MCP server · Audited from source
N8n MCP server
by czlonkowski/n8n-mcpMIT licenceAudited 20 Sep 2026 · source 38edc3a55958
npm n8n-mcp-ui-apps 1.0.0ssestdiostreamable-http★ 22,949
Is it safe? No — BLOCK, grade F (29/100). It exposes 57 tools: 47 read, 7 write and 3 destructive. The audit recorded 76 findings (0 critical, 8 high, 31 medium, 35 low). Maintainer's description: A MCP for Claude Desktop / Claude Code / Windsurf / Cursor to build n8n workflows for you
Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
Cite
Cite this page
ModelsAtlas. “N8n MCP server (czlonkowski/n8n-mcp)”. Retrieved 20 Sep 2026. https://modelsatlas.com/mcp/czlonkowski/n8n-9
Why this is BLOCK. The audit found 0 critical and 8 high findings; the most severe is Code injection at scripts/test-code-node-enhancements.ts:78. Each finding is listed below with its file and line.
Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.
3 MCP servers are called N8n. You are viewing czlonkowski/n8n-mcp. Compare all 3 →
- leonardsellem/n8n-mcp-server★ 1,633✓SAFE
- illuminaresolutions/n8n-mcp-server★ 119✓SAFE
- czlonkowski/n8n-mcp★ 22,949✕BLOCK
Trust audit
Audit 0.4.1 · full source read 20 Sep 2026
Trust score29/100✕BLOCK F
0 critical8 high31 medium35 low2 info
76 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.
What the source does
- FilesystemDeclared9 observations
- NetworkDeclared11 observations
- ShellDeclared10 observations
- DependenciesNot pinnedSome ranges float
- SecretsFoundSee the findings
Findings (76)
Sorted by severity · the 25 most severe of 76 are listed
HIGHCode injectioncode.eval_exec · scripts/test-code-node-enhancements.ts:78
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
jsCode: 'const result = eval(item.json.code);\nreturn [{json: {result}}];'- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · src/database/database-adapter.ts:11
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
exec(sql: string): void;
- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · src/database/database-adapter.ts:199
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
exec(sql: string): void {- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · src/database/database-adapter.ts:278
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
exec(sql: string): void {- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · src/services/config-validator.ts:628
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
if (language !== 'python' && (code?.includes('eval(') || code?.includes('exec('))) {- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
HIGHNetwork egressnet.metadata_ip · src/utils/ssrf-protection.ts:60
F-04 Network egressCWE-200 · CWE-319Layer L1
'169.254.169.254', // AWS/Azure metadata
- Why
- cloud metadata endpoint: the classic SSRF credential grab
- Fix
- —
HIGHPrompt injectionprompt.credential_read · data/skills/n8n-expression-syntax/SKILL.md:72
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
Access environment variables:
- Why
- asks the agent to read credentials
- Fix
- —
HIGHPrompt injectionprompt.credential_read · data/skills/n8n-multi-instance/SKILL.md:163
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
1. switch → A; read the source (n8n_manage_credentials get / n8n_get_workflow)
- Why
- asks the agent to read credentials
- Fix
- —
MEDIUMInventory / provenanceinv.binary · data/nodes.db-shm
F-13 Inventory / provenanceCWE-1104Layer L0
nodes.db-shm
- Why
- a compiled or binary member cannot be reviewed from source
- Fix
- ship source, or explain the binary in the README
MEDIUMInformation disclosuredisclose.log_secret · src/scripts/sanitize-templates.ts:76
F-12 Information disclosureCWE-209 · CWE-532Layer L1
console.log(` - Found: ${token.substring(0, 20)}...`);- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMInformation disclosuredisclose.log_secret · src/utils/template-sanitizer.ts:49
F-12 Information disclosureCWE-209 · CWE-532Layer L1
logger.info(`Added problematic token to sanitizer: ${token.substring(0, 10)}...`);- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · Dockerfile:125
F-04 Network egressCWE-200 · CWE-319Layer L1
CMD sh -c 'curl -f http://127.0.0.1:${PORT:-3000}/health || exit 1'- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · Dockerfile.railway:105
F-04 Network egressCWE-200 · CWE-319Layer L1
CMD curl -f http://127.0.0.1:${PORT:-3000}/health || exit 1- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.anthropic · tests/unit/services/credential-scanner.test.ts:133
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.aws · tests/unit/services/credential-scanner.test.ts:67
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.aws · tests/unit/services/credential-scanner.test.ts:268
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.aws · tests/unit/services/credential-scanner.test.ts:511
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.aws · tests/unit/services/credential-scanner.test.ts:525
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.db_uri · tests/unit/telemetry/workflow-sanitizer.test.ts:1309
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · tests/unit/flexible-instance-security-advanced.test.ts:233
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · tests/unit/services/credential-scanner.test.ts:55
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · tests/unit/services/credential-scanner.test.ts:61
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · tests/unit/services/credential-scanner.test.ts:73
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · tests/unit/services/credential-scanner.test.ts:93
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.github · tests/unit/services/credential-scanner.test.ts:73
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
Tools it exposes
57 declared in source · 3 destructive
47 read7 write3 destructive
3 tools can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one, so give it a token scoped to what you need.
