Build my server

Guides

n8n MCP Server: Built-in Server vs n8n-nodes-mcp, Setup and Security (Oct 2026)

By Team TrustedMCP

On this page
n8n MCP Server: Built-in Server vs n8n-nodes-mcp, Setup and Security (Oct 2026)

Three things are called n8n MCP: n8n's built-in instance-level MCP server, n8n's MCP Server Trigger and MCP Client Tool nodes, and the community n8n-nodes-mcp node. To let an agent use your workflows, use n8n's own server. It grades A, with OAuth per client.

The community node grades D. It has had no release since January 2026, and n8n's own nodes now cover most of what it does.

The three, side by side

Instance-level MCP server MCP Server Trigger / MCP Client Tool n8n-nodes-mcp
Made by n8n (built in) n8n (core nodes) Community (nerding-io)
What it does Lets an agent search, run and build workflows on your instance Trigger: one workflow acts as an MCP server. Client Tool: an n8n agent calls an outside MCP server Lets a workflow call outside MCP servers (stdio or HTTP)
Auth OAuth per client, or a personal access token Trigger: None, Bearer or Header auth. Client Tool: also OAuth2 Static headers. Stdio runs a command
Our grade A Not graded separately D

The instance-level server lets agents into n8n. The client nodes let n8n call out to other servers.

Enable the built-in server safely

These steps come from n8n's instance-level MCP docs.

  1. Go to Settings > Instance-level MCP and select Enable MCP access. Only an instance owner or admin can do this.
  2. Select Connect to open the Connect a client dialog (n8n 2.33.0 or newer). Use the OAuth tab. n8n marks it as recommended. Pick your client, then approve access when n8n asks.
  3. Expose only the workflows you want. Nothing runs until you do this.

The server URL ends in /mcp-server/http. Clients can see previews of every workflow your user can access. They can't read full details, run or change a workflow until it is enabled for MCP. You can enable one workflow in three places:

  • Settings > Instance-level MCP > Workflows enabled, then Enable workflows.
  • In the editor: workflow menu (...) > Settings, then turn on Available in MCP.
  • In Workflows: open a card's menu and pick Enable MCP access.

From 2.24.0 you can also toggle a whole project or folder. That only covers workflows that exist today. A newer Auto-expose new workflows switch is off by default. Leave it off, so each new workflow needs a deliberate choice.

Review and revoke clients. The Connected clients list shows each OAuth client. Use Revoke access to cut one off. Each client keeps only the permissions you approved when it connected. Clients that use an access token do not appear in this list. To cut those off, generate a new token. That revokes the old one for every client that used it.

Limit callback URLs. Under Access, open Allowed callback URLs and switch from All callback URLs (the default) to Only trusted URLs.

Turn it off. Use the MCP status control and choose Disable. That disconnects every client. On self-hosted n8n, set N8N_DISABLED_MODULES=mcp to remove the MCP endpoints and screens entirely. You can also lock the setting with N8N_MCP_MANAGED_BY_ENV=true and N8N_MCP_ACCESS_ENABLED=false, per the environment variables page.

Stay current. Five MCP-related CVEs were published for n8n in 2026. All were fixed in releases that were out by the disclosure date. That only helps if you update.

Put TLS in front of self-hosted n8n. The docs don't set this up for you. Run n8n behind a reverse proxy with HTTPS. Your proxy must allow the headers MCP-Protocol-Version, Mcp-Method and Mcp-Name.

Client config

These come from n8n's MCP client connection examples. Replace <your-n8n-domain> with your domain, without https://. The Connect dialog shows the full URL too.

Claude Code (OAuth). Then run /mcp, select n8n and authorize:

claude mcp add --transport http n8n https://<your-n8n-domain>/mcp-server/http

Cursor (~/.cursor/mcp.json or .cursor/mcp.json):

{ "mcpServers": { "n8n": { "type": "streamable-http",
  "url": "https://<your-n8n-domain>/mcp-server/http" } } }

VS Code (.vscode/mcp.json):

{ "servers": { "n8n": { "type": "http",
  "url": "https://<your-n8n-domain>/mcp-server/http" } } }

The same page has token-based versions, plus Codex CLI, Gemini CLI, Windsurf and Claude Desktop. If you use a token, keep it out of committed files.

If you're using the community node

n8n-nodes-mcp is a community node by nerding-io. Its README calls it a node "that lets you interact with Model Context Protocol (MCP) servers in your n8n workflows". It is a client only. It does not expose your workflows to agents.

Why it grades D:

  • No release since January 2026. The last npm version, 0.1.37, is from 2 January 2026.
  • Stdio mode runs a command. You enter a command, arguments and environment variables, and n8n starts that process on the host. Anyone who can edit the workflow can change what runs.
  • Static header auth only. HTTP connections send fixed headers you type in. There is no OAuth.
  • Agent use needs an extra switch. The README says you must set N8N_COMMUNITY_PACKAGES_ALLOW_TOOL_USAGE=true to use it as an AI Agent tool. That turns on tool use for every community package, not only this one.

How to move off it. For HTTP servers, add n8n's own MCP Client Tool node to your AI Agent. Point it at the server's endpoint and pick an Authentication option: Bearer, generic header, multiple headers or OAuth2. Use Tools to Include > Selected to load only the tools you need. Then remove the community node and unset the environment variable if nothing else needs it. n8n's node has no stdio mode. For a local stdio server, run it behind an HTTP wrapper or pick a hosted version.

Security notes

An agent with n8n access can reach everything your workflows reach. A workflow may hold credentials for email, CRM or payment tools. Expose only workflows you would let a stranger trigger, and keep approval on in your client for runs.

Watch for prompt injection. Data that flows through a workflow, like an email body or a form field, can carry instructions aimed at the model. Treat workflow output as untrusted.

Agents get more than run access. From 2.13.0 the server can build and edit workflows. Review what the agent changes before you publish it.

More in MCP security best practices and is it safe to install an MCP server. Each exposed tool also loads into context. See why MCP servers eat your context window.

Why the built-in server grades A

  • Authentication, 30 of 30. OAuth per client, and you can revoke each one. A personal access token is the alternative. Only owners and admins can turn it on.
  • Maintenance, 25 of 25. It ships inside n8n, which releases often.
  • Known CVEs, 25 of 25. Five MCP-related CVEs in 2026, all fixed by the disclosure date: CVE-2026-42230, CVE-2026-42235 and CVE-2026-42236 (MCP OAuth client registration), CVE-2026-54309 (the @n8n/mcp-browser HTTP mode) and CVE-2026-59207 (an AI Agent allowed-domains bypass through an MCP tool).
  • Transport, 6 of 20. This is the only deduction. On self-hosted n8n, TLS depends on your own setup, so we can't assume it.

Full breakdown on the n8n MCP listing. The method is in how TrustedMCP scores servers. Similar servers are under automation.

FAQs

Is n8n-nodes-mcp the same as n8n's MCP server? No. The community node lets workflows call other MCP servers. The built-in server lets agents call into n8n.

Do I need the community node to expose workflows? No. Use Settings > Instance-level MCP and mark workflows Available in MCP.

Instance-level server or MCP Server Trigger? The instance-level server covers many workflows and supports OAuth. The trigger exposes one workflow's tools, with None, Bearer or Header auth.