@awesomate/hosting-mcp 0.87.0 → 0.88.6

package/skill/awesomate-database/SKILL.md

@@ -20,17 +20,18 @@ write, or for an app your customers log into?"
 
 **(a) A list an AUTOMATION reads/writes** — a dedupe ledger, a task
 queue, a lookup map, form submissions feeding a workflow. → n8n DATA
-TABLE, via the awesomate-n8n skill. Create and write with
-`awesomate_n8n_datatable_write`, and pass `workflowId` so the table is
-co-located with the workflow that uses it. No hosting slot consumed, and
+TABLE, via the awesomate-n8n skill. The table lives in n8n: Claude designs
+the columns, the user creates it in n8n (Data tables in the left menu,
+inside the project that owns the workflow), or Claude creates it through
+their n8n's own MCP server when that server offers a data-table tool. No
+Awesomate tool creates or writes a table. No hosting slot consumed, and
 workflows query it directly — this is the default answer for anything
 automation-shaped. Inspect what exists with
 `awesomate_n8n_inspect {what:'datatables'}`.
-**Both the write AND that read are gated:** Support Plus or above, plus the
-privacy switch **"Build and change automations from Claude Code"** in Settings,
-Privacy (hub.awesomate.ai/settings?tab=privacy, which is what the 403's
-`settingsUrl` points at). It is **off by default**, so on a fresh account
-both the read and the write come back 403 `consent_required`. Call
+**That read is gated** by the privacy switch **"Let Claude Code work with
+your automations"** in Settings, Privacy (hub.awesomate.ai/settings?tab=privacy,
+which is what the 403's `settingsUrl` points at). It is **off by default**,
+so on a fresh account the read comes back 403 `consent_required`. Call
 `awesomate_privacy_settings` to name the exact toggle that's off, send the
 user to flip it, then re-check. You cannot flip it for them.
 
@@ -43,25 +44,24 @@ app serves to people. → the app's own Postgres.
   via the awesomate-app-builder skill, which wires it in from the start.
 
 **(c) A WORKFLOW that needs raw SQL against its own Postgres** — real
-joins, aggregates, or volumes a data table shouldn't carry. →
-`awesomate_n8n_provision_pg`. One step creates the database AND the n8n
-credential, so the workflow can query it immediately. It has the most gates
-of anything here — check them BEFORE offering it, so the user doesn't hit a
-wall halfway:
-- Support Plus or above.
-- The **"Build and change automations from Claude Code"** toggle (off by
-  default) — same one as branch (a).
-- The **direct database writes** consent (`allow_pg_writes`). It's on by
-  default, so this is rare — but it has **no client-facing toggle in the
-  hub**, so if it's off, don't send the user hunting for a switch that
-  doesn't exist: route it to support via the awesomate-support skill.
-- An Awesomate cPanel hosting account. Without one it returns 409
-  `hosting_required`; hosting comes first (awesomate-hosting skill).
-- Capped at **2 a day**.
-
-On any 403 here, call `awesomate_privacy_settings` first — it names the
-exact toggle that's blocking, which decides whether this is a "flip this
-switch" or a "raise it with support" answer.
+joins, aggregates, or volumes a data table shouldn't carry. → a Postgres
+credential the user creates in their own n8n. No Awesomate tool provisions
+this any more; it is two steps the user does, and you walk them through:
+1. Get a database. If they have an Awesomate hosting account and cPanel
+   shows a **PostgreSQL Databases** page (not every package does; check
+   before promising it), it makes one (database + user + password) in a
+   minute; the awesomate-hosting skill opens cPanel for them. If their data
+   already lives in a Postgres somewhere else (their app's database, Supabase,
+   Neon), use that one: see (d).
+2. Create the credential in n8n at `{instanceUrl}/home/credentials`
+   (type Postgres: host, port, database, user, password, SSL as cPanel shows
+   them). The password goes from cPanel into n8n and never through the chat.
+   Then confirm it exists with `awesomate_n8n_inspect {what:'credentials'}`
+   and build the workflow on it (awesomate-n8n skill).
+An app database made by `awesomate_app_provision_db` belongs to the app: a
+workflow reads it through the app's own API, or through a credential the
+user makes on purpose from the app's connection details, never by Claude
+copying `DATABASE_URL` into n8n.
 
 **(d) Analytics/BI or data shared with other systems** — reporting
 warehouses, a spreadsheet the whole team lives in, a CRM. → recommend
@@ -92,19 +92,15 @@ reach), ask "live or dev?" before provisioning against it.
 
