Plango
Get Plango

For developers

Mac security

← MCP server and skill grades

n8n-mcp

czlonkowski/n8n-mcp

B
Type
MCP server
Scanned
Oct 29, 2026
Version
f7a454661701
Files read
970

This MCP server gives AI assistants access to n8n node documentation, workflow validation tools, and live management of workflows, credentials, and executions on a connected n8n instance. The biggest risks are that it grants the AI full control to modify, run, or delete live workflows and credentials on your n8n server, and it sends sanitized workflow structures, search queries, and usage telemetry to an external server by default.

What it can reach

Network
Connects to the configured n8n instance API, webhooks, and MCP endpoints, fetches templates and version info from api.n8n.io, GitHub, and npm, and sends usage and workflow telemetry to telemetry.n8n-mcp.com by default.
Files
Reads and writes the local SQLite database (data/nodes.db), telemetry configuration (~/.n8n-mcp/telemetry.json), temporary batch files, bundled skill documentation, and optional token or Docker config files.
Secrets
Reads n8n API keys, MCP access tokens, Cloudflare Access tokens, HTTP auth tokens, and OpenAI API keys from environment variables or request headers, and can create, update, list, or delete credentials on the connected n8n instance.
Shell commands
Runs git clone and git pull commands during documentation rebuilds and can spawn stdio child processes through its MCP client utility.
System
Reads OS hostname, platform, architecture, home directory path, and Linux /proc system files to generate a persistent installation ID for telemetry.

Findings

6 medium11 low
  1. MediumMismatched tenant headers on an existing session fall back to the stored tenant's credentials

    src/http-server-single-session.ts:977

    In multi-tenant HTTP mode with the default 'instance' session strategy, when a non-initialize request supplies an existing Mcp-Session-Id, handleRequest initializes requestContext to this.sessionContexts[sessionId] and only refreshes it if the incoming instanceContext matches both the stored instanceId and n8nApiUrl. If a request arrives with a different tenant's x-n8n-url, x-n8n-key, or x-instance-id headers alongside an existing session ID, the mismatch is not rejected and the request executes using the session owner's stored n8n credentials.

    Fix: When ENABLE_MULTI_TENANT is enabled and sessionStrategy is 'instance', reject any request whose instanceContext does not match the stored session's instanceId and n8nApiUrl (or lacks tenant headers) with HTTP 403.

  2. MediumTelemetry is enabled by default and sends workflow structures and mutations externally

    src/mcp/handlers-n8n-manager.ts:703

    Unless N8N_MCP_TELEMETRY_DISABLED=true is set in the environment, the server enables telemetry by default and transmits tool usage, search queries, error details, created/validated workflow definitions, and partial/full workflow mutation payloads (including before/after workflow snapshots and user intent) to an external telemetry service.

    Fix: Make telemetry opt-in by default (disabled unless explicitly enabled by the user) and avoid transmitting workflow definitions or mutation snapshots.

  3. MediumTelemetry is enabled by default and uploads sanitized workflows, queries, and user intents

    src/telemetry/config-manager.ts:198

    On first run, telemetry is enabled by default unless an opt-out environment variable (such as N8N_MCP_TELEMETRY_DISABLED=true) is set. When enabled, TelemetryEventTracker and MutationTracker send tool usage, search queries, user intent strings, diff operations, and sanitized workflow definitions (including node parameters such as Code node scripts and AI prompts) to https://telemetry.n8n-mcp.com. Although WorkflowSanitizer strips known secret patterns, URLs, and email addresses, proprietary business logic, prompts, and internal field names in workflows can still leave the user's machine without explicit opt-in.

    Fix: Change the default telemetry configuration to opt-in (enabled: false by default) or limit default telemetry to minimal aggregate counters without uploading workflow structures, node parameters, or user intent text.

  4. MediumTelemetry is enabled by default and uploads sanitized workflow structures and intents

    PRIVACY.md:26

    Telemetry is enabled by default across local, npx, and Docker installations. Beyond basic usage counters, it transmits the free-text intent argument and sanitized workflow structures (including node names, connections, and any node parameters that survive pattern-based redaction) to telemetry.n8n-mcp.com to build datasets and train machine learning models that may be licensed to third parties. Because redaction is pattern-based, proprietary workflow logic or custom secret formats in node parameters could leave the user's machine without explicit opt-in.

    Fix: Set N8N_MCP_TELEMETRY_DISABLED=true in your MCP client environment configuration or run npx n8n-mcp telemetry disable.

  5. MediumWorkflow creation, execution, and credential management tools enabled by default

    manifest.json:114

    When N8N_API_URL and N8N_API_KEY are provided, all n8n management tools are enabled by default, allowing the agent to create, update, delete, and trigger workflows (including JavaScript/Python Code nodes) and manage credentials or data tables. If the agent processes untrusted content containing a prompt injection, an attacker could execute arbitrary workflow code on the n8n server or delete workflows.

    Fix: Set DISABLED_TOOLS and DISABLED_TOOL_OPERATIONS in the environment (as shown in the Read-Only Deployment section of README.md) and use a least-privilege n8n API key.

  6. MediumTelemetry is enabled by default and sends sanitized workflow data off-machine

    manifest.json:67

    Anonymous usage telemetry is enabled by default in both the MCP manifest and the Docker image. Unless disabled, the server transmits tool usage events, user intents, and sanitized workflow definitions (where secrets and URLs are scrubbed via regex, but node structures, code snippets, and prompts remain) to an external telemetry endpoint.

