n8n MCP Server

About

n8n-MCP gives an AI assistant deep knowledge of n8n rather than a remote control for it: 2,412 nodes (829 core plus 1,583 community, 1,340 of them verified) with 99% property coverage and 66.5% operation coverage, 86% documentation coverage, a library of 2,352 workflow templates, and validators that check a node config or a whole workflow before anything is deployed. Seven documentation tools always load — search_templates, get_template, search_nodes, get_node, validate_node, validate_workflow and tools_documentation — and get_node is deliberately tiered because full node detail costs 3,000-8,000 tokens. Supplying N8N_API_URL and N8N_API_KEY unlocks a further sixteen management tools that create, partially update, validate, autofix, deploy and inspect workflows on your own instance, plus executions, credentials, folders, data tables and health checks; without credentials the server cannot execute anything at all. MCP_MODE=stdio is required for stdio clients, or log output corrupts the JSON-RPC stream; WEBHOOK_SECURITY_MODE=moderate is required when N8N_API_URL points at localhost or host.docker.internal, because the default SSRF gate rejects loopback. Install with npx n8n-mcp, the ghcr.io/czlonkowski/n8n-mcp Docker image, or the maintainer's hosted instance at dashboard.n8n-mcp.com (100 tool calls/day free). This is a community project by Romuald Czlonkowski under MIT, not published by n8n, and it is distinct from n8n's own MCP Server Trigger node, which does the reverse — exposing an n8n workflow as an MCP server over SSE or Streamable HTTP. The project's own headline warning is never to let an AI edit production workflows directly.

Installation

npx n8n-mcp

Setting up n8n-MCP

1. 1.Fastest path — the hosted instance

   dashboard.n8n-mcp.com is the maintainer's hosted version: sign up, take an API key, connect your client. Free tier is 100 tool calls per day and the node/template data is kept current, which is the part that goes stale in a local install.

2. 2.Local — add it to Claude Code, docs tools only

   MCP_MODE=stdio is required, not cosmetic: without it the process writes log lines to stdout and the client reports JSON parse errors like "Unexpected token…". LOG_LEVEL=error and DISABLE_CONSOLE_OUTPUT=true exist for the same reason.

   shell

   claude mcp add n8n-mcp \
     -e MCP_MODE=stdio \
     -e LOG_LEVEL=error \
     -e DISABLE_CONSOLE_OUTPUT=true \
     -- npx n8n-mcp

3. 3.Add your instance to unlock the management tools

   The n8n API credentials are optional. Without them you get documentation, templates and validation. With them you additionally get create/update/execute/inspect against that instance. For a local n8n, N8N_API_URL is http://localhost:5678 — or http://host.docker.internal:5678 if n8n-MCP itself runs in Docker.

   shell

   claude mcp add n8n-mcp \
     -e MCP_MODE=stdio \
     -e LOG_LEVEL=error \
     -e DISABLE_CONSOLE_OUTPUT=true \
     -e N8N_API_URL=https://your-n8n-instance.com \
     -e N8N_API_KEY=your-api-key \
     -- npx n8n-mcp

4. 4.Docker, including the loopback trap

   The image is ghcr.io/czlonkowski/n8n-mcp:latest. If N8N_API_URL points at localhost or host.docker.internal you must also set WEBHOOK_SECURITY_MODE=moderate — the SSRF gate covers both webhook triggers and the API client, and the default `strict` mode rejects loopback addresses outright. `moderate` allows localhost while still blocking RFC1918 ranges and cloud metadata endpoints.

   claude_desktop_config.json

   {
     "mcpServers": {
       "n8n-mcp": {
         "command": "docker",
         "args": [
           "run", "-i", "--rm",
           "-e", "MCP_MODE=stdio",
           "-e", "LOG_LEVEL=error",
           "-e", "DISABLE_CONSOLE_OUTPUT=true",
           "-e", "N8N_API_URL=http://host.docker.internal:5678",
           "-e", "N8N_API_KEY=your-api-key",
           "-e", "WEBHOOK_SECURITY_MODE=moderate",
           "ghcr.io/czlonkowski/n8n-mcp:latest"
         ]
       }
     }
   }

5. 5.Behind Cloudflare Access

   Set N8N_CF_CLIENT_ID and N8N_CF_CLIENT_SECRET; they are sent as CF-Access-Client-Id / CF-Access-Client-Secret on API requests, health probes and webhook executions. The token is scoped to the N8N_API_URL origin only — a webhook on a different host deliberately does not receive it.

The 23 tools, in the order you actually use them

Seven documentation tools always load; the sixteen n8n_* management tools appear only when API credentials are present. `DISABLED_TOOLS` and `DISABLED_TOOL_OPERATIONS` (e.g. `n8n_executions:delete`) let you remove capabilities you do not want an agent to have.

What people use it for

Which one should you use?

Categories

Works With

Frequently Asked Questions

Related Guides