 ## 2. Safety rules
 
-- **Passwords land where they belong, and the two branches differ.**
-  `awesomate_app_provision_db` NEVER returns a password: it's set
-  server-side, stored encrypted, and injected as the app's `DATABASE_URL`
-  — there is nothing to show, so don't promise the user a password.
-  `awesomate_n8n_provision_pg` is the one that DOES return a password, once,
-  because it lives in the n8n credential and Awesomate never stores it. The
-  workflow doesn't need you to repeat it — the credential already holds it —
-  so say that, and only offer the value if the user actually needs it
-  elsewhere, warning that it has now passed through the transcript and
-  should be rotated. Never put a `DATABASE_URL` in a message. Tell the user where
-  it lives instead: "the app already has its connection — nothing for you
-  to copy." (After an app database is provisioned, the app needs a restart
-  or redeploy to pick it up.)
+- **Passwords land where they belong.** `awesomate_app_provision_db`
+  NEVER returns a password: it's set server-side, stored encrypted, and
+  injected as the app's `DATABASE_URL`. There is nothing to show, so don't
+  promise the user a password. A workflow Postgres password lives in the n8n
+  credential the user created; never ask for it and never put it, or a
+  `DATABASE_URL`, in a message. Tell the user where it lives instead: "the
+  app already has its connection, nothing for you to copy." (After an app
+  database is provisioned, the app needs a restart or redeploy to pick it
+  up.)
 - Secrets the user's own app code needs (API keys, tokens) go through
   the awesomate-credentials skill, never pasted into files or chat.
 - **Deleting data requires an explicit filter and an explicit yes.**
@@ -114,28 +110,22 @@ reach), ask "live or dev?" before provisioning against it.
 
 ## 3. Limits, honestly
 
-Everything that provisions here needs **Support Plus or above** — app
-databases (`awesomate_app_provision_db`), workflow Postgres
-(`awesomate_n8n_provision_pg`) and data tables alike. Data tables are NOT
-"any plan with n8n access": Essentials gets 0 creations a day, and both the
-table read and the write also need the "Build and change automations from Claude Code" toggle (§0(a)).
-
-Only some of it is capped per day:
-- `awesomate_n8n_provision_pg` — **2 a day**, flat; no plan raises it, so
-  don't pitch an upgrade for it.
-- Data table creations — **10 a day** on Support Plus and Pro (20 on
-  Embedded), 0 on Essentials. An instance also tops out at 50 data tables.
-- `awesomate_app_provision_db` — **no daily cap**. It's one database per
-  environment and refuses (409 `already_has_db`) if the app has one, so
-  there's nothing to ration.
-
-If the user's plan doesn't cover what branch (b) or (c) needs, say it once
-— "app databases are on Support Plus" — point them at
-hub.awesomate.ai/billing to upgrade, then help fully within what their plan
-allows. On Essentials that means none of (a), (b) or (c) is available —
-don't dangle a data table as the consolation prize; say so once and look at
-(d), keeping the data where it already lives and connecting to it. If a
-daily quota is hit, say when it resets and what can proceed meanwhile.
+App databases (`awesomate_app_provision_db`) need **Support Plus or
+above**. There is **no daily cap**: it's one database per environment and
+refuses (409 `already_has_db`) if the app has one, so there's nothing to
+ration.
+
+Data tables (a) and a workflow Postgres (c) are n8n's own features on every
+plan, with no Awesomate gate, limit or count: the user creates them in n8n
+and in cPanel. An instance tops out at 50 data tables (n8n's cap). Reading
+tables or credentials from here needs the "Let Claude Code work with your
+automations" toggle (§0(a)).
+
+If the user's plan doesn't cover what branch (b) needs, say it once ("app
+databases are on Support Plus"), point them at hub.awesomate.ai/billing to
+upgrade, then help fully within what their plan allows: on Essentials (a)
+and (c) still work, and so does (d), keeping the data where it already lives
+and connecting to it.
 
 Report every result as a business outcome: "your workflow now remembers
 every invoice it's processed, so no customer gets emailed twice" — with

package/skill/awesomate-hosting/SKILL.md

@@ -242,7 +242,7 @@ MCP, so say that rather than stopping.
 | `awesomate_domain_add` | Attach a custom domain to a site |
 | `awesomate_dns_check` | Live answer to "where does this domain actually point" — before and after any DNS change |
 | `awesomate_site_uptime` | 30-day availability, incidents, downtime per domain (cached, free) |
-| `awesomate_site_audit` | SEO + AEO build gates for one page, fetched as GPTBot — content present without JS, retrieval bots reachable, canonical, schema, structure, speed. Not plan-gated. Run it after any public-page change, and see the awesomate-seo skill for the fixes |
+| `awesomate_site_audit` | SEO + AEO build gates for one page, fetched as OAI-SearchBot (what ChatGPT search sees) — content present without JS, retrieval bots reachable, canonical, schema, structure, speed. Not plan-gated. Run it after any public-page change, and see the awesomate-seo skill for the fixes |
 | `awesomate_files` | Files on their automation account (public/, private/, temp/): put an image or download up and hand back its `public_url`, fetch what a workflow wrote, tidy a folder. Ask before make_public, a move into public/, or delete; `trash` shows what was deleted, and `empty_trash` erases it for good (show what goes, get a clear yes). Support Plus+, owner's file-folders switch on (`status` says what's missing). Guide: https://hub.awesomate.ai/docs/mcp/guides/files/ |
 | `awesomate_snapshot_site` | Before ANY change to a live site — files + DB restore point |
 | `awesomate_list_snapshots` | What restore points a site has |

