are fully described in the schema. However, it lacks detail on update behavior, expected return/confirmation, and comparison with server-management siblings, and there is no output schema to compensate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all four parameters. The description only duplicates the api_key creation note and adds no meaningful semantic value beyond what the input schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb-resource pair: 'Add or update an n8n server connection.' This clearly distinguishes the tool from siblings like n8n_list_servers, n8n_remove_server, and n8n_ping_server because the action and resource are unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to use this tool instead of alternatives such as n8n_list_servers or n8n_remove_server. The description implies its use case through the verb 'add or update,' but never states exclusions, alternatives, or prerequisites beyond API-key creation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
n8n_create_workflowC
Create a new n8n workflow. Provide the full workflow JSON including nodes and connections.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Workflow name | |
| nodes | Yes | Array of workflow nodes | |
| activate | No | Activate workflow after creation | |
| connections | No | Array of connections between nodes | |
| server_name | No | Server name. Uses default if omitted. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations, so the description carries the burden of disclosing side effects. It only says 'Create' and does not mention duplicate handling, activation behavior, server selection, or reversibility. The schema's activate default is not reflected in the prose, and no return behavior is described.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single short sentence with no filler, and it front-loads the core action. The second phrase about 'full workflow JSON' is somewhat redundant given the schema, but the overall structure is clean and scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations and no output schema, the description is thin: it omits expected return value, duplicate-name behavior, and relationship to import/update siblings. The detailed schema mitigates parameter confusion but cannot fully compensate for missing behavioral and usage context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all five parameters. The prose adds only a general hint that nodes and connections are needed for a complete workflow, which is mildly helpful but does not substantially extend what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear action and resource: 'Create a new n8n workflow.' It is specific and unambiguous about the core operation. However, it does not distinguish itself from sibling n8n_import_workflow, which also creates workflows via import, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to use this tool versus alternatives such as n8n_import_workflow or n8n_update_workflow. The description only states what the tool does, leaving the agent to infer which workflow-creation path is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
n8n_delete_workflowA
Delete a workflow from an n8n server. By default, a JSON backup is saved before deletion.
| Name | Required | Description | Default |
|---|---|---|---|
| server_name | No | Server name. Uses default if omitted. | |
| workflow_id | Yes | n8n workflow ID to delete |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of disclosing destructive behavior. It clearly says 'Delete' and adds the important context that a JSON backup is saved by default. However, it does not mention permanence, required permissions, or what happens after deletion.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with no filler. The primary action is stated first, and the backup behavior is added succinctly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter delete operation, the description gives essential information: what is deleted and the default safety backup. It does not describe the response or possible errors, but those are not critical for invoking the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already describes both parameters fully (100% coverage). The description adds no extra meaning about workflow_id or server_name, so it meets the baseline but provides no additional value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Delete') and resource ('workflow from an n8n server'), which is unambiguous. The added backup detail also helps distinguish this destructive operation from related siblings like n8n_restore_workflow and n8n_list_backups.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance about when to use this tool versus alternatives such as deactivating a workflow or exporting it. The backup note implies a safety benefit, but it does not explicitly state when deletion is appropriate or when another sibling should be used instead.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
n8n_describe_nodesB
Get information about common n8n node types. Useful for understanding which nodes to use when building workflows.
| Name | Required | Description | Default |
|---|---|---|---|
| category | No | Filter by category | all |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description must disclose behavioral traits. It does not mention that the tool is read-only, safe, or any other behavioral aspects, leaving the agent to infer safety from the verb 'describe'.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, with two sentences that are both informative and free of unnecessary text. It front-loads the main action and purpose effectively.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple lookup tool with one optional parameter and no output schema, the description sufficiently explains the tool's function and usefulness. It could be slightly more specific about the output, but is adequate overall.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema fully documents the single parameter with a description. The tool description does not add any further meaning beyond what the schema already provides, so it meets the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool gets information about common n8n node types, using a specific verb and resource. It implicitly distinguishes from sibling tools that focus on workflows, servers, etc., but the term 'common' is somewhat vague.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides context ('useful for understanding which nodes to use') but does not give explicit guidance on when to use it versus alternatives, nor does it specify when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
n8n_export_workflowA
Export a workflow from an n8n server as JSON. Returns the complete workflow definition that can be imported into another n8n instance.