    Fix: Set N8N_MCP_TELEMETRY_DISABLED=true in the environment or enable the Disable Telemetry option in the client configuration.

  7. LowHTTP server binds to 0.0.0.0 and enables wildcard CORS by default

    src/http-server-single-session.ts:1262

    When started in HTTP mode (MCP_MODE=http), the server listens on 0.0.0.0 (all network interfaces) and sets Access-Control-Allow-Origin to '*' unless overridden by HOST and CORS_ORIGIN. On machines without a host firewall, this exposes the MCP server to the local network and allows any website to issue cross-origin requests.

    Fix: Default HOST to 127.0.0.1 for local HTTP mode and require explicit configuration to bind to 0.0.0.0 or allow wildcard CORS origins.

  8. LowDeprecated fixed HTTP server omits DISABLED_TOOLS filtering and rate limiting

    src/http-server.ts:466

    When USE_FIXED_HTTP=true is set, the legacy HTTP server in src/http-server.ts returns the full tool list in tools/list without applying DISABLED_TOOLS or DISABLED_TOOL_OPERATIONS restrictions, exposes unauthenticated /version and /test-tools endpoints, and does not apply rate limiting to POST /mcp authentication attempts.

    Fix: Remove the deprecated fixed HTTP server implementation or apply the same authentication, rate-limiting, and tool-policy checks used in SingleSessionHTTPServer.

  9. LowUnpinned npx package execution in MCP bundle manifest

    manifest.json:3

    The MCP bundle manifest runs 'npx -y n8n-mcp' without pinning a specific version, even though the manifest itself declares version 2.62.0. Starting the server through this manifest always downloads and executes whatever version is currently tagged latest on npm, exposing users to supply-chain risk if a future npm publish is compromised.

    Fix: Pin the package version in manifest.json (for example, 'n8n-mcp@2.62.0') and keep it synchronized during release builds.

  10. LowPermissive wildcard CORS origin by default in Railway Dockerfile

    Dockerfile.railway:98

    Dockerfile.railway configures the HTTP server with HOST=0.0.0.0 and CORS_ORIGIN="*" by default. Allowing any origin via wildcard CORS lets arbitrary websites make cross-origin requests to the MCP HTTP server if it is reachable from a user's browser.

    Fix: Remove the wildcard CORS_ORIGIN="*" default or require operators to configure an explicit allowed origin.

  11. LowUnvalidated command execution in MCPClient stdio transport

    src/utils/mcp-client.ts:58

    When MCPClient is configured with connectionType 'stdio', it splits serverUrl on spaces and passes the resulting command and arguments directly to StdioClientTransport, which spawns a child process. If MCPClient is ever called with a serverUrl derived from untrusted input, an attacker could execute arbitrary commands.

    Fix: Remove stdio process spawning from URL strings or validate the executable against a strict allowlist.

  12. LowMCPB manifest runs unpinned npx package at runtime

    manifest.json:35

    The MCPB manifest configures the server to run npx -y n8n-mcp without pinning a specific version, rather than running the bundled dist/mcp/index.js entry point or a pinned version tag. This causes the client to download and execute whatever version is currently tagged as latest on npm, increasing exposure to a compromised upstream release.

    Fix: Pin the package version in manifest.json (for example, n8n-mcp@2.99.2) or invoke node with the bundled dist/mcp/index.js entry point directly.

  13. LowUsage telemetry is enabled by default (opt-out instead of opt-in)

    manifest.json:67

    The server enables usage telemetry by default unless the user explicitly sets N8N_MCP_TELEMETRY_DISABLED=true or toggles the disable option in the configuration. This causes usage events and workflow structure data to leave the user's machine automatically upon installation.

    Fix: Change the default value of n8n_mcp_telemetry_disabled to true (or require explicit opt-in) so no data is transmitted externally without the user's consent.

  14. LowUnpinned npx package execution in manifest.json

    manifest.json:3

    The MCP bundle manifest configures the server to run via npx -y n8n-mcp without pinning a specific version tag. This causes npx to automatically download and run the latest version published to npm rather than the specific version declared in the manifest.

    Fix: Pin the package version in the npx arguments (for example, n8n-mcp@2.62.0) or execute the bundled dist/mcp/index.js entrypoint directly.

  15. LowTelemetry is enabled by default (opt-out)

    manifest.json:67

    Anonymous usage telemetry is enabled by default in both the MCP bundle manifest and the Docker image, sending tool usage and workflow creation/mutation events to an external telemetry server unless the user explicitly opts out.

    Fix: Set N8N_MCP_TELEMETRY_DISABLED=true in the environment or change the default of n8n_mcp_telemetry_disabled to true so telemetry is opt-in.

  16. LowUnpinned npx package execution in manifest.json

    manifest.json:35

    The MCP bundle manifest configures the server to run via 'npx -y n8n-mcp' without pinning a specific version, which automatically downloads and executes the latest published version from npm at runtime.

    Fix: Pin the package version in the npx arguments (for example, 'n8n-mcp@2.62.0') or run the bundled entry point directly with node.

  17. LowUnpinned npx package execution in MCP manifest

    manifest.json:35

    The manifest configures the server to run via 'npx -y n8n-mcp' without pinning a version number, which downloads and runs the latest version from npm at runtime without verification.

    Fix: Pin the package to an exact version in the npx arguments (e.g., 'n8n-mcp@2.99.2') or run a locally installed copy.