n8n-mcp-community 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,116 @@
+# Changelog
+
+All notable changes to this project will be documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and releases use
+[Semantic Versioning](https://semver.org/).
+
+## [Unreleased]
+
+## [0.1.0] - 2026-07-20
+
+### Added
+
+- Secure stdio MCP runtime with exactly 44 tools, five resources, and four prompts.
+- Three operation modes with exact confirmations for unsafe calls.
+- Deterministic local Introspect engine v2 with 23 diagnostic rules.
+- Strict Node 22/24 test, build, dependency-license, and package gates.
+- Native-English public documentation and complete tool reference.
+- Embedded synthetic terminal demonstration with a packaged transcript and an
+  automated orphan-asset documentation gate.
+
+- Optional `doctor` floor-compatibility probe behind `N8N_MCP_DOCTOR_PROBE=1`:
+  two bounded single-item reads diagnose `floor_compatible`,
+  `below_floor_indicators`, or `inconclusive` without claiming a remote version.
+
+### Changed
+
+- Every confirmation-guarded tool now documents its exact required confirmation
+  phrase (for example `DELETE <workflowId>`) directly in the `confirmation`
+  field description, derived from the tool's own confirmation function so the
+  documented and enforced phrases can never drift. The phrase is discoverable in
+  the tool schema an MCP client sees, yet is still never echoed back on a
+  mismatch, so the deliberate-action guard is preserved.
+
+### Fixed
+
+- Redact URL userinfo credentials, cookie and session values, suffixed secret
+  keys, and complete quoted multi-word secrets in strings.
+- Reject API keys that are illegal HTTP header values at configuration load and
+  keep request-construction failures value-free.
+- Validate surgical node updates against per-field type contracts and
+  re-validate the mutated node before any write reaches n8n.
+- Stop re-validating trusted server round-trip data under caller input rules so
+  workflows with large or prototype-keyed upstream data remain updatable.
+- Reject out-of-bounds array indexes in update paths instead of fabricating
+  sparse null elements.
+- Exclude pinned data from workflow-diff and introspect reads, and fail before
+  writing when an instance omits workflow version identity.
+- Distinguish below-floor endpoint absence from retention pruning in
+  version-history errors and add version-floor guidance to floor-marker 404s.
+- Tolerate name-only credential references in usage scans and expose value-free
+  coverage counts instead of aborting.
+- Report over-cap successful mutations as truncated successes, derive
+  execution-stop outcomes from the validated upstream body, and preserve
+  completed credential-test outcomes by truncating over-long diagnostics.
+- Map upstream response-shape mismatches to a stable `upstream_shape_mismatch`
+  code without exposing schema internals.
+- Emit stable, secret-free configuration reason codes aligned with `doctor`
+  guidance, and end broken-stdio sessions with one structured stderr line.
+- Count literal secrets in canonical `{name, value}` parameter entries and
+  recognize core entry nodes without "trigger" in their type names.
+- Authenticate artifact-baseline approval receipts with an operator-held HMAC
+  key, bind `server.json` and SBOM digests to the reviewed baseline, verify the
+  MCPB dependency file count, and pin gitleaks and npm versions in CI.
+- Remove private identifiers from the public-language gate, scan the gate
+  itself, and align registry metadata with the HTTP(S) connection contract.
+
+- Report all mutable node execution-behavior fields in value-free workflow
+  diffs instead of silently omitting nine supported fields, while normalizing
+  absent and explicit `false` default-false flags.
+- Validate the real n8n invitation response, report truthful delivery metadata,
+  and keep capability-bearing invitation URLs out of MCP output.
+- Invoke npm, npx-compatible execution, and MCPB through JavaScript entrypoints
+  so package, audit, baseline, and bundle gates remain shell-free and portable
+  on Windows and Corepack-managed layouts.
+- Encode every valid email selector as one RFC 3986-safe path segment, including
+  apostrophe-containing addresses accepted by the public input contract.
+- Reject retained workflow snapshots whose returned version identity differs
+  from either selector requested by the workflow-diff tool.
+- Publish every tool input and output schema fully inline. Reusing one Zod
+  instance across two properties of the same tool previously emitted
+  intra-schema `$ref` pointers that not every MCP client resolves.
+
+### Security
+
+- Same-origin Public API client with redirect rejection, timeouts, body limits,
+  boundary validation, output redaction, and zero-request policy denial.