| Name | Required | Description | Default |
|---|---|---|---|
| server_name | No | Server name. Uses default if omitted. | |
| workflow_id | Yes | n8n workflow ID to export |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It mentions returning a complete workflow definition but does not disclose whether the operation is read-only, requires specific permissions, or any side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the action and output. No redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with 2 parameters and no output schema, the description is mostly complete. It covers the return value and purpose. Missing details like error conditions or prerequisites, but adequate for the complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions. The description adds value by noting that 'server_name' uses default if omitted, which is not in the schema. However, it doesn't elaborate on format or constraints beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Export'), the resource ('workflow'), and the output format ('JSON'). It distinguishes from siblings like n8n_get_workflow by emphasizing the complete definition for import.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implied usage: exporting for backup or migration. No explicit guidance on when to use vs. alternatives like n8n_get_workflow or conditions for use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
n8n_get_workflowA
Get detailed information about a specific n8n workflow including all nodes, connections, and settings.
| Name | Required | Description | Default |
|---|---|---|---|
| server_name | No | Server name. Uses default if omitted. | |
| workflow_id | Yes | n8n workflow ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It clearly indicates a read-only operation ('Get detailed information') and adds context about what is returned, but does not discuss side effects, auth requirements, or error conditions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, efficient, front-loaded verb+resource. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple get tool, the description covers the main points and return content. It lacks some detail (e.g., error handling) but is sufficient for selection among siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the description does not add extra meaning beyond the schema. It references the resource generally but does not elaborate on the parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get detailed information' and the resource 'a specific n8n workflow', specifying the included content (nodes, connections, settings). This distinguishes it from siblings like n8n_list_workflows and n8n_update_workflow.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use when detailed information on a specific workflow is needed, but does not explicitly state when not to use or mention alternative tools for listing or modifying workflows.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
n8n_import_workflowB
Import a workflow JSON onto an n8n server. Takes a full n8n workflow JSON and creates it on the server.
| Name | Required | Description | Default |
|---|---|---|---|
| activate | No | Activate after import | |
| server_name | No | Target server name. Uses default if omitted. | |
| workflow_json | Yes | Complete n8n workflow JSON as string |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations , the description must disclose behavioral traits. It only states the tool 'creates' a workflow but does not specify idempotency, overwrite behavior, required permissions, or side effects. This is insufficient for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise at two sentences, front-loading the action and resource. No superfluous words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the basic action but lacks context like relationship to sibling tools (e.g., import vs. create vs. restore) and requirements (e.g., server must exist). Minimal completeness given tool complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents all three parameters. The description adds no extra meaning beyond 'full n8n workflow JSON,' which is already clear from the schema. Baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool imports a workflow JSON onto an n8n server and creates it, implying uploading an exported file. This distinguishes it from other creation tools like n8n_create_workflow, but it does not explicitly name siblings or contrast them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives (e.g., n8n_create_workflow for step-by-step creation, n8n_restore_workflow for recovery). No prerequisites or exclusions are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
n8n_list_backupsA
List local workflow backups created before n8n mutations.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum backups to show (integer 1-1000). | |
| server_name | No | Optional server name filter. | |
| workflow_id | No | Optional workflow ID filter. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the disclosure burden. 'List' clearly signals a read-only operation, and 'backups created before n8n mutations' provides useful context about what is being read. However, it does not disclose return format, whether local means filesystem vs database, or any operational caveats.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no filler. It states the verb and resource immediately and includes a meaningful qualifier without wasting words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With only three optional, fully documented parameters and no nested objects, the tool is simple enough that this description is nearly complete. A small gap is the absence of any mention of the response shape, but 'list' reasonably implies a list of backup entries.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema coverage is 100%, and each parameter has a clear description. The tool description itself adds no additional parameter semantics, which is acceptable because the schema already fully documents what each parameter means.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List'), a clear resource ('local workflow backups'), and a defining condition ('created before n8n mutations'). This makes the tool's purpose immediately clear and distinguishes it from sibling tools like n8n_list_workflows or n8n_list_executions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'created before n8n mutations' implies the tool is relevant in a backup/safety workflow, but there is no explicit guidance about when to prefer this over alternatives like n8n_restore_workflow or n8n_safety_status. Usage context is implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
n8n_list_executionsA
List recent workflow executions on an n8n server. Shows status, timing, and errors.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max results (integer 1-1000) | |
| status | No | Filter by status | |
| server_name | No | Server name. Uses default if omitted. | |