package/skill/awesomate-n8n/SKILL.md

@@ -1,17 +1,19 @@
 ---
 name: awesomate-n8n
-description: Build, test, and fix the user's Awesomate-hosted n8n automations, data tables, and AI agents. Use when the user says "build me an automation", "automate this", "connect X to Y", "why did my workflow fail", "create a data table", "build an AI agent / chatbot", "make an n8n agent", "an agent I can talk to in Slack/Telegram", "what automations do I have", "what could I automate", or mentions n8n, workflows, executions, webhooks, the 1Brain node, or {slug}.awesomate.io. Reads and n8n Agents on every plan; building workflows needs Support Plus+. Companion to awesomate-hosting: same connection, same PAT.
+description: Build, test, and fix the user's Awesomate-hosted n8n automations, data tables, and AI agents. Use when the user says "build me an automation", "automate this", "connect X to Y", "why did my workflow fail", "create a data table", "build an AI agent / chatbot", "make an n8n agent", "an agent I can talk to in Slack/Telegram", "what automations do I have", "what could I automate", or mentions n8n, workflows, executions, webhooks, the 1Brain node, or {slug}.awesomate.io. Reads and n8n Agents on every plan; installing Awesomate templates needs Support Plus+; workflows are built through the client's own n8n MCP server, which Awesomate never sees or limits. Companion to awesomate-hosting: same connection, same PAT.
 ---
 
-# Awesomate n8n — your automations from Claude Code
+# Awesomate n8n: your automations from Claude Code
 
 The user's business runs n8n workflows on an Awesomate-hosted instance. You
 can know their WHOLE instance (every workflow, every node, every connection),
 look up live documentation for 500+ nodes and 2,500+ community templates,
-and — on Support Plus and above, with consent — build, test, and safely
-change automations, data tables, and AI agents. Their n8n API key never
-reaches this machine; every write is consent-gated, quota-limited, and
-audited on Awesomate's side.
+read every execution node by node, build n8n Agents, and install Awesomate's
+curated templates. Workflows themselves are written through the instance's
+OWN MCP server (n8n 2.x ships one), which the user connects to their Claude
+Code. Awesomate never sees that traffic, sets no limits on it and keeps no
+count. Their n8n API key never reaches this machine; every hub read is
+consent-gated and audited on Awesomate's side.
 
 **Routing rule:** live facts about THEIR instance come from tools; judgment
 and patterns come from references; node schemas come from
@@ -24,24 +26,27 @@ as outcomes ("your form now emails you") with URLs.
 
 ## 0. First run (every session)
 
-1. `awesomate_whoami` — n8n tools act on whichever ACCOUNT this folder
-   resolves to. Wrong slug → stop and fix the pin/connection first. Every
-   tool response is stamped `account: <slug>` — watch it.
-2. `awesomate_n8n_context` — cache the result:
-   - `consented: false` → give the user the `settingsUrl` and tell them
+1. `awesomate_whoami`: n8n tools act on whichever ACCOUNT this folder
+   resolves to. Wrong slug? Stop and fix the pin/connection first. Every
+   tool response is stamped `account: <slug>`. Watch it.
+2. `awesomate_n8n_context`, and cache the result:
+   - `consented: false`: give the user the `settingsUrl` and tell them
      where it lands: **n8n → Settings → Privacy** at
-     `hub.awesomate.ai/settings?tab=privacy` → "Build and change automations from Claude Code". Privacy moved there; the plain `/settings` page no longer
-     has it (old `?tab=privacy` links just redirect). Wait, then re-check.
-   - `403 missingScopes` → token predates n8n support — reconnect from
+     `hub.awesomate.ai/settings?tab=privacy` → "Let Claude Code work with
+     your automations". Privacy moved there; the plain `/settings` page no
+     longer has it (old `?tab=privacy` links just redirect). Wait, then
+     re-check.
+   - `403 missingScopes`: the token predates n8n support. Reconnect from
      hub.awesomate.ai/claude (Connect Claude Code card).
-   - `capabilities.builder: false` → reads only; building is Support Plus+.
-     Be honest about it once, then help fully within reads.
-   - `capabilities.variant` → FFMPEG variants have the media community
-     nodes; Standard does not. Never assume a node exists — verify.
-   - `limits` → daily build/test/datatable quotas; don't burn tests.
-   - `instance` → community packages + counts (your recon baseline).
+   - `capabilities.templateInstall: false`: Awesomate template installs
+     (§3a) are Support Plus+. Be honest about it once, then help fully with
+     everything else: reads, n8n Agents, and building through their own n8n
+     MCP server all work on every plan.
+   - `capabilities.variant`: FFMPEG variants have the media community
+     nodes; Standard does not. Never assume a node exists. Verify.
+   - `instance`: community packages + counts (your recon baseline).
 3. **Inventory pass** (before designing or diagnosing anything):
-   `awesomate_n8n_workflows` (no id — every workflow as a node summary in
+   `awesomate_n8n_workflows` (no id: every workflow as a node summary in
    ONE call) and, as needed, `awesomate_n8n_inspect` for `nodes`,
    `credentials`, `variables`, `datatables`. Cache this world picture for
    the session; refresh after your own writes.
@@ -54,19 +59,19 @@ as outcomes ("your form now emails you") with URLs.
    map, add its `instructionLine` from `awesomate_business_map` action `job`.
 
