What it is
n8n-MCP, by Romuald Członkowski, gives AI assistants structured knowledge of the n8n workflow automation platform. It ships a pre-built database covering 3,143 n8n nodes (841 core and 2,302 community), their properties and documentation, plus 2,352 workflow templates. It is not made by n8n. The repo has about 23,100 GitHub stars and version 2.96.1 was released on 22 October 2026.
Seven core tools search nodes and templates and validate node configs and whole workflows without touching any n8n instance. Add an n8n API URL and key and 21 management tools appear: create, update, delete and autofix workflows, run tests, and manage executions, folders, data tables and credentials. Several newer tools also call n8n's own instance-level MCP server through a separate access token.
Run it locally with npx n8n-mcp (stdio), with Docker, or use the author's hosted service at dashboard.n8n-mcp.com: free for 100 tool calls a day, or €19 a month on the Supporter plan with a fair-use cap of 5,000 calls a day.
Install
npx n8n-mcpOur review
n8n-MCP earns its place through its reference data, not its write access. Models routinely invent n8n parameters or lean on defaults that fail at runtime. Having the exact properties of 3,143 nodes, 2,352 templates to copy from and a validator that checks connections and expressions removes much of that trial and error. The documentation-only mode touches no n8n instance at all, which makes it the sensible place to start.
Add an API key and the stakes change. The model can then delete workflows, overwrite them wholesale, run them, and create, read or delete credentials. The README's own advice is never to let AI edit production workflows, and it publishes a read-only recipe: DISABLED_TOOLS to remove whole tools, DISABLED_TOOL_OPERATIONS to block destructive verbs inside bundled tools, and a read-only n8n key underneath. The recipe has traps the author spells out, such as four of the five n8n_test_workflow methods actually running the workflow.
The security record is long for a community server. GitHub lists 15 advisories since May 2026: one critical (cross-tenant access to workflow backups in the multi-tenant HTTP mode), six high, including an authenticated SSRF and a path traversal, and three more published on 18 October 2026. They were disclosed and fixed in the open, which counts in its favour, but anyone running the shared HTTP mode should pin versions and read each one. Telemetry is on by default and, under the privacy policy effective 28 September 2026, collects sanitised workflow structures and the free-text intent of edits to train workflow-generation models; one of the October advisories concerned free-text fields that slipped past that sanitising.
n8n's built-in MCP server can now create and edit workflows itself, with no extra process and no third party. n8n-MCP's case against it is breadth of reference material and a multi-level validator; its cost is a second codebase with write access and a telemetry pipeline to manage. The two are built to coexist: several of n8n-MCP's newer tools work by calling n8n's instance-level server.
Where it earns its place
An automation engineer maintaining a self-hosted n8n instance for a finance team
Draft new workflows from a plain description and catch bad node configs before import
Run npx n8n-mcp with no API key; the agent calls search_nodes, get_node and validate_workflow, then hands back workflow JSON to import by hand. Nothing in the instance can change, telemetry can be switched off, and the only cost is model tokens.
A platform team letting developers request automations from Claude Code
Build and test workflows in a staging n8n instance, never production
Give it a staging API key, keep n8n_create_workflow, n8n_update_partial_workflow and n8n_test_workflow, and use DISABLED_TOOLS to remove n8n_delete_workflow and n8n_manage_credentials. n8n-MCP snapshots a workflow before each change, so n8n_workflow_versions can roll back a bad edit.
An operations manager at a small agency on n8n Cloud
Get AI help building workflows without running a server
The hosted service is free for 100 tool calls a day; the recommended flow calls several tools per node (search, configure, validate), so regular builders move to the €19-a-month Supporter plan. The hosted service holds your n8n API key, which puts a second party in the path of your automations.
Before you commit
- Setup
- npx n8n-mcp runs it over stdio; a Docker image (ghcr.io/czlonkowski/n8n-mcp) and an HTTP mode cover shared deployments. Guides cover Claude Code, Claude Desktop, Cursor and Windsurf, and docs-only mode needs no keys, so the first tool call takes minutes.
- Integrations
- 28 tools: 7 read-only documentation and validation tools, and 21 management tools that appear once N8N_API_URL and N8N_API_KEY are set, covering create, full and partial update, delete, test runs, executions, folders, data tables and credentials. Agent management, node resource discovery and native version history also need an N8N_MCP_ACCESS_TOKEN for n8n's instance-level server.
- Data and privacy
- The n8n key gives the model whatever that key can do, including reading and deleting credentials, so pair a read-only key with DISABLED_TOOLS. Telemetry goes to telemetry.n8n-mcp.com on Azure in Germany West Central: raw events and change records are kept 7 days, the anonymised workflow dataset indefinitely; disable it with npx n8n-mcp telemetry disable or N8N_MCP_TELEMETRY_DISABLED=true.
- Cost at scale
- Self-hosting is free beyond the machine it runs on. The hosted service is free up to 100 tool calls a day, then €19 a month for unlimited calls under a 5,000-a-day fair-use cap; paid limits above that are by arrangement. n8n_test_workflow runs real executions with real side effects.
- Limits
- 28 tool definitions are a sizeable context load; DISABLED_TOOLS trims context as well as risk. Several tools need recent n8n releases (folders 2.19+, evaluations 2.30+, agents 2.34+), and the multi-tenant HTTP mode is where most past advisories landed.
What's good
- Reference data for 3,143 nodes and 2,352 templates
- Validates nodes and whole workflows before anything reaches n8n
- Documentation-only mode needs no n8n credentials
- Per-tool and per-operation switches for a read-only deployment
What's not
- Telemetry on by default, including sanitised workflow structures
- 15 security advisories since May 2026, one critical
- Management tools can delete workflows and read credentials
- Single-maintainer community project, not from n8n
Best for
n8n builders who want an AI assistant to draft and validate workflows with accurate node configuration.
Alternatives
n8n-MCP: common questions
- Is n8n-MCP worth it?
- It gives a model the n8n knowledge it otherwise invents; run it read-only with telemetry off until you have read its 15 security advisories. We rate it 4.1 out of 5.
- How much does n8n-MCP cost?
- Free and open source (MIT) to self-host. Hosted: free for 100 tool calls a day; Supporter €19/month for unlimited calls under a 5,000-a-day fair-use cap.
- What are the downsides of n8n-MCP?
- Telemetry on by default, including sanitised workflow structures; 15 security advisories since May 2026, one critical; management tools can delete workflows and read credentials; single-maintainer community project, not from n8n.
- Who is n8n-MCP best for?
- n8n builders who want an AI assistant to draft and validate workflows with accurate node configuration.
- How much does n8n-MCP cost for a team or in production?
- Self-hosting is free beyond the machine it runs on. The hosted service is free up to 100 tool calls a day, then €19 a month for unlimited calls under a 5,000-a-day fair-use cap; paid limits above that are by arrangement. n8n_test_workflow runs real executions with real side effects.
- Is n8n-MCP safe for company data?
- The n8n key gives the model whatever that key can do, including reading and deleting credentials, so pair a read-only key with DISABLED_TOOLS. Telemetry goes to telemetry.n8n-mcp.com on Azure in Germany West Central: raw events and change records are kept 7 days, the anonymised workflow dataset indefinitely; disable it with npx n8n-mcp telemetry disable or N8N_MCP_TELEMETRY_DISABLED=true.
- What are the best n8n-MCP alternatives?
- The closest alternatives we have reviewed are n8n Instance-level MCP and Zapier MCP.
Answers checked Oct 23, 2026.
Make n8n-MCP? Show this rating on your site