+- Official documentation URLs and validated Introspect identifiers survive
+  output sanitization. Untrusted values that merely look similar stay redacted.
+- All 23 Introspect rule identifiers come from one closed list. Long workflow
+  identifiers receive bounded hash suffixes so distinct findings stay distinct.
+- Introspect detects stored non-positive node type versions and keeps partial
+  reports within their output budget after synchronizing disclosed findings.
+- Git ignores and index checks reject every `.env*` form and transient npm or
+  MCPB artifact. Only fixed public CA slots may appear during an active release
+  transition.
+- Executable metadata gates protect the private-to-public transition. Semgrep
+  rules are pinned to an exact commit instead of a mutable remote alias.
+- Changelog anchors handle prerelease versions, both release-verification layers
+  enforce fixed certificate paths, and a real `private: false` package survives
+  pack and install.
+- Public certificates must be regular files. CI pins exact runners and Node
+  versions for Linux, macOS, and Windows.
+- Explicit rejection tests for inconsistent package/signing states, an isolated
+  empty-cache public-package round trip, package-derived Markdown scan coverage,
+  and a SemVer-constrained unpublished-candidate anchor.
+- Artifact receipts are required only for a publishable `private: false`
+  candidate. Private development remains fully automated, while an absent or
+  stale receipt still blocks the actual release transition.
+- Public-boundary verification now rejects shallow checkouts and scans every
+  changed path in the complete ancestry reachable from `HEAD` and all locally
+  available refs. Deleted SDDs, private-development receipts, local context,
+  credentials, keys, and generated release artifacts cannot survive in that
+  publishable history; authenticated public release receipts remain supported.
+
+[Unreleased]: https://github.com/drzamarian/n8n-mcp-community/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/drzamarian/n8n-mcp-community/releases/tag/v0.1.0

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,51 @@
+# Contributor Covenant Code of Conduct
+
+## Our pledge
+
+We pledge to make participation in this project a harassment-free experience
+for everyone, regardless of age, body size, visible or invisible disability,
+ethnicity, sex characteristics, gender identity and expression, level of
+experience, education, socioeconomic status, nationality, personal appearance,
+race, caste, color, religion, or sexual identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our standards
+
+Positive behavior includes demonstrating empathy, respecting differing
+viewpoints and experiences, giving and accepting constructive feedback,
+accepting responsibility and apologizing for mistakes, and focusing on what is
+best for the community.
+
+Unacceptable behavior includes sexualized language or imagery, trolling,
+insulting or derogatory comments, personal or political attacks, public or
+private harassment, publishing another person's private information without
+permission, and other conduct reasonably considered inappropriate in a
+professional setting.
+
+## Enforcement responsibilities
+
+Project maintainers are responsible for clarifying and enforcing acceptable
+behavior and may remove, edit, or reject contributions, comments, commits, code,
+issues, and other contributions that are not aligned with this Code of Conduct.
+
+## Scope
+
+This Code applies within project spaces and when an individual officially
+represents the project in public spaces.
+
+## Enforcement
+
+Report abusive, harassing, or otherwise unacceptable behavior through a private
+maintainer channel. Until a dedicated conduct address is published, request a
+private contact through a non-sensitive GitHub issue. Do not include personal or
+sensitive details in the public request.
+
+All complaints will be reviewed promptly and fairly. Maintainers will respect
+the privacy and security of reporters.
+
+## Attribution
+
+This Code of Conduct is adapted from the Contributor Covenant, version 2.1,
+available at <https://www.contributor-covenant.org/version/2/1/code_of_conduct.html>.

package/CONTRIBUTING.md

@@ -0,0 +1,69 @@
+# Contributing
+
+Thank you for helping make n8n MCP Community safer and more useful. Changes are
+welcome when they preserve the Community Edition scope, the exact documented
+tool contract, and the project's data-minimization defaults.
+
+## Before you begin
+
+- Read the [security model](docs/security-model.md) and
+  [architecture](docs/architecture.md).
+- Use synthetic fixtures only. Never submit real credentials, workflows,
+  executions, instance URLs, cookies, or identifying data.
+- For a vulnerability, follow [SECURITY.md](SECURITY.md) instead of opening a
+  public issue.
+- Discuss a new tool or public behavior before implementing it. Tool additions
+  change the compatibility, documentation, and release contract.
+
+## Development setup
+
+Node.js 22 and 24 are the supported development lines.