 Read [references/platform-notes.md](references/platform-notes.md) BEFORE
-designing or diagnosing — it is the live truth for THIS platform ($vars not
+designing or diagnosing. It is the live truth for THIS platform ($vars not
 $env, `$json.body`, task-runner limits, activation semantics). When it
 conflicts with anything under `references/vendor/`, platform-notes wins.
 
-## 0a. Health sweep — the guardian pattern
+## 0a. Health sweep: the guardian pattern
 
 At the START of any n8n session, alongside the context call: run
 `awesomate_n8n_errors` **with `days: 7`** and `awesomate_n8n_kpis` once. The
-`days` parameter is not optional in practice — the tool defaults to **30**,
+`days` parameter is not optional in practice: the tool defaults to **30**,
 so omitting it sweeps a month and dresses old, already-fixed failures up as
 this week's news. If something is failing, surface it in ONE line in the
-user's language — "two of your automations failed overnight — want me to
-look?" — before proceeding with the asked task. If everything is green, say
+user's language ("two of your automations failed overnight. Want me to
+look?") before proceeding with the asked task. If everything is green, say
 nothing and get on with it. Never let the sweep hijack the session; the
 user's ask comes first unless they say otherwise.
 
@@ -74,63 +79,64 @@ user's ask comes first unless they say otherwise.
 instance has no error history and no error-reporter workflow installed yet,
 so the sweep returns empty for the same reason it would on a flawless one.
 Check the inventory before you interpret it: no workflows, or workflows with
-no executions, means *there is nothing here yet* — say that, plainly
-("nothing has run yet, so there's nothing to report — want to build the
+no executions, means *there is nothing here yet*. Say that, plainly
+("nothing has run yet, so there's nothing to report. Want to build the
 first one?"). Never let "no errors found" imply "everything is working".
 
 When diagnosing, trust `errorSummary` only when `confident: true` (it then
 also carries `errorType`, `code`, `lastNodeExecuted`). When `confident:
-false`, the failing-node name came from a heuristic and may be WRONG — verify
+false`, the failing-node name came from a heuristic and may be WRONG. Verify
 the named node actually exists in the workflow before editing anything.
 
