n8nctrl

Active

When an n8n workflow fails at 3am, you find out by clicking through the executions list one run at a time. n8n-ops-mcp hands your whole n8n instance to the agent: list what broke, read the per-node error, trigger a retry, audit for security risks, and edit workflows, all without leaving your MCP client.

GitHub repo → npm →

$npm install -g n8n-ops-mcp

read-only defaultwrite-gatedcredential 2nd gateNode 20+

See it workrepresentative session

you

What n8n workflows broke today, and can you tell me why the worst one is failing?

tool

n8n_list_executions{ status: "error", limit: 20 }

result

3 failed 8814 Nightly CRM Sync error 02:03Z 8791 Invoice Webhook error 01:47Z 8712 Slack Digest error 00:10Z

tool

n8n_get_execution{ id: "8814", includeRunData: true }

result

node "HTTP Request" failed ECONNREFUSED 203.0.113.20:443 (crm.internal) retriedFrom: null stoppedAt: 02:03Z

agent

Nightly CRM Sync is the one to look at. Its HTTP Request node got ECONNREFUSED to crm.internal (203.0.113.20:443), so the CRM endpoint was down, not a workflow bug. The other two look downstream of it. Want me to n8n_retry_execution 8814 once the endpoint is back?

Representative session. Illustrative values, RFC 5737 addresses. Reads are always on; the retry it offers needs N8N_ENABLE_EDIT plus confirm.

What it does

Point any MCP client at n8n-ops-mcp and your running n8n instance becomes tools the agent can call over the n8n Public API: workflows, executions, schedules, webhooks, tags, and credential metadata. It is built for operating the flows you already run (triage failed executions, find drift, scan for security risks) rather than indexing n8n's node catalog to build new ones. It differs from a docs or builder tool in that read tools are always on while every write hides behind N8N_ENABLE_EDIT and destructive ops confirm-gate and snapshot first, so the same package is safe to hand a read-only agent or an operator with edit unlocked. It ships as a stdio MCP adapter (n8nctrl mcp or the back-compat n8n-ops-mcp bin), a read-only CLI (n8nctrl) for shells and cron, and a first-class OpenClaw plugin, with no hard dependency on a specific model or harness.

Capabilities40 tools across the n8n ops surface

Executions & triage

9 tools

List, get, search executions with per-node error logs; cancel, retry, and batch-delete runs.

Workflows & lifecycle

9 tools

Get, validate, diff, create, save, activate, archive, and delete workflows with snapshot-before-delete.

Scanners & drift

6 tools

Find workflows by node type or credential, list schedules and webhooks, surface disabled nodes and browser-bridge usage.

Stats & security audit

2 tools

Per-workflow failure rate and p95 runtime; n8n's built-in credentials/database/nodes/filesystem/instance audit.

Credentials

5 tools

Read credential metadata and schemas (secrets never echoed); create and delete behind a second write gate.

Full tool reference on GitHub →

Setup

01 · install

npm install -g n8n-ops-mcp

02 · configure

Required: N8N_BASE_URL, N8N_API_KEY (Settings -> API). Optional gates: N8N_ENABLE_EDIT, N8N_ENABLE_CREDENTIALS_WRITE, plus N8N_BACKUP_DIR, N8N_MAX_EXECUTION_LOG_BYTES, N8N_REQUEST_TIMEOUT_MS.

03 · mcp client config

{ "mcpServers": { "n8n": { "command": "npx", "args": ["-y", "n8n-ops-mcp"], "env": { "N8N_BASE_URL": "https://n8n.example.com", "N8N_API_KEY": "your-n8n-api-key" } } } }

Safety

how it stays safe

Writes are off by default. All create/save/trigger/archive/delete tools hide unless N8N_ENABLE_EDIT=true and require confirm:true; deletes snapshot to a backup directory first, and the read-only diff tool confines snapshot reads to that directory so it cannot be turned into an arbitrary file-read primitive. Credential writes sit behind a second independent gate (N8N_ENABLE_CREDENTIALS_WRITE), and credential secrets are stripped from every response including error paths, so a validation 400 cannot leak submitted data.

More in Network5 tools

librenmsctrlPipe LibreNMS devices, ports, and alerts to shells, cron, and agents. Writes gated. watchtowerNOC dashboard: device status, topology, and VM metrics via LibreNMS and Proxmox. eero-cliDrive the eero mesh API from the shell: SMS auth, device filtering, bulk block. cutsheetNetwork change intelligence: self-hosted config diff and risk analysis for switches, firewalls, and NetOps. portgridHigh-density port visualizer for LibreNMS, a modern replacement for the legacy SwitchMap.