// SCAN REPORT

n8n-MCP

22 tools. 11 can modify or destroy data without limits.

4 destructive tools with no built-in limits. Policy required.

Last updated: 3 Jul 2026

11 can modify or destroy data

11 read-only

22 tools total

Community server · catalogue entry verified 03/07/2026

How to control n8n-MCP ↓

TOOL MAP

What n8n-MCP exposes to your agents

Read (11) Write / Execute (7) Destructive / Financial (4)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous n8n-MCP tools

Destructive · Critical n8n_delete_workflow This tool permanently and irreversibly deletes workflows with no undo mechanism. Destructive · High n8n_executions Because the tool spans multiple categories (Read for get/list, Destructive for delete), the most severe applicable category applies. Destructive · High n8n_workflow_versions Although the tool also provides read operations (list, get) and a reversible rollback function, the destructive modes (delete, truncate, prune) that permanently remove workflow versions dominate the risk profile. Destructive · Critical n8n_manage_datatable The tool spans multiple categories but must be classified at the most severe applicable level.

11 of n8n-MCP's 22 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control n8n-MCP

PolicyLayer is an MCP gateway — it sits between your AI agents and n8n-MCP, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "n8n_delete_workflow": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "n8n_autofix_workflow": {
    "limits": [
      {
        "counter": "n8n_autofix_workflow_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "get_node": {
    "limits": [
      {
        "counter": "get_node_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register n8n-MCP — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON N8N-MCP →

Instant setup, no code required.

FULL CATALOGUE

All 22 n8n-MCP tools

DESTRUCTIVE 4 tools

Destructive n8n_delete_workflow Permanently delete a workflow. This action cannot be undone. Destructive n8n_executions Manage workflow executions: get details, list, or delete. Use action= Destructive n8n_manage_datatable Manage n8n data tables and rows. Actions: createTable, listTables, getTable, updateTable, deleteTable, getRows Destructive n8n_workflow_versions Manage workflow version history, rollback, and cleanup. Six modes: - list: Show version history for a workflow

EXECUTE 1 tools

Execute n8n_test_workflow Test/trigger workflow execution. Auto-detects trigger type (webhook/form/chat). Supports: webhook (HTTP), form

WRITE 6 tools

Write n8n_autofix_workflow Automatically fix common workflow validation errors. Preview fixes or apply them. Fixes expression format, typ Write n8n_create_workflow Create workflow. Requires: name, nodes[], connections{}. Created inactive. Returns workflow with ID. Write n8n_deploy_template Deploy a workflow template from n8n.io directly to your n8n instance. Deploys first, then auto-fixes common is Write n8n_generate_workflow Generate an n8n workflow from a natural language description using AI. Write n8n_manage_credentials Manage n8n credentials. Actions: list, get, create, update, delete, getSchema. Use getSchema to discover requi Write n8n_update_full_workflow Full workflow update. Requires complete nodes[] and connections{}. For incremental use n8n_update_partial_work

READ 11 tools

Read get_node Get node info with progressive detail levels and multiple modes. Detail: minimal (~200 tokens), standard (~1-2 Read get_template Get template by ID. Use mode to control response size: nodes_only (minimal), structure (nodes+connections), fu Read n8n_audit_instance Security audit of n8n instance. Combines n8n Read n8n_get_workflow Get workflow by ID with different detail levels. Use mode= Read n8n_health_check Check n8n instance health and API connectivity. Use mode= Read n8n_list_workflows List workflows (minimal metadata only). Returns id/name/active/dates/tags. Check hasMore/nextCursor for pagina Read n8n_validate_workflow Validate workflow by ID. Checks nodes, connections, expressions. Returns errors/warnings/suggestions. Read search_nodes Search n8n nodes by keyword with optional real-world examples. Pass query as string. Example: query= Read search_templates Search templates with multiple modes. Use searchMode= Read tools_documentation Get documentation for n8n MCP tools. Call without parameters for quick start guide. Use topic parameter to get Read validate_workflow Full workflow validation: structure, connections, expressions, AI tools. Returns errors/warnings/fixes. Essent

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about n8n-MCP

Can an AI agent delete data through the n8n- MCP server? +

Yes. The n8n-MCP server exposes 4 destructive tools including n8n_delete_workflow, n8n_executions, n8n_manage_datatable. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through n8n-MCP? +

The n8n-MCP server has 6 write tools including n8n_autofix_workflow, n8n_create_workflow, n8n_deploy_template. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach n8n-MCP.

How many tools does the n8n- MCP server expose? +

22 tools across 4 categories: Destructive, Execute, Read, Write. 11 are read-only. 11 can modify, create, or delete data.

How do I enforce a policy on n8n-MCP? +

Register the n8n- MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every n8n-MCP tool call.

Deterministic rules across all 22 n8n-MCP tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON N8N-MCP →

Instant setup, no code required.

22 n8n-MCP tools catalogued and risk-classified — across an index of 43,000+ MCP servers.