# Security & Hardening

n8n-mcp is a proxy to the n8n REST API. **The security boundary is n8n itself, not n8n-mcp.** Every operation available through n8n-mcp can be performed identically using the n8n REST API with the same API key. n8n-mcp does not grant any capability beyond what the n8n API already provides.

Whoever has access to the MCP session effectively has the same privileges as the configured `N8N_API_KEY`. For vulnerability reporting, see [SECURITY.md](../SECURITY.md).

## Hardening Options

| Environment Variable | Purpose | Example |
|---|---|---|
| `AUTH_TOKEN` | Required for HTTP mode. Use a strong random value (min 32 chars). | `openssl rand -base64 32` |
| `DISABLED_TOOLS` | Comma-separated list of MCP tools to disable. | `n8n_create_workflow,n8n_test_workflow` |
| `WEBHOOK_SECURITY_MODE` | SSRF gate applied to webhook trigger URLs, the n8n API client (`N8N_API_URL`), and per-request URLs from the `x-n8n-url` header. Default `strict` blocks localhost, RFC1918, and cloud metadata endpoints. Use `moderate` to allow localhost (e.g. `http://localhost:5678`) while still blocking RFC1918 and metadata. `permissive` allows RFC1918 too — only suitable when n8n-mcp and n8n share a private Docker/Kubernetes network. Cloud metadata endpoints (169.254.169.254, metadata.google.internal, etc.) are blocked in all modes. | `moderate` |

## Restricting Workflow Capabilities

The workflow management tools can create and execute workflows on your n8n instance, including workflows with Code nodes. This is by design -- Code nodes are a first-class n8n feature. To control what Code nodes can do, configure these on **your n8n instance**:

- **Code node sandbox**: Enabled by default in n8n, restricts execution scope
- **`N8N_CODE_NODE_ALLOWED_MODULES`**: Controls which Node.js modules Code nodes can import
- **RBAC** (n8n Enterprise): Fine-grained access control per user/role

If workflow creation via MCP is not needed at all, disable the tools:
```bash
DISABLED_TOOLS=n8n_create_workflow,n8n_update_full_workflow,n8n_update_partial_workflow,n8n_test_workflow
```

## Prompt Injection Awareness

When n8n-mcp returns data from an n8n instance (workflow names, descriptions, execution results), that content is surfaced to the LLM. If a malicious actor has access to modify workflows on the shared n8n instance, they could craft workflow names or descriptions designed to manipulate the AI assistant.

This is a general characteristic of all LLM-agent systems that surface user-generated content. Mitigations include:
- Restricting who can create or modify workflows on the n8n instance
- Using `DISABLED_TOOLS` to limit which MCP tools are available
- Reviewing AI-generated workflow actions before execution