| workflow_id | No | Filter by workflow ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It discloses that the tool returns status, timing, and error information, and the verb 'List' implies a read-only operation. However, it does not mention whether this is purely read-only, whether server_name resolution has side effects, or how it handles missing/invalid filters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one tight, front-loaded sentence that states the core action and the key output dimensions. Every word earns its place with no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple listing tool with four optional parameters fully described in the schema, the description provides enough context about the returned data (status, timing, errors). It could mention that results are ordered by recency or that the limit default applies, but those details are inferable from the description and schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter already has a clear meaning in the schema. The description adds no parameter-specific detail beyond what the schema provides, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('List'), resource ('workflow executions'), and scope ('on an n8n server'). It clearly distinguishes this from siblings like n8n_list_workflows, which list workflow definitions rather than execution history.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes the use case clear: retrieving recent execution records, including their status, timing, and errors. It does not explicitly name alternatives or exclusions, but the resource distinction from siblings is evident enough, and no conflicting alternative is obvious.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
n8n_list_serversA
List all configured n8n server connections.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavior. It states a read-only listing operation, but does not mention any authentication needs, rate limits, or output format. For a simple list, this is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that immediately conveys the action and scope. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is complete for a simple list operation, but does not specify the return format (e.g., array of server details). Given no output schema, more detail would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, so schema coverage is trivially 100%. The description adds no parameter info, but none is needed. Baseline for 0 parameters is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'List' and resource 'all configured n8n server connections', clearly distinguishing it from sibling tools like n8n_add_server or n8n_remove_server which modify individual servers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when one needs an overview of server connections, but provides no explicit guidance on when not to use it or comparisons to alternatives. Context from sibling names suggests it is complementary to other server-related tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
n8n_list_workflowsA
List all workflows on an n8n server. Returns workflow names, IDs, active status, and node counts.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max number of workflows to return (integer 1-1000) | |
| server_name | No | Server name from config. Uses default if omitted. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of disclosing behavior. It does reveal the returned fields, but it claims to list 'all' workflows while the input schema caps results at 1000 with a default of 100, and no pagination behavior is mentioned. This makes the description misleading about the actual tool behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences with the action front-loaded and the return payload summarized immediately. There is no filler, redundancy, or unnecessary boilerplate.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only list tool, the essential purpose and return fields are present, and the schema covers both parameters. However, the 'all' claim conflicts with the limit parameter, and the absence of an output schema or pagination details leaves a material gap for agents that need a truly complete workflow set.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both `limit` and `server_name` are already documented in the input schema. The description adds no extra semantic detail about these parameters, which matches the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and resource ('workflows') with a clear scope ('on an n8n server'), and lists the key returned fields. This distinguishes it from sibling tools like n8n_get_workflow or n8n_list_executions, though the word 'all' is slightly overstated given the limit parameter.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this tool is for enumerating workflows, but it does not explicitly state when to use it over alternatives like n8n_get_workflow, n8n_list_executions, or n8n_export_workflow. No when/when-not guidance or exclusions are provided, so the agent must infer usage from the sibling tool names and context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
n8n_manager_historyA
Read version history, recorded decisions, and sync history from a running n8n-workflow-manager. Requires the N8N_MCP_MANAGER_URL environment variable; without it, this MCP talks to n8n directly and no such history exists. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max entries per history section (1-500). | |
| workflow_id | No | Manager workflow ID (NOT the n8n instance ID). Omit to list the known workflows. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure, and it handles this well by explicitly stating 'Read-only' and explaining the critical failure mode when the environment variable is missing, including the consequence of talking to n8n directly. It could go further by describing response shape or pagination, but the two most operationally important behaviors are disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, all front-loaded with purpose first, then the critical precondition and failure mode, then the safety statement. Every sentence earns its place with distinct information and there is zero wasted text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only, 2-parameter tool with fully self-documenting parameters, the description covers purpose, safety, and the key operational gotcha (environment variable). The main gap is the absence of an output schema combined with no description of the return structure, though naming the three content sections partially compensates by letting an agent infer the response shape.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%; both parameters are already well-documented in the schema (limit range of 1-500, workflow_id disambiguation from n8n instance ID, and the omit-to-list behavior). The description adds only marginal context by naming the three history sections ('version history, recorded decisions, and sync history'), which loosely maps to what 'per history section' means, so the baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Read') and a specific resource ('version history, recorded decisions, and sync history') from a 'running n8n-workflow-manager', which clearly distinguishes this tool from all siblings, none of which target manager history. The manager-vs-direct-n8n distinction further disambiguates it from tools like n8n_list_executions and n8n_list_backups.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides an explicit precondition ('Requires the N8N_MCP_MANAGER_URL environment variable') and a clear when-not-to-use condition ('without it, this MCP talks to n8n directly and no such history exists'). This tells an agent when the tool will fail or return nothing. However, it does not name specific sibling alternatives for obtaining history from a direct n8n connection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
n8n_ping_serverB
Test the connection to an n8n server.
