n8n-MCP

The 72/100 score is weighted around the job that matters most: letting an AI agent construct and modify working n8n automation without creating unacceptable operational risk.

Feature breadth therefore does not automatically improve the verdict. Workflow correctness, credential containment, safe failure reporting, context efficiency and security boundaries matter more than the number of exposed tools.

n8n-MCP is a community Model Context Protocol server that gives AI clients structured knowledge about n8n nodes and, when n8n API credentials are configured, direct tools for creating, inspecting, validating, editing, executing and administering n8n workflows.

The server has two operating layers. The first is a local knowledge layer for node search, node definitions, validation and template discovery. The second is a management layer that uses N8N_API_URL and N8N_API_KEY to act on a real n8n instance.

Those two layers have different risk profiles. Documentation-only use does not need n8n credentials. Management use can affect live workflows, executions, credentials and data.

The community czlonkowski/n8n-mcp project is not the same product as n8n's official instance-level MCP server. Both connect AI clients with n8n, but they expose different capability surfaces and trust boundaries.

The community project's remaining differentiation is deeper node intelligence, dedicated validation, template discovery, resource resolution and precise incremental workflow editing. The official MCP reduces the need to run another privileged third-party component when those deeper capabilities are unnecessary.

The phrase n8n MCP can describe two opposite connection directions. The community n8n-mcp package is an MCP server. n8n itself can also act as an MCP client through dedicated client nodes.

n8n also provides an MCP Server Trigger for exposing a workflow-defined tool surface. That is related to, but distinct from, the community n8n-MCP server and the official instance-level MCP server.

n8n-MCP combines n8n knowledge tools with a large management surface. It can research nodes, inspect schemas, find templates, validate configurations, create workflows, edit workflows, execute tests, inspect failures, manage versions, administer credentials and data tables, and audit an n8n instance.

The tool count is not completely fixed across documentation and deployment modes. The evaluated README documented 7 core knowledge tools plus 16 n8n management tools, while newer HTTP deployment documentation described configurations exposing up to 28 total tools.

The safest client-facing wording is therefore 23 documented in the evaluated main README; up to 28 in newer configured deployments.

n8n-MCP sits between an AI client and n8n. The server supplies local node knowledge, exposes MCP tools to the AI client, and uses configured n8n credentials when a tool must inspect or change a real instance.

Documentation-only operation can stay on the local knowledge path. Management operations contact the configured n8n instance using N8N_API_URL and N8N_API_KEY. HTTP deployments add a separate MCP authentication token.

n8n-MCP receives the effective permissions of the credentials configured for its n8n connection. A broadly privileged API key can allow an AI agent to create, replace, partially edit, delete, execute and repair workflows while also exposing management operations for executions, credentials, tables and versions.

That creates a large blast radius when the server is attached to production credentials.

How to reduce the blast radius

• use a dedicated n8n API key;
• disable tools that are not required;
• disable specific destructive operations;
• remove credential-management tools unless explicitly needed;
• prefer read-only or limited-write deployments for production;
• test destructive operations only against disposable data.

n8n-MCP has useful hardening controls, but MCPVerdict assigns Scan Grade C because the server legitimately handles credentials and can perform high-impact writes. Production safety depends on current versions, constrained credentials, disabled destructive tools, protected HTTP transport and deliberate telemetry settings.

The project publishes a security policy and hardening guidance. That is a positive signal. It does not erase the importance of its recent security history.

The correct interpretation is:

Historically serious security record ≠ current release proven vulnerable.

It does mean update discipline and permission containment are part of the product's operating model.

Anonymous telemetry is enabled by default unless explicitly disabled. The project's privacy documentation says sanitized data is used for feature usage analysis, error analysis, product improvement, development prioritization and workflow-generation ML training, with telemetry stored through Supabase.

Disable it with:

N8N_MCP_TELEMETRY_DISABLED=true

A reviewed May 2026 security advisory found that earlier versions could retain fragments from URL-shaped workflow values before telemetry transmission. That issue was patched in version 2.51.3.

Current 2026-07-28 MCP conformance is not proven. The evaluated repository used @modelcontextprotocol/sdk 1.28.0, while later development showed ongoing stateless-transport and conformance work.