| Tool | What it does | Risk |
|---|---|---|
n8n_delete_workflow | Permanently delete a workflow. This action cannot be undone. | destructive |
n8n_executions | Manage workflow executions: get details, list, or delete. Use action= | destructive |
n8n_manage_credentials | Manage n8n credentials. Actions: list, get, create, update, delete, getSchema. Use getSchema to discover required fields before creating. For list, page beyond 100 results with cursor (from the previous response\ | destructive |
n8n_autofix_workflow | Automatically fix common workflow validation errors. Preview fixes or apply them. Fixes expression format, typeVersion, error output config, webhook paths, connection structure issues (numeric keys, invalid types, ID-to-name, duplicates, out-of-bounds indices). | write |
n8n_create_workflow | Create workflow. Requires: name, nodes[], connections{}. Created inactive. Returns workflow with ID. | write |
n8n_deploy_template | Deploy a workflow template from n8n.io directly to your n8n instance. Deploys first, then auto-fixes common issues (expression format, typeVersions). Returns workflow ID, required credentials, and fixes applied. | write |
n8n_get_workflow | Get workflow by ID with different detail levels. n8n has a draft/publish model: the workflow body holds the draft (latest edits); use mode= | write |
n8n_test_workflow | Run a workflow. method=auto (default) triggers it over HTTP through its webhook/form/chat trigger. Workflows without such a trigger need n8n | write |
n8n_update_full_workflow | Full workflow update. Requires complete nodes[] and connections{}. For incremental use n8n_update_partial_workflow. | write |
tools_documentation | Get documentation for n8n MCP tools. Call without parameters for quick start guide. Use topic parameter to get documentation for specific tools. Use depth= | write |
Empty | Empty node | read |
IF | Route items | read |
OpenAI | OpenAI integration | read |
Slack | Consume Slack API | read |
Test | Test node | read |
Webhook | Starts workflow on webhook call | read |
body | Issue description | read |
calculate_shipping | Calculate shipping cost based on weight (kg) and distance (km) | read |
city | City name | read |
data_analyst | Data analysis expert | read |
echo | Echo skill | read |
field1 | Primary description | read |
get_ai_agent_node | Extract AI Agent node source | read |
get_function_node | Extract Function node source | read |
get_node | Get node info with progressive detail levels and multiple modes. Detail: minimal (~200 tokens), standard (~1-2K, default), full (~3-8K). Modes: info (default), docs (markdown documentation), search_properties (find properties), versions/compare/breaking/migrations (version info). Use format= | read |
get_node_essentials | Essentials | read |
get_node_info | Get info | read |
get_template | Get template by ID. Use mode to control response size: nodes_only (minimal), structure (nodes+connections), full (complete workflow). | read |
get_webhook_node | Extract Webhook node source | read |
host_failing_tool | Always fails | read |
host_list_instances | List n8n instances | read |
host_mutable_tool | original description | read |
host_switch_instance | Switch active n8n instance | read |
host_typed_tool | Has a typed input schema | read |
list_ai_nodes | List AI/LangChain nodes | read |
list_available_nodes | List all available n8n nodes | read |
n8n_audit_instance | Security audit of n8n instance. Combines n8n | read |
n8n_explore_node_resources | Resolve the real options behind a node\ | read |
n8n_health_check | Check n8n instance health and API connectivity. Use mode= | read |
n8n_list_catalog | List instance-level catalog entries: projects (with the personal project marked, needed as projectId for agents and data tables) or tags. Reads the Public API first; when team projects are not licensed there, falls back to n8n\ | read |
n8n_list_workflows | List workflows (minimal metadata only). Returns id/name/active/dates/tags. Check hasMore/nextCursor for pagination. | read |
