// SCAN REPORT

N8n

8 tools. 4 can modify or destroy data without limits.

4 write tools that can modify data. Rate limits recommended.

Last updated: 3 Jul 2026

4 can modify or destroy data

4 read-only

8 tools total

Community server · catalogue entry verified 03/07/2026

How to control N8n ↓

TOOL MAP

What N8n exposes to your agents

Read (4) Write / Execute (4) Destructive / Financial (0)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

High Risk

The most dangerous N8n tools

Write · High create_workflow This tool creates new workflows, which are reversible data modifications. Write · High edit_workflow The tool modifies workflow definitions (a core system component), which could have significant downstream effects if an agent maliciously edits critical workflows to alter their behavior, add malicious steps, or disrupt Write · Medium load_workflows_to_postgres This tool writes/inserts workflow metadata into a PostgreSQL database. Write · Medium vectorize_workflows This tool reads existing workflows and writes/stores vector embeddings into a database (likely PostgreSQL based on sibling tools).

4 of N8n's 8 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control N8n

PolicyLayer is an MCP gateway — it sits between your AI agents and N8n, and nothing reaches the server without passing your rules. These are the rules we recommend:

Rate limit write operations

{
  "create_workflow": {
    "limits": [
      {
        "counter": "create_workflow_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "get_workflow": {
    "limits": [
      {
        "counter": "get_workflow_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register N8n — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON N8N →

Instant setup, no code required.

FULL CATALOGUE

All 8 N8n tools

WRITE 4 tools

Write create_workflow Create a new workflow in n8n. Write edit_workflow Edit an existing workflow in n8n. Write load_workflows_to_postgres Load workflow metadata into the PostgreSQL database for production use. Write vectorize_workflows Generate and store vector embeddings for all workflows to be used for context search.

READ 4 tools

Read get_workflow Get a specific workflow by ID. Read list_workflows List all workflows from n8n. Read search_similar_workflows Search for similar workflows based on a query. Read validate_workflow Validate a workflow against best practices.

FAQ

Questions about N8n

How do I prevent bulk modifications through N8n? +

The N8n server has 4 write tools including create_workflow, edit_workflow, load_workflows_to_postgres. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach N8n.

How many tools does the N8n MCP server expose? +

8 tools across 2 categories: Read, Write. 4 are read-only. 4 can modify, create, or delete data.

How do I enforce a policy on N8n? +

Register the N8n MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every N8n tool call.

Deterministic rules across all 8 N8n tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON N8N →

Instant setup, no code required.

8 N8n tools catalogued and risk-classified — across an index of 43,000+ MCP servers.