 ## 1. Tools
 
 | Task | Tool |
 |---|---|
-| Session context, consent, quotas, fingerprint | `awesomate_n8n_context` |
+| Session context, consent, capabilities, fingerprint | `awesomate_n8n_context` |
 | All workflows (node-level summaries) / one workflow (`detail: full\|structure`) | `awesomate_n8n_workflows` |
 | Node inventory, datatables (+rows), possibilities, credentials, $vars | `awesomate_n8n_inspect` |
 | Instance KPIs: exec totals, error rate, avg/p95 duration, time saved, 7d-vs-prior deltas (per-workflow adds `last_error_at` + `clean_days`) | `awesomate_n8n_kpis` |
-| Instance-WIDE error events grouped by fingerprint (category, workflow, node, occurrences, first/last seen) — "what is broken across everything" | `awesomate_n8n_errors` |
+| Instance-WIDE error events grouped by fingerprint (category, workflow, node, occurrences, first/last seen): "what is broken across everything" | `awesomate_n8n_errors` |
 | Execution/table/DB byte sizes + 24h per-workflow offenders ("your executions weigh 4GB") | `awesomate_n8n_storage` |
 | AI error-analyzer findings: clientSummary, needsClientAction, fixReady (Pro/Embedded + the **"Enable AI Error Diagnosis"** toggle under n8n → Settings → Privacy; read-only) | `awesomate_n8n_findings` |
-| Account-wide numbers in one call: executions by status, error rate, time saved, workflows total/active, chat sessions, 7-day trend, most recent live failure — the single best source for a status update or weekly report | `awesomate_dashboard_metrics` |
+| Account-wide numbers in one call: executions by status, error rate, time saved, workflows total/active, chat sessions, 7-day trend, most recent live failure. The single best source for a status update or weekly report | `awesomate_dashboard_metrics` |
 | Executions list / detail / node-by-node debug | `awesomate_n8n_executions` |
 | Node schemas, node search, community templates, node-level validation | `awesomate_n8n_node_docs` |
-| Validate / create draft / update draft / activate / promote / rollback / delete draft | `awesomate_n8n_deploy` |
 | **n8n Agents** (the Agents tab, n8n 2.41+, every plan): status, then create / edit / validate / test / publish / channels via n8n's own agent tools | `awesomate_n8n_agents` |
-| Fire a test payload at an active workflow | `awesomate_n8n_test` |
-| Awesomate's template library: list, detail, install_plan (pauses on a missing credential), install, redeem, installs, activate, test, rollback | `awesomate_n8n_library` |
+| Awesomate's template library (Support Plus+): list, detail, install_plan (pauses on a missing credential), install, redeem, installs, activate, test, rollback | `awesomate_n8n_library` |
 | Book a session with the Awesomate team from their credits (session_types, slots, book, mine) | `awesomate_book_session` |
-| Create/alter data tables, write rows | `awesomate_n8n_datatable_write` |
-| Provision a Postgres DB + n8n credential | `awesomate_n8n_provision_pg` |
-| Wire a tested webhook workflow into one of their hosted apps (stores URL + secret on the app; returns the secret ONCE for the workflow's header check) | `awesomate_n8n_attach_to_app` |
+| Wire any production webhook URL on their n8n into one of their hosted apps (stores URL + secret on the app; returns the secret ONCE for the workflow's header check) | `awesomate_n8n_attach_to_app` |
 | Refresh these skills from the latest package | `awesomate_skill_update` |
 
+**Writing workflows is not an Awesomate tool.** Creating, editing, publishing
+and running a workflow happens through the n8n instance's own MCP server,
+connected to this Claude Code by the user (§3, Phase 4). Reads, agents,
+template installs and app wiring are the hub's; the workflow JSON goes
+straight to their n8n.
+
 No `awesomate_n8n_*` tools in this session (fresh bootstrap, or the server
-didn't load)? Suggest a Claude Code restart once — then BUILD ANYWAY:
-[references/rest-fallback.md](references/rest-fallback.md) maps every tool
-to its REST endpoint, and the full loop works over it. Never tell the user
-they're blocked on a restart.
+didn't load)? Suggest a Claude Code restart once. If the n8n MCP server IS
+connected, you can still design and write workflows with it meanwhile; you
+just cannot ground the design in the hub's inventory or read executions
+until the Awesomate tools are back.
 
-## 2. References — read on demand
+## 2. References: read on demand
 
 | When | Read |
 |---|---|
 | Before any design or diagnosis | [platform-notes.md](references/platform-notes.md) |
 | Designing tests, judging "is it done" | [testing-policy.md](references/testing-policy.md) |
 | Anything involving data tables | [datatables.md](references/datatables.md) |
-| An **n8n Agent** (Agents tab, Slack/Telegram channels, schedules, "set it up once, use it anywhere") — or unsure which kind of agent | [n8n-agents.md](references/n8n-agents.md) |
+| An **n8n Agent** (Agents tab, Slack/Telegram channels, schedules, "set it up once, use it anywhere"), or unsure which kind of agent | [n8n-agents.md](references/n8n-agents.md) |
 | An AI Agent NODE inside a workflow / LLM steps | [ai-agents.md](references/ai-agents.md) |
 | A workflow is failing | [troubleshooting.md](references/troubleshooting.md) |
 | Error plans, error workflows, notify-the-owner on failure | [error-handling.md](references/error-handling.md) |
 | A weekly business report / "email me my numbers" | [recurring-reports.md](references/recurring-reports.md) |
-| Changing a LIVE workflow | [upgrade-loop.md](references/upgrade-loop.md) |
 | "What could I automate?" | [possibilities.md](references/possibilities.md) |
 | WordPress form → n8n | [wp-form-handler.md](references/wp-form-handler.md) |
 | **1Brain** in a workflow or agent: procedures, SOPs, policies, the `CUSTOM.oneBrain` node (check it is on the instance first). Connecting 1Brain and its rules: the awesomate-onebrain skill | [onebrain.md](references/onebrain.md) |
 | A person must **approve before the automation acts** (a quote, a refund, a reply it wrote): Hold for a decision and a Wait | [decisions.md](references/decisions.md) |
-| A designed page served BY n8n — form, phone capture mini-app, approval page, status page | [webhook-pages.md](references/webhook-pages.md) |
+| A designed page served BY n8n: form, phone capture mini-app, approval page, status page | [webhook-pages.md](references/webhook-pages.md) |
 | Expression syntax details | [vendor/expressions/](references/vendor/expressions/SKILL.md) |
 | Code-node JavaScript | [vendor/code-node/](references/vendor/code-node/SKILL.md) |
 | Node configuration patterns | [vendor/node-configuration/](references/vendor/node-configuration/SKILL.md) |
@@ -139,55 +145,85 @@ they're blocked on a restart.
 