n8n_manage_agents | Manage n8n Agents (persisted assistants with a model, instructions, tools, skills, tasks, memory and channels) through n8n | read |
n8n_manage_datatable | Manage n8n data tables, rows and columns. Actions: createTable, listTables, getTable, updateTable, deleteTable, getRows, insertRows, updateRows, upsertRows, deleteRows, addColumn, deleteColumn, renameColumn. The column actions run through n8n | read |
n8n_manage_folders | Manage workflow folders (n8n 2.19+; folders need a registered Community instance or higher). Actions: create, list, get, rename, move, delete. projectId defaults to | read |
n8n_probe_tool | Synthetic tool used by the policy tests | read |
n8n_validate_workflow | Validate workflow by ID. Checks nodes, connections, expressions. Returns errors/warnings/suggestions. | read |
owner | Repository owner username | read |
repo | Repository name | read |
research_agent | Deep research specialist | read |
research_specialist | Expert researcher that searches multiple sources and synthesizes information. Use for detailed research tasks. | read |
search_nodes | Search n8n nodes by keyword with optional real-world examples. Pass query as string. Example: query= | read |
search_templates | Search templates with multiple modes. Use searchMode= | read |
title | Issue title | read |
validate_node | Validate n8n node configuration. Use mode= | read |
validate_workflow | Full workflow validation: structure, connections, expressions, AI tools. Returns errors/warnings/fixes. Essential before deploy. | read |
writer_agent | Content writing specialist | read |
wrongName | User identifier | read |
Safer alternatives
Glif✓SAFE
glifxyz/glif-mcp-server
Deprecated — use the hosted Glif MCP server at https://glif.app/mcp
Grade B
N8n Workflow Builder✓SAFE
ifmelate/n8n-workflow-builder-mcp
MCP server that allow LLM in agent mode builds n8n workflows for you
4 destructiveGrade B
specstream-tools✓SAFE
Specstreamai/specstream-tools
Finished lists from the live web for your agent, every row with its source, priced before anything runs. MCP setup, plugins, skills, SDKs, n8n node and GitHub Action for SpecStream.
Grade B
Audit history
- ✕BLOCK F 29 / 100
Source changed, verdict held ·
38edc3a55958
README badge
Badges show the current verdict, BLOCK included
A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.
Questions about N8n MCP server
What is the N8n MCP server?
A MCP for Claude Desktop / Claude Code / Windsurf / Cursor to build n8n workflows for you
What tools does N8n expose?
57 in total: 47 read-only, 7 that write, and 3 that can delete or overwrite (n8n_delete_workflow, n8n_executions, n8n_manage_credentials). Every one is listed on this page with its risk.
Is N8n safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (29/100) and found 8 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 3 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does N8n need?
It reads AUTH_RATE_LIMIT_MAX, AUTH_RATE_LIMIT_WINDOW, AUTH_TOKEN, AUTH_TOKEN_FILE, DATABASE_PASSWORD, MCP_AUTH_TOKEN, N8N_API_KEY, N8N_MCP_ACCESS_TOKEN, N8N_MCP_LLM_API_KEY, OPENAI_API_KEY, SECRET_API_KEY and SUPABASE_ANON_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does N8n run?
It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as n8n-mcp-ui-apps at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (38edc3a55958), read on 2026-09-20. The repository is watched and re-audited when it changes.
Which N8n MCP server is the right one?
leonardsellem/n8n-mcp-server. 3 servers share the name; see the side-by-side comparison.
I already installed N8n. What should I do?
Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.
Can the verdict change?
Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.
Sources
- czlonkowski/n8n-mcp on GitHub — the source we read, its licence, stars and activityObserved · 20 Sep 2026
- ModelsAtlas trust audit — BLOCK verdict for commit 38edc3a55958Observed · 20 Sep 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What is the N8n MCP server?
- What tools does N8n expose?
- Is N8n safe to connect to an agent?