n8n MCP: Connect AI Agents to n8n (Server, Client & Setup)

Search "n8n MCP" and you'll land on several different things that all share the name. That's exactly why it gets confusing. Here's the short version: n8n MCP is n8n's support for the Model Context Protocol (MCP), the open standard from Anthropic for connecting LLM applications to external tools and data. Inside n8n, that support splits into three first-party features (the instance-level MCP server, the MCP Server Trigger node, and the MCP Client / MCP Client Tool nodes) plus one dominant third-party project, the community czlonkowski/n8n-mcp server. This guide separates them cleanly, shows how to set each one up, and covers the security and troubleshooting details most write-ups skip.

One attribution note first, because the confusion starts right here. n8n (the automation tool, its nodes, and its built-in MCP server) is made by n8n GmbH in Berlin. MCP itself is an open protocol introduced by Anthropic. And czlonkowski/n8n-mcp is an independent, MIT-licensed community project by Romuald Czlonkowski, not an n8n GmbH product. Three different owners. Three different things.

What MCP means inside n8n

n8n's own docs describe the protocol as "an open protocol that enables seamless integration between LLM applications and external data sources and tools." An MCP server exposes tools. An MCP client discovers and calls them. n8n implements both roles, and that's why "n8n MCP" can mean opposite directions of data flow depending on which feature you're talking about.

Here are the four things people tend to lump together:

• Instance-level n8n MCP server: a native server built into n8n that exposes your workflows (and more) as tools to external AI clients like Claude or Cursor. AI calls into n8n.
• MCP Server Trigger node: turns a single workflow into an MCP server, exposing only the tools attached to that trigger.
• MCP Client / MCP Client Tool node: lets n8n itself consume tools from an external MCP server. n8n calls out.
• czlonkowski/n8n-mcp: a separate community server you run that gives an AI assistant deep knowledge of n8n's node library so it can author correct workflows.

The first three are first-party, documented at docs.n8n.io. The MCP nodes shipped in n8n v1.88.0, announced April 10, 2025.

n8n's built-in instance-level MCP server

This is the feature most people now mean when they say "the n8n MCP server." It's a native server, built into every edition of n8n (Cloud, Enterprise, and the free self-hosted Community Edition, per the n8n blog) that lets external AI clients talk to your instance through one connection with centralized authentication.

What it does

At launch it could only run existing workflows. As of the April 29, 2026 update, it can also build new workflows from scratch and update existing ones directly in your instance. Here's the clever part: n8n generates a TypeScript representation of the workflow that must type-check and compile before it touches your instance, so invalid configurations get caught up front rather than emitting raw JSON. The tools reference lists named tools across workflow management, execution management, the workflow builder, and data tables.

n8n is honest about the limits. Complex branching workflows often need manual cleanup, node selection can go wrong when several similar nodes overlap, and some design choices get made silently. Treat agent-built workflows as drafts to review, not finished products.

Requirements and setup

The feature is in Public Preview. n8n recommends version 2.18.4 or higher for the best workflow-building experience. Enabling it requires instance owner or admin permissions. You turn MCP on at the instance level, then enable each workflow individually. For self-hosted instances, the N8N_MCP_ACCESS_ENABLED=true environment variable is available from v2.20.0. These version numbers move fast, so confirm against the docs for your edition.

The high-level flow from the n8n blog: enable the MCP server, copy the connection details, add the server to your MCP client, then restart the client. Under Settings > Instance-level MCP, open the Connection details menu to reach the authentication tabs.

Authentication

You get two client auth methods: OAuth2 or a personal MCP Access Token. On your first visit to the Access Token tab, n8n auto-generates a token tied to your user account. Copy it immediately. After that it only shows a redacted value with the copy button disabled. Generating a new token revokes the old one, so every connected client breaks until you update them. A "Connected clients" tab lists OAuth clients with a per-row menu to revoke access. One important caveat: MCP access isn't scoped per client, so every connected client sees all MCP-enabled workflows.