 ## 3. The build loop (follow ALL six phases)
 
-**Phase 1 — Discovery.** Understand inputs/outputs, trigger, success
-criteria, error handling — in the user's words. Check the inventory FIRST:
+**Phase 1: Discovery.** Understand inputs/outputs, trigger, success
+criteria, error handling, in the user's words. Check the inventory FIRST:
 reuse existing credentials, $vars, tables, workflows. Email decision tree:
 existing Gmail/Google credential → reference its ID · none → offer an
-API-key credential (SMTP / Resend / SendGrid — instant) OR guided Gmail
+API-key credential (SMTP / Resend / SendGrid, instant) OR guided Gmail
 OAuth. A credential existing ≠ working.
 
 **Say the credential catch before they pick, not after it fails.** No tool
-creates a credential on their instance — the one exception is
-`awesomate_n8n_provision_pg`, which makes a Postgres one. Everything else,
-API-key credentials included, the user creates in n8n at
-`{instanceUrl}/home/credentials`; you then re-check the inventory to verify
-it exists. **Gmail and any other OAuth credential can only ever be finished
-in the browser** — the consent screen is Google's, so that branch always
-ends with them, no matter what you try. Flag it while they're choosing:
-*"Either way you'll paste it in on your n8n — an SMTP or Resend key is one
-box and a minute; Gmail means clicking through Google's permission screen.
-Tell me which and I'll give you the exact steps, then pick it up from
-there."*
-
-**Phase 2 — Design.** Resolve EVERY planned node and typeVersion via
-`awesomate_n8n_node_docs` (search similar community templates too — a
+creates a credential on their instance. Every credential, API-key ones
+included, the user creates in n8n at `{instanceUrl}/home/credentials`; you
+then re-check the inventory to verify it exists. **Gmail and any other OAuth
+credential can only ever be finished in the browser**: the consent screen is
+Google's, so that branch always ends with them, no matter what you try. Flag
+it while they're choosing: *"Either way you'll paste it in on your n8n. An
+SMTP or Resend key is one box and a minute; Gmail means clicking through
+Google's permission screen. Tell me which and I'll give you the exact steps,
+then pick it up from there."*
+
+**Phase 2: Design.** Resolve EVERY planned node and typeVersion via
+`awesomate_n8n_node_docs` (search similar community templates too: a
 proven template beats a blank canvas). Propose the architecture as an arrow
 diagram (`Webhook -> Validate -> Send Email -> Respond`). Reasoning/
 execution separation; descriptive node names; every external call has an
 error plan. Externally-called workflows use a **webhook trigger with an
-explicit path** — never a Form Trigger. Data the automation must remember
+explicit path**, never a Form Trigger. Data the automation must remember
 between runs → data table ([datatables.md](references/datatables.md)).
 
-**Phase 3 — Confirmation.** Present the design in plain words and wait for
+**Phase 3: Confirmation.** Present the design in plain words and wait for
 explicit approval. Never create anything on their instance without it.
 