| Name | Required | Description | Default |
|---|---|---|---|
| server_name | No | Server name. Uses default if omitted. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, and the description does not disclose behavioral traits such as what the test does (e.g., ping, latency check), side effects, or return format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, efficient, but could be expanded slightly to add value without being verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema is provided, and the description does not explain what the tool returns (e.g., success/failure, response time). For a simple test tool, some return or behavior detail is expected.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single optional parameter; the description adds no further meaning beyond the schema's 'Server name. Uses default if omitted.'
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Test' and the resource 'connection to an n8n server', distinguishing it from sibling tools like n8n_list_workflows.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this is used to check connectivity, but provides no guidance on when to use vs. alternatives or when not to use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
n8n_remove_serverB
Remove an n8n server from the configuration.
| Name | Required | Description | Default |
|---|---|---|---|
| server_name | Yes | Name of the server to remove |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. The description implies destructive action but does not disclose side effects, reversibility, or dependencies (e.g., does removal affect workflows?). For a deletion tool, this is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no wasted words. Appropriately sized for a simple tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one param and no output schema, the description is technically complete but fails to provide necessary context for a destructive operation, such as confirmation steps or impact on associated resources.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with one parameter. The description adds no extra meaning beyond the schema's 'Name of the server to remove,' so baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Remove an n8n server from the configuration' uses a specific verb (remove) and resource (server), clearly distinguishing it from sibling tools like n8n_add_server or n8n_list_servers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives, no prerequisites or exclusions provided. The description only states the action without context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
n8n_restore_workflowA
Restore a workflow from a local backup. By default creates a new workflow; pass target_workflow_id to overwrite an existing workflow.
| Name | Required | Description | Default |
|---|---|---|---|
| activate | No | Activate restored workflow after restore. | |
| backup_path | Yes | Path returned by n8n_list_backups or mutation output. | |
| server_name | No | Target server name. Uses default if omitted. | |
| target_workflow_id | No | Existing workflow ID to overwrite. If omitted, creates a new workflow. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral disclosure burden. It does reveal the key mutating behavior: creating by default and overwriting an existing workflow when target_workflow_id is provided. However, it omits the irreversibility of overwrite, any return value, activation side effects, or what happens to the backup file, leaving only partial transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no wasted words: the first states the core operation and the second captures the essential behavioral distinction. The key information is front-loaded and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutating tool with no annotations and no output schema, the description covers the central create-vs-overwrite decision and references how to obtain a valid backup_path. However, it does not explain expected outcomes, error conditions, or the consequences of overwriting an existing workflow, so an agent has to infer some critical execution context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All four parameters are fully described in the input schema, so the baseline is 3. The description reiterates the role of target_workflow_id but adds no new meaning beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Restore a workflow from a local backup') with a clear resource and source. It further distinguishes the two operating modes (create new vs overwrite via target_workflow_id), which sets it apart from siblings like create_workflow, import_workflow, or update_workflow.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives internal branching guidance (default creates, target_workflow_id overwrites) but does not explain when to choose this tool instead of n8n_import_workflow, n8n_create_workflow, or n8n_update_workflow. No alternatives or disqualifying conditions are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
n8n_safety_statusA
Show n8n Manager safety settings, backup directory, audit log location, and whether the optional n8n-workflow-manager seam is configured and reachable.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: 'Show' communicates non-mutating behavior, and it further discloses that the tool checks whether the optional n8n-workflow-manager seam is configured and reachable. It also states exactly what data will be returned, so an agent can expect a safe inspection call.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that names the resource first and then lists the specific scopes covered. There is no repetition, filler, or unnecessary information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter status tool with no output schema, the description is complete: it identifies the operation, the resource, and every category of information the tool reports. An agent has enough to invoke it correctly and understand what it will return.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema is empty, with zero parameters, so there is no parameter ambiguity to resolve. The 0-parameter baseline applies, and the description adds no parameter details because none are needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the verb 'Show' with a specific resource and enumerates the exact content: safety settings, backup directory, audit log location, and seam status. This clearly differentiates it from mutating siblings like n8n_set_safety_mode and from history/backup-listing tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for a read-only status inspection: use it when you need the current safety settings, backup directory, audit log location, or seam reachability status. It does not explicitly name alternatives or exclusions, but the 'Show' framing contrasts naturally with the mutating n8n_set_safety_mode sibling.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
n8n_set_safety_modeB
Configure local safety settings: read-only mode, backup-before-mutation, and audit logging.
