Manage workflow version history, rollback, and cleanup. Six modes: - list: Show version history for a workflow - get: Get details of specific version - rollback: Restore workflow to previous version (creates backup first) - delete: Delete specific version or all versions for a workflow - prune: M...
AI agents call n8n_workflow_versions to permanently remove resources in n8n-MCP — typically in cleanup and lifecycle workflows. It does its job in a single call, and there is no undo.
Although the tool also provides read operations (list, get) and a reversible rollback function, the destructive modes (delete, truncate, prune) that permanently remove workflow versions dominate the risk profile. Deletion of version history is irreversible and could cause loss of critical audit trails and backup points.
From the tool's definition The tool includes modes that perform irreversible deletions: 'delete: Delete specific version or all versions for a workflow' and 'truncate: Delete ALL versions for ALL workflows (requires confirmation)'.
Attacks that exploit this kind of access
Manage workflow version history, rollback, and cleanup. Six modes: - list: Show version history for a workflow - get: Get details of specific version - rollback: Restore workflow to previous version (creates backup first) - delete: Delete specific version or all versions for a workflow - prune: Manually trigger pruning to keep N most recent versions - truncate: Delete ALL versions for ALL workflows (requires confirmation). It is categorised as a Destructive tool in the n8n-MCP MCP Server, which means it can permanently delete or destroy data. Block by default and require explicit approval.
Register the n8n- MCP server in PolicyLayer and add a rule for n8n_workflow_versions: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches n8n-MCP. Nothing to install.
n8n_workflow_versions is a Destructive tool with critical risk. Critical-risk tools should be blocked by default and only enabled with explicit human approval.
Yes. Add a rate_limit block to the n8n_workflow_versions rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for n8n_workflow_versions. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
n8n_workflow_versions is provided by the n8n- MCP server (spring1237/mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Every MCP server has a record like this.
Type a name, get the same breakdown: verified identity, auth posture, risk grade, capabilities, recommended policy.
Teams ship this data inside their own products. See what a licence covers →