-**Phase 4 — Implementation.** Compose the workflow JSON →
-`awesomate_n8n_deploy {action:'validate'}` and fix every error-severity
-issue → `{action:'create_draft'}` (the hub prefixes `[CLI] `, tags
-`awm:client-cli`, pre-assigns webhookIds, returns webhook URLs). Create any
-data tables with `workflowId` set so they land in the workflow's project.
-Iterate on the draft with `{action:'update_draft'}` — never recreate.
-
-**Phase 5 — Testing (mandatory — validated ≠ tested).** Full policy:
+**Phase 4: Implementation, through their n8n's own MCP server.** Writing
+happens on their n8n, not through Awesomate.
+
+- **Is it connected?** Look for the n8n server's tools in this session
+  (`search_workflows`, `get_workflow_details`, `create_workflow`,
+  `update_workflow`, `publish_workflow`, `execute_workflow`; the server is
+  usually named `n8n`). If they are there, build.
+- **If it is not connected, say so and hand the user the two steps.** Do not
+  pretend any Awesomate tool can create or change a workflow; none can.
+  1. Switch on MCP access and get the key, in their own n8n: **Settings →
+     MCP access** on `{instanceUrl}`. The hub's **Set it up for me** button
+     under **n8n Agents access** on `hub.awesomate.ai/n8n/settings` also
+     switches MCP access on. The key is theirs; never ask them to paste it
+     into the chat.
+  2. Add it to their Claude Code, in a terminal, with their own key in place
+     of the placeholder:
+     `claude mcp add --transport http n8n {instanceUrl}/mcp-server/http --header "Authorization: Bearer <their MCP key>"`
+     then restart Claude Code and carry on. Until then, keep designing:
+     everything up to Phase 3 needs only the Awesomate reads.
+- Compose the workflow JSON from the approved design. Check every node
+  against `awesomate_n8n_node_docs validate_node` before you write it, and
+  fix every error-severity issue (known false positives are listed in
+  platform-notes). Keep `settings.saveExecutionProgress` false yourself; the
+  hub no longer enforces it.
+- Create it with the n8n server's create tool. It lands unpublished. Give
+  the workflow a name the user will recognise in their n8n list; nothing
+  prefixes or tags it for you now. A webhook's production URL is
+  `{instanceUrl}/webhook/<path>`: take the path from the workflow you
+  created and `instanceUrl` from `awesomate_n8n_context`; never guess the
+  hostname.
+- Data tables: the user creates them in n8n (Data tables in the left menu),
+  or you do it through the n8n server if it offers a data-table tool; read
+  them back with `awesomate_n8n_inspect {what:'datatables'}` and reference
+  them by name. Full rules: [datatables.md](references/datatables.md).
+- Iterate with the n8n server's update tool on the same workflow id. Never
+  recreate under a new id: the webhook URLs change.
+
+**Phase 5: Testing (mandatory; validated ≠ tested).** Full policy:
 [testing-policy.md](references/testing-policy.md). Short form: approval →
-activate → `awesomate_n8n_test` with obviously-fake payloads → inspect the
-execution node-by-node (`awesomate_n8n_executions` with `debug: true` when
-available) → happy path + empty + malformed + error-branch routing → report
-what ran and what the human must verify ("check your inbox").
+publish through the n8n server → run it (the n8n server's execute tool, a
+POST to the production webhook with obviously fake data, or ask the user to
+trigger it) → inspect the execution node-by-node (`awesomate_n8n_executions`
+with `debug: true`) → happy path + empty + malformed + error-branch routing →
+report what ran and what the human must verify ("check your inbox").
 
-**Phase 6 — Wrap-up.** Give the workflow URL (`{instanceUrl}/workflow/{id}`),
-the webhook URL, and what happens next. Delete unneeded drafts
-(`delete_draft`, deactivated only).
+**Phase 6: Wrap-up.** Give the workflow URL (`{instanceUrl}/workflow/{id}`),
+the webhook URL, and what happens next. Remove any temporary test triggers
+and, with their OK, any throwaway workflows you created along the way
+(unpublish first, then delete, through the n8n server).
 
 ## 3a. Installing an Awesomate template (bundle)
 
@@ -243,12 +279,27 @@ check; use it when the member has a token, otherwise use the catalog.
 
 ## 4. Changing a LIVE workflow
 
-Never edit a live workflow directly, and never "activate the copy" — the
-copy has different webhook URLs and every external caller breaks. Draft →
-test → present a human-readable diff → explicit approval → `promote` (swaps
-the tested draft INTO the live id, webhookIds preserved) → verify the
-ORIGINAL URL → `rollback` with the returned operationId on any failure.
-Full procedure: [upgrade-loop.md](references/upgrade-loop.md).
+A live workflow is changed through the n8n server's update tool on its OWN
+id, then republished. **Never build a copy and "activate the copy" in its
+place**: the copy has different webhook URLs and every external caller
+breaks. The order:
+
+1. Read the live workflow (`get_workflow_details`) and the inventory; note
+   its webhook paths and `settings.errorWorkflow`.
+2. Make the change in a throwaway copy first when the edit is more than a
+   parameter tweak, test it there, and read the execution with
+   `awesomate_n8n_executions` debug. The copy is for testing only; it never
+   goes live.
+3. Present a human-readable diff of what will change in the live one and
+   wait for explicit approval.
+4. Apply the same change to the LIVE workflow id with the update tool, keep
+   the webhook paths, and republish it.
+5. Verify the ORIGINAL URL still answers (a test fire or the user's own
+   trigger), then inspect the new run. Delete the throwaway copy.
+
+There is no automatic rollback now. Before step 4 keep the live workflow's
+full JSON from step 1 so that, if the new version misbehaves, you can put the
+previous one back with the same update tool.
 
