It gives an agent n8n schemas instead of guesses
n8n-MCP puts n8n node documentation, templates, validation, and instance management behind Model Context Protocol tools. An assistant can search for a node, inspect properties and operations, compare versions, find templates, and validate a workflow before deployment. The README describes 7 core discovery tools and 16 management tools. That split matters: the first group can help draft and check workflow JSON, while the second group can change an attached n8n instance.
The catalog is unusually broad. The README lists 2,541 nodes, including 832 core nodes and 1,709 community nodes, plus 2,352 workflow templates. Those are project claims, so they describe coverage rather than proof that every configuration will run. Still, schema lookup is a better input to an agent than remembered examples from a model. Teams already using n8n will get more value than teams shopping for an automation platform.
Read-only mode is the sensible first deployment
Management access uses N8N_API_URL and N8N_API_KEY. Once enabled, tools can create workflows, replace them, apply partial updates, run tests, delete executions, manage folders, and work with credentials or data tables. That is enough power to turn a drafting assistant into an operator. Cloudflare Access installations may also provide a service-token pair, which the server confines to the configured n8n origin.
The README supplies 9 whole-tool exclusions for a read-only deployment, including workflow writes, test execution, credentials, and data tables. A second setting blocks destructive operations inside mixed read and write tools. Pairing those lists with a read-only n8n API key gives two layers of restriction. This is the correct starting posture. The project's own safety warning tells users to copy workflows, test in development, export backups, and validate changes before production deployment.
What happened when we ran it
Our sandbox installed 2,761 npm packages in 152 seconds, leaving 1,775 MB on disk. The TypeScript build completed successfully in 12 seconds. This was a 116 MB checkout with 884 files and roughly 235,128 lines of source, so a quick npx launch hides a substantial dependency and code footprint. The repository includes 8 CI workflow files, a Dockerfile, a Compose file, and a tests directory.
The test command failed after 706 seconds. Vitest reported 6,387 passed, 220 failed, and 53 skipped out of 6,660 across 235 test files. The tail shows Axios calls through N8nApiClient.sendWorkflowWrite and createWorkflow, ending in validate-workflow.test.ts; it does not establish one cause for all 220 failures. We can say the checked-out commit did not pass its full suite in our fresh, secret-free container.
Npm audit found 133 known vulnerabilities: 5 critical, 42 high, 82 moderate, and 4 low. That result concerns the dependency tree installed for commit fe3a4cb, not a claim that each advisory is remotely exploitable through this server. It is still too large to wave away. Before placing the service near credentials or workflow data, operators should inspect the affected packages, reachable paths, and available upgrades.
A nested edit report makes full diffs mandatory
Open issue 1023 describes a 14-node workflow where setNodeParameter on one nested path created a duplicate structure and removed discriminator fields from other nodes. The reporter says the first response carried no validation warnings; fetching and diffing the full workflow revealed the damage. A replacement-style parameter update worked around it. This is one report, yet it concerns the exact partial-write behavior that makes the server attractive.
That report turns the README's safety advice into an operating rule. Keep a versioned export, apply changes to a copy, fetch the complete result, and compare every node before promotion. Validation alone may miss a bad write if the write response does. For governance-sensitive installations, leave update and delete tools disabled until the team has an approval step outside the agent conversation.
Protocol and validation reports deserve a trial on your client
Issue 1020 reports that a client offering MCP revision 2025-11-25 received revision 2025-03-26, outside the advertised supported window. A related issue covers 7 findings against revision 2026-07-28. These automated reports may expose compatibility gaps specific to a client and protocol revision, so test the exact client-server pair you intend to deploy. A successful tool listing does not exercise pagination, unknown-tool errors, resources, or every negotiated capability.
Another open report, issue 1018, describes intermittent connection closures during validation of a 9-node workflow. The same report says small read-only calls continued working and a 2-node synthetic workflow did not reproduce the behavior. We did not reproduce that issue in our lab, and our own failures provide no basis for linking the two. Together they justify a staged evaluation built around representative workflows, rather than a toy trigger connected to one action.
August maintenance is active, while the risk stays operational
GitHub recorded the last push on August 24, 2026, and listed 63 combined issues and pull requests. The latest release, v2.73.0, shipped on August 19 and updated n8n compatibility to the 2.35 line. Recent issue updates on August 23 and 24 cover validation, nested edits, and MCP conformance. That is active maintenance and active scrutiny, not an empty tracker.
For documentation search and workflow drafting, n8n-MCP solves a real context problem. For production control, its 16 management tools enlarge the blast radius of an assistant mistake. The 1,775 MB install, 220 failed tests, security-audit count, and open write-path report outweigh the convenience of immediate write access. Start with search and validation, keep the API key restricted, and require a human-reviewed full diff before any workflow changes leave a development instance.