An August 2026 issue still reported a protocol requirement violation even against an older specification target. MCPVerdict therefore classifies the status as Unknown / Transitional rather than Adopted.

n8n-MCP can consume substantial model context because there are two different costs: the initial tool-schema surface and the data returned during workflow construction.

1. Tool-schema cost

For a broadly enabled deployment exposing roughly 23–28 tools, the evaluation estimates approximately 8,000–15,000 input tokens of schema overhead. This is an estimate, not a universal measured count.

2. Tool-result cost

Results from node retrieval, templates, complete workflows, executions and validators can add thousands to tens of thousands of tokens during a serious workflow build.

3. Partial updates help

The project's diff-based editing avoids repeatedly sending complete workflow JSON. Publisher documentation claims 80–90% token reduction for incremental edits versus full workflow replacement.

The MCP package itself is free. Real cost comes from model usage, n8n hosting or plan costs, server infrastructure, workflow executions and the APIs called by those workflows.

A realistic evaluation budget for a moderately complex workflow is approximately 60K input + 20K output tokens. That is an evaluation estimate, not a measured universal session size.

Those figures describe model inference, not the price of installing n8n-MCP. Subscription products may express practical cost through plan quotas rather than a direct charge per MCP call.

Hidden costs

• n8n Cloud plan or self-hosted infrastructure;
• Docker/Node hosting for persistent remote MCP deployment;
• third-party APIs called by workflows;
• security hardening and maintenance;
• context consumed during long workflow-debugging sessions;
• human review when validators or writes behave unexpectedly.

n8n-MCP can run locally through npm or as a persistent remote server through Docker/HTTP. Documentation-only operation needs no n8n credentials. Workflow management requires the n8n instance URL and API key.

Local stdio

npx n8n-mcp

Global npm install

npm install -g n8n-mcp

Enable n8n management

N8N_API_URL=https://your-n8n-instance.com
N8N_API_KEY=your-n8n-api-key

HTTP server URL

A local HTTP deployment commonly exposes:

http://localhost:3000/mcp

A remote deployment exposes the same /mcp path under its configured host and should be protected with HTTPS and MCP authentication.

Verify before granting broad write access

1. Connect with documentation-only or restricted tools first.
2. Confirm node search and validation work.
3. Attach a disposable n8n instance.
4. Create and validate one simple workflow.
5. Test a targeted partial update.
6. Only then consider production credentials or broader management tools.

Yes. n8n-MCP supports local npm execution, Docker and persistent HTTP deployment. Self-hosting gives the operator control over transport, authentication and network placement, but it does not remove the credential and permission risks of management access.

A public HTTP deployment adds its own operational requirements: HTTPS, proxy configuration, secret storage, rate limiting, network policy and careful client authentication.

For sensitive use, a local stdio deployment against a disposable or tightly permissioned n8n instance is the simplest place to start.

n8n-MCP is designed for MCP-compatible clients using stdio or HTTP. The evaluated profile includes Claude Desktop, Claude Code, Cursor, Windsurf, Codex and similar agentic clients.

Client support and model support are separate. The MCP client manages the connection; the language model handles reasoning and tool selection.

The n8n API exposes programmatic n8n operations; n8n-MCP packages those operations for AI agents and adds node knowledge, schema retrieval, validation, templates and workflow-editing semantics.

Use the API when deterministic application logic is more important than agent autonomy. Use n8n-MCP when the AI agent itself must discover nodes, construct workflows and iteratively repair them.

Run n8n-MCP locally through stdio, disable telemetry, use a disposable n8n instance and expose only the workflow read/create/update tools needed for the evaluation.

Run the same five workflows against community n8n-MCP and n8n's official MCP. Measure:

• first-attempt workflow correctness;
• number of repair turns;
• total input/output tokens;
• node and schema lookups required;
• quality of validation errors;
• precision of partial edits;
• permissions required to finish the task.

The result tells you much more than simply asking whether n8n-MCP “works.”

The evaluated evidence corpus includes recent user comparisons, reproducible GitHub issues, reviewed security advisories and current maintenance activity.

Evidence confidence: Strong. Overall verdict confidence: Moderate because no controlled live A/B benchmark was run.