+
+```bash
+npm ci
+npm run check
+```
+
+The complete gate covers formatting, dependency licenses and notices, strict
+TypeScript, the full automated test suite, a real stdio inventory check, and the
+production build.
+Run `npm run sbom > sbom.cdx.json` when reviewing dependency changes.
+
+## Branch and commit conventions
+
+- Create a focused branch from `dev`: `feat/<topic>`, `fix/<topic>`,
+  `docs/<topic>`, or `chore/<topic>`.
+- Keep changes small and traceable. Avoid unrelated refactors.
+- Use Conventional Commit subjects such as `feat:`, `fix:`, `docs:`,
+  `test:`, or `chore:`.
+- Never commit `.env`, generated packages, build output, logs, or secrets.
+- Do not force-push a shared review branch.
+
+## Pull requests
+
+A pull request should explain the problem, the chosen minimal change, security
+and compatibility impact, tests performed, and documentation updated. Every
+tool change must update both the runtime contract and
+[docs/tools.md](docs/tools.md). A registration-only tool is not acceptable.
+
+Reviewers will check:
+
+- Community Edition support through a documented Public API path;
+- operation mode and MCP annotations matching actual side effects;
+- input validation before upstream requests;
+- response allowlisting, redaction, pagination, and size limits;
+- zero-request denial for invalid or unauthorized operations;
+- Node 22 and 24 behavior;
+- documentation and inventory parity;
+- package, provenance, and license impact.
+
+All actionable review findings must be resolved or explicitly dispositioned with
+evidence before merge. `dev` is the integration branch; releasable changes reach
+`main` only through the reviewed release process.
+
+## Style
+
+Write code, tests, comments, commit messages, issues, and documentation in clear
+native-quality English. TypeScript is strict, `any` is prohibited, and external
+data must be validated at the boundary. Prefer the smallest implementation that
+satisfies the actual contract.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Walter Zamarian Jr.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,271 @@
+# n8n MCP Community
+
+**A security-focused Model Context Protocol server for self-hosted n8n Community Edition.**
+
+Connect an MCP client to n8n through 44 carefully bounded tools for workflows,
+executions, credentials, tags, users, diagnostics, and instance metadata. The
+server starts offline, defaults to read-only, uses the supported n8n Public API,
+and never sends workflow data to an external AI provider.
+
+> **v0.1.0:** install the exact published version or use a source checkout. See
+> [Installation](docs/installation.md) for the pinned npm and signed MCPB
+> options.
+
+[Read the synthetic terminal demo transcript](docs/demo-transcript.md). It shows
+the planned exact-version startup, 44-tool inventory, and local Introspect
+diagnostics using only synthetic identifiers and documented output shapes.
+
+[![Animated synthetic terminal demonstration showing the planned exact-version startup, MCP inventory, and local Introspect result](docs/assets/demo.gif)](docs/demo-transcript.md)
+
+## Why this project
+
+- **Community Edition first.** The release surface is designed for self-hosted
+  n8n Community Edition, without presenting paid-only capabilities as available.
+- **44 useful tools, one explicit contract.** Every tool has bounded inputs,
+  documented side effects, MCP safety annotations, and contract tests.
+- **Safe by default.** Read-only mode is the default. Writes and destructive or
+  externally contacting operations require progressively stronger gates.
+- **Deterministic Introspect.** `n8n_introspect` runs a local 23-rule engine;
+  it does not execute workflows, call an agent, or contact an external model.
+- **Surgical node updates.** `n8n_update_node` changes one validated node path
+  while preserving the rest of the workflow and disclosing the Public API's
+  non-atomic limitation.
+- **Truthful discovery.** `n8n_list_node_types` reports only types observed in
+  accessible workflows. It does not claim to be a complete installed catalog.
+- **Data minimization.** Credential values, raw execution values, pin data, and
+  static workflow data are not returned by the generic public tools.
+
+## Current verification
+
+The current source candidate has been verified with:
+
+- exactly **44 tools**, **5 resources**, and **4 prompts** over real stdio;
+- **271 passing tests** and the complete verification gate on Node.js 22.23.1
+  and 24.18.0;
+- zero findings from Gitleaks, Semgrep, Trivy, and both production/full
+  `npm audit` runs; all three source scanners are reproduced in CI, with
+  immutable scanner/action identities;
+- a reproducible dependency-license gate covering 224 installed package paths;
+- bounded same-origin HTTP contracts and zero-request policy-denial tests;
+- all 44 compiled tool lifecycles on disposable n8n Community 2.30.5 and 2.30.7
+  instances with egress isolation, revoked keys, cleanup, and zero residue; and
+- a clean-installed npm tarball plus a byte-reproducible unsigned MCPB with the
+  same compiled runtime and complete production dependency notices.