| Name | Required | Description | Default |
|---|---|---|---|
| audit_log | No | When true, appends mutation outcomes to ~/.n8n-manager-mcp/audit.log. | |
| read_only | No | When true, blocks create/update/delete/activate/import/restore operations. | |
| backup_before_mutations | No | When true, exports workflows before update/delete/activate/restore. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure, but it only restates the setting names. It does not mention side effects such as read_only blocking operations across tools, backup_before_mutations triggering exports, or audit_log appending to a file. Some of this appears in parameter descriptions, but the main description adds no behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single well-structured sentence with a colon-led list that front-loads the tool's purpose. Every word earns its place and there is no filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity tool with three optional booleans and full schema descriptions, the description plus schema is largely sufficient. The only notable gap is that the description does not state whether the settings persist or apply globally to all subsequent tool calls, but the parameter descriptions compensate for most practical ambiguity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and each boolean parameter already has a meaningful description explaining its effect, so the baseline is 3. The description merely lists the parameter topics without adding default values, interactions, or invocation-level detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Configure') and a clear resource ('local safety settings'), and enumerates the three settings: read-only mode, backup-before-mutation, and audit logging. The tool name also distinguishes it from the sibling n8n_safety_status, though the description does not explicitly contrast them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided about when to use this tool versus n8n_safety_status or other siblings. There are no prerequisites, exclusions, or conditions such as 'use this before running mutations' or 'check n8n_safety_status to view current settings'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
n8n_update_workflowC
Update an existing n8n workflow. Send the full updated workflow JSON.
| Name | Required | Description | Default |
|---|---|---|---|
| server_name | No | Server name. Uses default if omitted. | |
| workflow_id | Yes | n8n workflow ID to update | |
| workflow_json | Yes | Full workflow JSON as string |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully disclose behavior. 'Update' indicates mutation, and 'Send the full updated workflow JSON' suggests a full replacement (PUT-like) operation. However, it does not disclose authentication requirements, idempotency, error handling, or side effects like version increments. Lacks depth for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no redundancy: first sentence states purpose, second adds a critical usage constraint. Every word earns its place. Neither too short to be vague nor too long.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, so the description should explain the return value (e.g., updated workflow object, confirmation message). It also omits behavioral details like whether the update merges or replaces fields. Given complexity of an update operation, more context is needed for complete understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for all 3 parameters, providing clear descriptions. The description adds the constraint 'full updated workflow JSON', which reinforces the schema's description of workflow_json but does not add new semantic meaning beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states 'Update an existing n8n workflow' with specific verb and resource. Distinguishes from create, delete, and activate tools among siblings. The phrase 'Send the full updated workflow JSON' reinforces the nature of the update (full replacement), though it could be more explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs siblings like n8n_create_workflow or n8n_activate_workflow. No prerequisites mentioned (e.g., workflow must exist, need to retrieve current version first). Usage is implied but not explicitly stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
9 tool updates
v0.1.17- Changed
n8n_add_server2 fields changed- removed
Input schema / properties / is_default / defaultRemoved value: -false - changed
Input schema / properties / is_default / descriptionPrevious value: -"Set as default server"New value: +"Optional default policy: omitted preserves an existing server's flag; true promotes this server; false explicitly removes its default flag."