MCP Server Trigger node: expose one workflow as a tool

Reach for the MCP Server Trigger node (n8n-nodes-langchain.mcptrigger) when you want to expose a single workflow rather than your whole instance. Per the docs, it lets n8n act as a Model Context Protocol (MCP) server, making n8n tools and workflows available to MCP clients.

Unlike conventional triggers, this node only connects to and executes tool nodes. Clients can list the available tools and call them individually. It exposes an MCP URL and supports two transports: Server-Sent Events (SSE) and streamable HTTP. Clients such as Claude Desktop speak stdio rather than HTTP/SSE directly, so you'll typically bridge to the SSE endpoint with the mcp-remote proxy.

MCP Client and MCP Client Tool nodes: n8n as the client

These flip the direction. Now n8n is the consumer of an external MCP server.

• The MCP Client Tool (n8n-nodes-langchain.toolmcp) is a cluster sub-node that lets an AI Agent node call tools exposed by an external MCP server.
• The MCP Client core node lets you use external MCP tools as regular workflow steps.

The MCP Client Tool node supports Bearer, generic header, multiple headers, and OAuth2 authentication. You configure the transport (HTTP Streamable is the modern, recommended method; SSE is legacy), the endpoint URL of the external server, and the tool (auto-fetched from that server).

One well-known gotcha. To use the n8n-nodes-mcp community client node as a tool inside an AI Agent, you have to set N8N_COMMUNITY_PACKAGES_ALLOW_TOOL_USAGE=true. Forgetting this is a common cause of "my tool node won't show up."

The community project: czlonkowski/n8n-mcp

The most-starred result for "n8n mcp" on GitHub is czlonkowski/n8n-mcp, an MIT-licensed MCP server self-described as a server "for Claude Desktop / Claude Code / Windsurf / Cursor to build n8n workflows for you." It complements the built-in server rather than competing with it. Where n8n's server executes and publishes workflows, this one gives an AI assistant structured knowledge of n8n's node library so it can author them accurately.

Per the project README, it documents roughly 1,845 n8n nodes (816 core + 1,029 community) and over 2,300 workflow templates, and exposes about 20 tools. There are core docs/search tools like search_nodes, get_node, validate_workflow, and search_templates, plus n8n management tools (n8n_create_workflow, n8n_update_partial_workflow, n8n_validate_workflow, and more) that activate only when you supply N8N_API_URL and N8N_API_KEY. These counts and version numbers are the maintainer's self-reported stats and change frequently, so verify with tools_documentation against your installed version.

Step-by-step setup

The simplest run uses npx. Knowledge tools work with no configuration:

npx n8n-mcp

For Claude Code, the README gives a documentation-only setup:

claude mcp add n8n-mcp \
  -e MCP_MODE=stdio \
  -e LOG_LEVEL=error \
  -e DISABLE_CONSOLE_OUTPUT=true \
  -- npx n8n-mcp

Want the workflow-management tools too? Add your n8n API credentials. The API key is created in the n8n UI under Settings > n8n API:

claude mcp add n8n-mcp \
  -e MCP_MODE=stdio \
  -e LOG_LEVEL=error \
  -e DISABLE_CONSOLE_OUTPUT=true \
  -e N8N_API_URL=https://your-n8n-instance.com \
  -e N8N_API_KEY=your-api-key \
  -- npx n8n-mcp

The three stdio variables (MCP_MODE, LOG_LEVEL, DISABLE_CONSOLE_OUTPUT) are described as critical for clean stdio communication. For Claude Desktop, edit claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/; Windows: %APPDATA%\Claude\; Linux: ~/.config/Claude/) and run via Docker:

{
  "mcpServers": {
    "n8n-mcp": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "MCP_MODE=stdio",
        "-e", "LOG_LEVEL=error",
        "-e", "DISABLE_CONSOLE_OUTPUT=true",
        "ghcr.io/czlonkowski/n8n-mcp:latest"
      ]
    }
  }
}

To run it as a remote HTTP server for a team, use the documented HTTP deployment:

docker run -d \
  --name n8n-mcp \
  --restart unless-stopped \
  --env-file .env \
  -p 3000:3000 \
  ghcr.io/czlonkowski/n8n-mcp:latest

with an .env like:

AUTH_TOKEN=$(openssl rand -base64 32)
MCP_MODE=http
PORT=3000

Then health-check with curl http://localhost:3000/health and connect a remote client through mcp-remote. Use HTTPS with a valid certificate in production, and never commit the token.