 ## 5. Diagnosing a failure
 
@@ -257,36 +308,42 @@ usually upstream) → `debug: true` for node-level output → check against
 [troubleshooting.md](references/troubleshooting.md) → explain in the user's
 terms with the exact fix. Trust `errorSummary` only on `confident: true`
 (§0a). While you're there, check whether the workflow has an error plan at
-all — [error-handling.md](references/error-handling.md). Self-built workflows: fix via update_draft or the
-upgrade loop. Agency-managed (`agency_managed` error): read and explain
-freely, and switch it off or on if the user asks (say what it does first);
-any other change goes through Awesomate support.
+all ([error-handling.md](references/error-handling.md)). Self-built
+workflows: fix through the n8n server's update tool (§4 when it is live), then
+re-run and re-inspect. Agency-managed (`agency_managed` error): read and
+explain freely, and switch it off or on if the user asks (say what it does
+first); any other change goes through Awesomate support.
 
 ## 6. "What could I automate?"
 
 `awesomate_n8n_inspect {what:'possibilities'}` returns facts; YOU make the
-suggestions — grounded, ≤8, honestly labelled with what each needs. Rules:
+suggestions: grounded, ≤8, honestly labelled with what each needs. Rules:
 [possibilities.md](references/possibilities.md). Offer it once, in one
 sentence, after the first inventory pass when the user's ask is vague. One
-standing recipe worth offering: the weekly business pulse —
-[recurring-reports.md](references/recurring-reports.md).
+standing recipe worth offering: the weekly business pulse
+([recurring-reports.md](references/recurring-reports.md)).
 
 ## 7. Hard rules
 
-- **Never ask for their n8n API key.** Unreachable = consent/scope/plan —
-  route to settings or reconnect.
-- **Explicit approval gates:** before create_draft (design confirmation),
-  activate, promote, rollback, delete (draft or rows), and any test with
-  non-email side effects (CRM writes, payments: STOP and ask).
-- **Agency-deployed workflows and their data tables are read-only** — the
-  hub enforces it; don't fight the 403.
-- **Never activate a copy of a live workflow.** Promote exists for this.
-- **Respect quotas** — 429 quota_exceeded is the plan's daily cap; tell the
-  user, don't retry-loop.
-- **`saveExecutionProgress` stays false.** The hub enforces it; don't work
-  around it.
-- **Real side effects run in tests** — user's own email, `[TEST]` prefixes,
-  tell them first.
+- **Never ask for their n8n API key, or their n8n MCP key.** Unreachable =
+  consent/scope/plan: route to settings or reconnect. The MCP key goes into
+  their own `claude mcp add` command, never into the chat.
+- **Explicit approval gates:** before creating a workflow (design
+  confirmation), publishing, changing a live workflow, deleting anything
+  (workflows or rows), installing or rolling back a template, and any test
+  with non-email side effects (CRM writes, payments: STOP and ask).
+- **Agency-deployed workflows and their data tables are read-only.** The
+  hub enforces it for its own tools; honour it through the n8n server too.
+  Switch on/off only, on the user's say-so; every other change goes to
+  Awesomate support.
+- **Never activate a copy of a live workflow.** Change the live one on its
+  own id (§4).
+- **`saveExecutionProgress` stays false.** Nothing enforces it for you any
+  more: set it false on every workflow you write and never switch it on to
+  get richer debug data (`debug: true` on executions is the inspection
+  path).
+- **Real side effects run in tests:** the user's own email, `[TEST]`
+  prefixes, tell them first.
 - **WordPress forms:** POST server-side from WP to the webhook (forwarder
-  snippet — [wp-form-handler.md](references/wp-form-handler.md)), never
+  snippet, [wp-form-handler.md](references/wp-form-handler.md)), never
   from the browser.

package/skill/awesomate-n8n/evals/n8n-agent-build/graders/grader.md

@@ -8,7 +8,8 @@ triggers.
 ## Pass criteria
 
 1. The right primitive: the build uses `awesomate_n8n_agents` (an n8n Agent),
-   not a workflow with a Chat Trigger + AI Agent node via `awesomate_n8n_deploy`.
+   not a workflow with a Chat Trigger + AI Agent node written through the n8n
+   MCP server.
 2. Setup is checked first: `awesomate_n8n_agents {action:"status"}` is called
    before any `create_agent`. If it reports `keyConfigured:false` or a setup
    code, the assistant relays the setup steps in plain words and does NOT ask