// SCAN REPORT

n8n MCP Server

39 tools. 24 can modify or destroy data without limits.

6 destructive tools with no built-in limits. Policy required.

Last updated: 2 Jul 2026

24 can modify or destroy data

15 read-only

39 tools total

Community server · catalogue entry verified 02/07/2026

How to control n8n MCP Server ↓

TOOL MAP

What n8n MCP Server exposes to your agents

Read (15) Write / Execute (18) Destructive / Financial (6)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous n8n MCP Server tools

Destructive · High n8n_delete_credential This tool irreversibly deletes data (a credential) and causes cascading failures in dependent workflows. Destructive · High n8n_delete_execution This tool performs a permanent, irreversible deletion of execution records and associated data. Destructive · High n8n_delete_tag Deleting a tag is a destructive action that cannot be undone. Destructive · High n8n_delete_variable Deleting a variable is an irreversible action that destroys data and causes cascading effects (workflows will malfunction with undefined references).

24 of n8n MCP Server's 39 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control n8n MCP Server

PolicyLayer is an MCP gateway — it sits between your AI agents and n8n MCP Server, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "n8n_delete_credential": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "n8n_archive_workflow": {
    "limits": [
      {
        "counter": "n8n_archive_workflow_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "n8n_discover": {
    "limits": [
      {
        "counter": "n8n_discover_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register n8n MCP Server — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON N8N →

Instant setup, no code required.

FULL CATALOGUE

All 39 n8n MCP Server tools

DESTRUCTIVE 6 tools

Destructive n8n_delete_credential Permanently delete a credential. Workflows using it will break. Args: - id (string): Credential ID to delet Destructive n8n_delete_execution Permanently delete a specific execution and its data. Args: - id (string): Execution ID to delete Destructive n8n_delete_tag Delete a tag. Removes it from all workflows that use it. Args: - id (string): Tag ID to delete Destructive n8n_delete_variable Delete a workflow variable. Workflows referencing it will get undefined. Args: - id (string): Variable ID t Destructive n8n_delete_workflow Permanently delete a workflow by ID. This action is irreversible. Consider using n8n_archive_workflow for soft Destructive n8n_uninstall_community_package Uninstall a community node package. Workflows using its nodes will break. Args: - packageName (string): npm

EXECUTE 5 tools

Execute n8n_activate_workflow Activate (publish) a workflow so it runs automatically on triggers/schedules. Args: - id (string): Workflow Execute n8n_install_community_package Install a community node package from npm. Args: - packageName (string): npm package name (e.g., Execute n8n_retry_execution Retry a failed execution. Creates a new execution from the point of failure. Args: - id (string): Failed ex Execute n8n_stop_execution Stop a currently running execution. Args: - id (string): Running execution ID to stop Execute n8n_test_credential Test whether a credential is valid by making a test request to the service. Args: - id (string): Credential

WRITE 13 tools

Write n8n_archive_workflow Soft-delete a workflow by archiving it. Can be restored with n8n_unarchive_workflow. Args: - id (string): W Write n8n_create_credential Create a new credential. Use n8n_get_credential_schema first to know required fields. Args: - name (string) Write n8n_create_project Create a new project for organizing workflows and credentials. Args: - name (string): Project name Write n8n_create_tag Create a new annotation tag for organizing workflows. Args: - name (string): Tag name (must be unique) Write n8n_create_variable Create a new global workflow variable accessible in all workflows via \$vars.key. Args: - key (string): Var Write n8n_create_workflow Create a new workflow in n8n. Args: - name (string): Workflow name - nodes (array): Array of node objects Write n8n_deactivate_workflow Deactivate a workflow so it stops running automatically. Manual executions are still possible. Args: - id ( Write n8n_set_workflow_tags Replace all tags on a workflow. Pass an empty array to remove all tags. Args: - id (string): Workflow ID Write n8n_unarchive_workflow Restore an archived workflow back to normal state. Args: - id (string): Workflow ID to unarchive Write n8n_update_credential Update an existing credential Write n8n_update_tag Rename an existing tag. Args: - id (string): Tag ID - name (string): New tag name Write n8n_update_variable Update a workflow variable Write n8n_update_workflow Update an existing workflow. Replaces the full workflow definition. If the workflow is active, it will be repu

READ 15 tools

Read n8n_discover Get the capability map for the current API key — shows which API endpoints/scopes are accessible. Useful for d Read n8n_generate_audit Generate a security audit report for the n8n instance. Checks for security misconfigurations, abandoned workfl Read n8n_get_credential Retrieve credential metadata by ID. Secret data is NOT returned. Args: - id (string): Credential ID Read n8n_get_credential_schema Get the schema/field definitions for a credential type. Use this to know which fields are required when creati Read n8n_get_execution Retrieve full details of a specific execution by ID, including output data. Args: - id (string): Execution Read n8n_get_workflow Retrieve full details of a specific workflow by ID, including its nodes and connections. Args: - id (string Read n8n_get_workflow_tags Get the tags associated with a specific workflow. Args: - id (string): Workflow ID Read n8n_list_community_packages List all installed community node packages in the n8n instance. Read n8n_list_credentials List all credentials. Requires owner/admin role. Credential data (secrets) are NOT returned — only metadata. Read n8n_list_executions List workflow executions with optional filtering. Args: - workflowId (string?): Filter by specific workflow Read n8n_list_projects List all projects in the n8n instance. Args: - limit (number): Max results (1-250, default 20) - cursor ( Read n8n_list_tags List all annotation tags available in the n8n instance. Args: - limit (number): Max results (1-250, default Read n8n_list_users List all users in the n8n instance. Requires owner role. Args: - limit (number): Max results (1-250, defaul Read n8n_list_variables List all workflow variables (global key-value pairs available in all workflows). Args: - limit (number): Ma Read n8n_list_workflows List workflows from the n8n instance with optional filtering. Args: - active (boolean?): Filter by active/i

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about n8n MCP Server

Can an AI agent delete data through the n8n MCP Server MCP server? +

Yes. The n8n MCP Server server exposes 6 destructive tools including n8n_delete_credential, n8n_delete_execution, n8n_delete_tag. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through n8n MCP Server? +

The n8n MCP Server server has 13 write tools including n8n_archive_workflow, n8n_create_credential, n8n_create_project. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach n8n MCP Server.

How many tools does the n8n MCP Server MCP server expose? +

39 tools across 4 categories: Destructive, Execute, Read, Write. 15 are read-only. 24 can modify, create, or delete data.

How do I enforce a policy on n8n MCP Server? +

Register the n8n MCP Server MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every n8n MCP Server tool call.

Deterministic rules across all 39 n8n MCP Server tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON N8N →

Instant setup, no code required.

39 n8n MCP Server tools catalogued and risk-classified — across an index of 43,000+ MCP servers.