n8n-MCP

Quick Verdict

n8n-MCP here means the community project maintained by czlonkowski, not the official MCP capability built into n8n. This review is based on v2.65.1, released under the MIT license. The server turns n8n node documentation, properties, operations, templates, examples, and validation rules into tools an MCP client can call. When an operator also supplies N8N_API_URL and N8N_API_KEY, its scope expands from reference material into real instance management: it can create, read, update, delete, validate, and test workflows.

That combination is useful for people who repeatedly ask an AI coding agent to design n8n automations. The agent can look up a node schema and validate configuration instead of guessing from model memory. It is not, however, permission to edit production by prompt. A broad API key plus write tools can overwrite connections, permanently delete workflows, trigger live webhooks, or expose credential and data-table surfaces. The safe default is documentation and validation only, followed by a separate development instance, human diff review, backups, and an explicitly controlled production promotion process.

Best For

• n8n workflow builders who want an agent to select nodes, fill parameters, connect branches, and check expressions with product-specific context.
• Automation teams establishing a repeatable template-search, validation, review, test, and deployment process.
• Heavy MCP users already working in Claude Code, Cursor, or GitHub Copilot.
• Self-hosting teams able to operate the service, rotate API keys, restrict tool exposure, and audit calls.
• Not ideal for organizations without a test n8n instance, export backups, permission controls, or a human owner for production workflows.

Key Features

• Node discovery and reference data: Search core and community nodes, retrieve properties and operations, inspect versions, and obtain documentation or real configuration examples.
• Template discovery: Search workflow templates by keyword, task, node type, service, complexity, or intended audience before building from scratch.
• Layered validation: Check required node fields, complete runtime configuration, workflow connections, expressions, and deployed workflows. Passing these checks catches structural problems, not every business error.
• Workflow writes: With n8n API access, create workflows, replace a complete workflow, or submit partial update operations. This is powerful and materially changes the server’s risk profile.
• Destructive administration: List and retrieve workflows, permanently delete workflows, trigger tests, inspect or delete executions, and manage workflow versions depending on enabled tools and operations.
• Credential and data-table surface: The tool set includes credential and data-table management. Read access alone can expose sensitive material, so these tools deserve an explicit deny decision.
• Multiple deployments: Run locally over stdio, self-host an HTTP endpoint, or use the project’s managed dashboard. Each option has a different cost, data boundary, authentication model, and maintenance burden.

Use Cases

A strong workflow starts with a concrete requirement such as: receive a form submission, normalize selected fields, write an approved record, and send a notification only after the write succeeds. The agent can search templates first, identify the required nodes, inspect their schemas, build explicit configurations, and run node and workflow validation. For an existing automation, it can retrieve a structural or minimal view and propose a small diff instead of replacing unrelated workflow state.

The same process helps with upgrades and debugging. An operator can compare node versions, inspect required values, validate expressions, and deploy only to a development instance. High-impact actions should remain separate. A single natural-language instruction should not design a payment or messaging workflow, update production, and trigger it in one uninterrupted tool chain. Use different permissions and approvals for authoring, deployment, and execution, especially where nodes send customer messages, charge accounts, delete records, or write to external systems.

Pricing

The community source is MIT-licensed and can be deployed with npx, Docker, or another supported self-hosted setup without a software license fee. The project’s managed dashboard offers a free allowance and may charge for higher usage or managed capacity, so this directory classifies n8n-MCP as freemium. Self-hosting is not cost-free: compute, logs, authentication, upgrades, backups, and the underlying n8n plan remain the operator’s responsibility.

The version verified for this page on 2026-07-21 is v2.65.1. Pin a specific version in production rather than leaving a client on latest. Review the changelog and repeat workflow tests before upgrading. n8n Community, Cloud, and Enterprise pricing is separate from the community MCP server, and the MIT license does not create a warranty or an official n8n support commitment.

Pros

• Combines n8n node knowledge, template search, examples, and validation in one MCP interface.
• Lets an agent query current schemas before writing configuration, reducing errors caused by stale model memory.
• Supports a low-risk reference-only setup as well as explicitly enabled instance management.
• MIT licensing permits code review, self-hosting, modification, and policy-specific tool restrictions.
• Documents a read-only deployment pattern and warns users not to let AI edit production workflows directly.
• Integrates with several coding clients, allowing workflow JSON and related project files to stay in an existing development environment.

Cons

• It is a czlonkowski community project, not an official n8n component or an official security guarantee.
• Write and delete tools have real side effects. A bad parameter, prompt injection, or overprivileged API key can affect live workflows and connected systems.
• Credential management remains sensitive even when limited to reads; disabling only write operations does not create an adequate boundary.
• Node catalogs, community packages, and n8n releases keep changing, so coverage figures and examples cannot guarantee every configuration is current or correct.
• Structural validation cannot prove business logic, idempotency, legal compliance, secret handling, capacity, or rollback readiness.
• Running it over HTTP adds authentication, encryption, logging, rate-limiting, and exposure-management work that local stdio avoids.

Alternatives

FAQ

Is n8n-MCP an official n8n project?

No. This page covers the community server maintained by czlonkowski. n8n’s official built-in MCP capability is part of the n8n product. They have different maintainers, tool scopes, support channels, and trust boundaries, even though both names contain n8n and MCP.

What do v2.65.1 and the MIT license tell me?

v2.65.1 is the release verified for this review on 2026-07-21. MIT permits use, modification, and redistribution subject to its terms, but it does not promise correctness, fitness for production, continuing maintenance, or compensation for operational damage.

Can n8n-MCP change or delete workflows?

Yes, when the n8n API is configured and the relevant tools are enabled. It supports creation, full and partial updates, and permanent deletion. Use a development instance, minimum permissions, export backups, tool restrictions, and human approval before any production change.

Can it access n8n credentials?

Its tool surface includes credential management. In governance-sensitive deployments, disable the credential tool entirely because read operations can still expose sensitive data. Never paste secret values into prompts, workflow JSON, or ordinary logs.

How is it different from the official built-in n8n MCP?

The community project emphasizes detailed node knowledge, template discovery, validation, and optional n8n API administration. The official capability belongs to n8n itself and focuses on the workflows n8n exposes through its supported MCP experience. Evaluate the exact tools and permissions rather than treating them as interchangeable.

Should I let it maintain production workflows automatically?

No. Copy or export the workflow, generate and validate changes in development, review the diff, test failure paths, and promote through a controlled process. Payment, notification, deletion, credential, and external-write nodes need additional approval and a tested rollback plan.

Bottom Line

n8n-MCP v2.65.1 is valuable because it gives an MCP client queryable, testable n8n knowledge and, when deliberately configured, an instance-management layer. That makes workflow authoring more grounded than asking a general model to invent node parameters. It does not turn generated automation into trusted production automation. Start with documentation, templates, and validation; pin releases; keep the server away from production credentials; and test against an isolated n8n instance. Open write access only after minimum-permission keys, disabled destructive tools, backups, human review, logging, and deployment approval are in place. If the requirement is only to expose or run published workflows, compare n8n’s official built-in MCP first so the two distinct products are not confused.