Permissions and security

n8n's flexibility (workflows that evaluate expressions and run code) is also its risk surface. Through 2025–2026 n8n saw a wave of critical RCE and credential-exposure CVEs, several rated CVSS 9.4–9.5 and tied to workflow expression evaluation, per The Hacker News. A separate, even more severe webhook flaw (CVE-2026-21858, CVSS 10.0) left over 100,000 internet-exposed instances vulnerable to RCE. Many of those flaws require permission to create or modify workflows, which is exactly the surface that MCP-driven authoring widens. So:

• Least privilege. Restrict workflow create/edit permissions to fully trusted users, and enable MCP only on the specific workflows you intend to expose. Remember, the built-in server's tokens aren't scoped per client.
• Scoped, rotated tokens. Treat the personal MCP Access Token and any N8N_API_KEY / AUTH_TOKEN as credentials. Keep them in environment variables or an --env-file, never in committed config. Generate strong tokens (openssl rand -base64 32).
• Never edit production with AI. The czlonkowski README is blunt: "NEVER edit your production workflows directly with AI!" Copy the workflow first, test in a dev environment, export backups, and validate before deploying.
• Harden and patch. Run external runner mode, exclude risky nodes where appropriate, restrict host privileges and network access, and patch promptly. n8n has cautioned that workarounds don't fully remediate risk and are temporary.

Troubleshooting common n8n MCP errors

• "Could not connect to your MCP server" over SSE in an AI Agent: confirm the external server is actually running and reachable, and that you used the correct transport. The community thread covers SSE-vs-HTTP mismatches, Docker hostname resolution (host.docker.internal), and gzip-compression issues on SSE endpoints.
• MCP server not running: see the forum report. Usually an instance/version or enablement issue.
• Community MCP node won't load ("Cannot find module," permission denied, invalid node version): a common community-node install problem.
• Tool node won't appear in an AI Agent: set N8N_COMMUNITY_PACKAGES_ALLOW_TOOL_USAGE=true.
• Missing Chat Model: an AI Agent needs a Chat Model sub-node attached before MCP tools work.

Where this pattern goes next

Strip away the UI and n8n's MCP features expose two primitives: an agent that calls MCP servers as tools (the Client Tool pattern), and a unit of work exposed as a tool, fired by an event and acting through APIs (the Server Trigger pattern). That's precisely the architecture a knowledge-workforce platform like gamut.so (from Datawizz) is built on, with agents that use MCP servers as tools to act on external systems, triggered by events and acting through APIs. n8n's MCP nodes make those primitives tangible at the workflow layer. gamut applies the same primitives at the agent layer. The n8n MCP server is exactly the kind of tool a gamut agent can pick up and use.

FAQ

What is n8n MCP and what does it do?

It's n8n's support for the Model Context Protocol (built-in nodes plus an instance-level server) that lets AI agents call your n8n workflows as tools, and lets n8n call external MCP servers.

What's the difference between the Server Trigger node and the instance-level MCP server?

The Server Trigger exposes a single workflow's tools as an MCP server. The instance-level server gives one connection per n8n instance with centralized auth, and you choose which workflows to expose.

Is the n8n MCP server official, or is czlonkowski/n8n-mcp a different thing?

Both exist. The instance-level server and the MCP nodes are official, from n8n GmbH. czlonkowski/n8n-mcp is a separate, independent community project.

Can the n8n MCP server build workflows, or only run them?

Since the April 29, 2026 update it can build new workflows and update existing ones, not just execute them. Recommended on n8n v2.18.4+.

Is n8n MCP free, and does it work on Community Edition?

Yes. The built-in MCP capability ships in Cloud, Enterprise, and the free self-hosted Community Edition.

Should I use SSE or HTTP Streamable transport?

HTTP Streamable is the modern, recommended method. SSE is the legacy option still supported for compatibility.