- Changed
n8n_create_workflow7 fields changed- added
Input schema / properties / connections / items / properties / from_output / descriptionAdded value: +"Source output index (integer 0-1000)" - added
Input schema / properties / connections / items / properties / from_output / maximumAdded value: +1000 - added
Input schema / properties / connections / items / properties / from_output / minimumAdded value: +0 - changed
Input schema / properties / connections / items / properties / from_output / typePrevious value: -"number"New value: +"integer" - added
Input schema / properties / connections / items / properties / to_input / $refAdded value: +"#/properties/connections/items/properties/from_output" - added
Input schema / properties / connections / items / properties / to_input / descriptionAdded value: +"Target input index (integer 0-1000)" - removed
Input schema / properties / connections / items / properties / to_input / typeRemoved value: -"number"
- Added
n8n_list_backups - Changed
n8n_list_executions4 fields changed- changed
Input schema / properties / limit / descriptionPrevious value: -"Max results"New value: +"Max results (integer 1-1000)" - added
Input schema / properties / limit / maximumAdded value: +1000 - added
Input schema / properties / limit / minimumAdded value: +1 - changed
Input schema / properties / limit / typePrevious value: -"number"New value: +"integer"
- Changed
n8n_list_workflows4 fields changed- changed
Input schema / properties / limit / descriptionPrevious value: -"Max number of workflows to return"New value: +"Max number of workflows to return (integer 1-1000)" - added
Input schema / properties / limit / maximumAdded value: +1000 - added
Input schema / properties / limit / minimumAdded value: +1 - changed
Input schema / properties / limit / typePrevious value: -"number"New value: +"integer"
- Added
n8n_manager_history - Added
n8n_restore_workflow - Added
n8n_safety_status - Added
n8n_set_safety_mode
14 tool updates
v0.1.6- First observed
n8n_activate_workflow - First observed
n8n_add_server - First observed
n8n_create_workflow - First observed
n8n_delete_workflow - First observed
n8n_describe_nodes - First observed
n8n_export_workflow - First observed
n8n_get_workflow - First observed
n8n_import_workflow - First observed
n8n_list_executions - First observed
n8n_list_servers - First observed
n8n_list_workflows - First observed
n8n_ping_server - First observed
n8n_remove_server - First observed
n8n_update_workflow
TDQS
Scored across 19 tools
Most tools are clearly separated by resource and action, but n8n_create_workflow and n8n_import_workflow are nearly identical in intent, and n8n_get_workflow vs n8n_export_workflow could easily be confused. The safety/manager tools are distinct but add a few overlapping informational surfaces.
The n8n_ prefix and snake_case are consistent, and most tools follow a clear verb_noun pattern (list_workflows, activate_workflow, add_server). Minor deviations like n8n_safety_status and n8n_manager_history use noun phrases instead of get/list verbs, but they do not create real ambiguity.
19 tools is on the heavy side (16-25 range), but the count is largely justified by the distinct subdomains: workflow CRUD, server management, backups, safety, and executions. It could be tighter by merging create/import and get/export, but the scope is coherent.
Workflow lifecycle, server connections, backups, and safety are well covered. Obvious gaps are minor: only list executions (no get/stop execution detail) and no backup deletion/rotation, but the core workflow-management surface is complete.
Maintenance
Related MCP Connectors
Open-source Zapier/n8n alternative as an MCP server: agents build, run and debug your workflows.
MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.
MCP server that lets AI assistants use all OneSchema features exposed via the public API.
Nifty's MCP server โ exposes tasks, projects, messages, and files as tools for AI agents.
Related MCP Servers
- AlicenseAqualityDmaintenance๐ช MCP server for programmatic creation and management of n8n workflows. Enables AI assistants to build, modify, and manage workflows without direct user intervention through a comprehensive set of tools and resources for interacting with n8n's REST API.1012 npm86MIT
- AlicenseNot gradedqualityDmaintenanceAn MCP server that provides AI assistants with access to documentation, schemas, and operations for over 535 n8n workflow automation nodes. It enables models to understand, create, and manage n8n workflows through natural language by connecting to the n8n API.46,471 npmMIT
- AlicenseNot gradedqualityDmaintenanceMCP server for n8n workflow automation, enabling management of workflows, executions, credentials, tags, users, and webhooks via an MCP-compatible client.MIT
- AlicenseNot gradedqualityDmaintenanceMCP server for integrating with n8n, enabling workflow automation and management through natural language.221 npm1MIT