+
+Publication proceeds only through the reviewed release procedure: the
+repository-pinned MCPB signing identity, a human artifact-baseline receipt,
+tag-scoped protected-environment approval, and an externally signed MCPB
+handoff verified byte for byte against the reviewed unsigned candidate.
+
+## Quick start from source
+
+Requirements: Node.js 22 or 24, npm, a self-hosted n8n Community Edition
+instance, and an n8n Public API key with only the permissions you need.
+
+```bash
+npm ci
+npm run build
+```
+
+Configure your MCP client to run the compiled stdio entry point:
+
+```json
+{
+  "mcpServers": {
+    "n8n-community": {
+      "command": "node",
+      "args": ["/absolute/path/to/n8n-mcp-community/dist/index.js"],
+      "env": {
+        "N8N_API_URL": "https://n8n.example.com",
+        "N8N_API_KEY": "replace-with-your-api-key",
+        "N8N_MCP_MODE": "read-only"
+      }
+    }
+  }
+}
+```
+
+Restart the MCP client and list tools. The server can initialize and expose its
+inventory without n8n credentials; connected tools validate the URL and API key
+only when called.
+
+The release provides both a signed MCPB for compatible clients and
+exact-version `npx` configuration for portability. `@latest`, global installs,
+and `curl | shell` are not reproducible defaults. See
+[Installation](docs/installation.md) for the release policy and client-specific
+guidance.
+
+## Safety modes
+
+| Mode      | What it allows                                                    | Required configuration                                     |
+| --------- | ----------------------------------------------------------------- | ---------------------------------------------------------- |
+| Read-only | Read-only tools only                                              | Default, or `N8N_MCP_MODE=read-only`                       |
+| Write     | Read-only and mutation tools without the unsafe confirmation gate | `N8N_MCP_MODE=write`                                       |
+| Unsafe    | All tools                                                         | `N8N_MCP_MODE=unsafe` plus the exact per-call confirmation |
+
+Unsafe mode is necessary but not sufficient. Every unsafe call also requires a
+confirmation such as `DELETE wf_123`, `STOP exec_123`, or `TEST cred_123`.
+The n8n API key remains the final upstream permission boundary.
+
+Plain HTTP is accepted automatically only for loopback URLs. A non-loopback
+HTTP instance additionally requires `N8N_ALLOW_INSECURE_HTTP=1`, which accepts
+the risk of exposing the API key and data in transit.
+
+## Tool catalog
+
+Every entry links to its complete input, output, endpoint, compatibility,
+failure, and security reference.
+
+### Workflows
+
+| Tool                                                                   | Mode      | Purpose                                                                |
+| ---------------------------------------------------------------------- | --------- | ---------------------------------------------------------------------- |
+| [`n8n_workflows_list`](docs/tools.md#n8n_workflows_list)               | Read-only | List accessible workflows with bounded filters and pagination.         |
+| [`n8n_workflows_get`](docs/tools.md#n8n_workflows_get)                 | Read-only | Read one workflow while withholding pin and static data values.        |
+| [`n8n_workflows_create`](docs/tools.md#n8n_workflows_create)           | Write     | Create a validated workflow through the Public API.                    |
+| [`n8n_workflows_update`](docs/tools.md#n8n_workflows_update)           | Write     | Guard and update selected fields while preserving omitted fields.      |
+| [`n8n_update_node`](docs/tools.md#n8n_update_node)                     | Write     | Change one validated node property with non-atomic concurrency guards. |
+| [`n8n_workflows_delete`](docs/tools.md#n8n_workflows_delete)           | Unsafe    | Permanently delete one workflow after exact confirmation.              |
+| [`n8n_workflows_activate`](docs/tools.md#n8n_workflows_activate)       | Unsafe    | Activate one workflow after exact confirmation.                        |
+| [`n8n_workflows_deactivate`](docs/tools.md#n8n_workflows_deactivate)   | Unsafe    | Deactivate one workflow after exact confirmation.                      |
+| [`n8n_workflows_get_version`](docs/tools.md#n8n_workflows_get_version) | Read-only | Retrieve one retained historical workflow version.                     |
+| [`n8n_workflows_get_tags`](docs/tools.md#n8n_workflows_get_tags)       | Read-only | List tags assigned to a workflow.                                      |
+| [`n8n_workflows_update_tags`](docs/tools.md#n8n_workflows_update_tags) | Write     | Replace a workflow's complete tag assignment.                          |
+| [`n8n_workflows_archive`](docs/tools.md#n8n_workflows_archive)         | Unsafe    | Archive one workflow after exact confirmation.                         |
+| [`n8n_workflows_unarchive`](docs/tools.md#n8n_workflows_unarchive)     | Unsafe    | Restore one archived workflow after exact confirmation.                |
+| [`n8n_workflows_diff`](docs/tools.md#n8n_workflows_diff)               | Read-only | Compare nodes and connections without returning raw values.            |
+
+### Executions
+
+| Tool                                                           | Mode      | Purpose                                                            |
+| -------------------------------------------------------------- | --------- | ------------------------------------------------------------------ |
+| [`n8n_executions_list`](docs/tools.md#n8n_executions_list)     | Read-only | List execution metadata with value-free data-presence summaries.   |
+| [`n8n_executions_get`](docs/tools.md#n8n_executions_get)       | Read-only | Read one execution's metadata without returning workflow payloads. |
+| [`n8n_executions_delete`](docs/tools.md#n8n_executions_delete) | Unsafe    | Permanently delete a saved execution.                              |
+| [`n8n_executions_retry`](docs/tools.md#n8n_executions_retry)   | Unsafe    | Retry an eligible saved execution.                                 |
+| [`n8n_executions_stop`](docs/tools.md#n8n_executions_stop)     | Unsafe    | Stop one running execution and bind identity from validated input. |
+
+### Credentials
+
+| Tool                                                             | Mode      | Purpose                                                                |
+| ---------------------------------------------------------------- | --------- | ---------------------------------------------------------------------- |
+| [`n8n_credentials_create`](docs/tools.md#n8n_credentials_create) | Write     | Create a credential without returning its values.                      |
+| [`n8n_credentials_delete`](docs/tools.md#n8n_credentials_delete) | Unsafe    | Permanently delete one credential.                                     |
+| [`n8n_credentials_schema`](docs/tools.md#n8n_credentials_schema) | Read-only | Read the public schema for a credential type.                          |
+| [`n8n_credentials_list`](docs/tools.md#n8n_credentials_list)     | Read-only | List credential metadata verified on n8n 2.30.5 and 2.30.7.            |
+| [`n8n_credentials_get`](docs/tools.md#n8n_credentials_get)       | Read-only | Read one credential's public metadata.                                 |
+| [`n8n_credentials_update`](docs/tools.md#n8n_credentials_update) | Write     | Update credential metadata or values without echoing secrets.          |
+| [`n8n_credentials_test`](docs/tools.md#n8n_credentials_test)     | Unsafe    | Test a stored credential, potentially contacting its external service. |
+| [`n8n_credentials_usage`](docs/tools.md#n8n_credentials_usage)   | Read-only | Find exact credential-ID references in one bounded workflow page.      |
+
+### Tags
+
+| Tool                                               | Mode      | Purpose                                          |
+| -------------------------------------------------- | --------- | ------------------------------------------------ |
+| [`n8n_tags_list`](docs/tools.md#n8n_tags_list)     | Read-only | List workflow tags.                              |
+| [`n8n_tags_get`](docs/tools.md#n8n_tags_get)       | Read-only | Read one tag.                                    |
+| [`n8n_tags_create`](docs/tools.md#n8n_tags_create) | Write     | Create a tag with the live 1–24 character bound. |
+| [`n8n_tags_update`](docs/tools.md#n8n_tags_update) | Write     | Rename a tag with the live 1–24 character bound. |
+| [`n8n_tags_delete`](docs/tools.md#n8n_tags_delete) | Unsafe    | Permanently delete one tag.                      |
+
+### Users
+
+| Tool                                                 | Mode      | Purpose                                                           |
+| ---------------------------------------------------- | --------- | ----------------------------------------------------------------- |
+| [`n8n_users_list`](docs/tools.md#n8n_users_list)     | Read-only | List users visible to the API key.                                |
+| [`n8n_users_get`](docs/tools.md#n8n_users_get)       | Read-only | Read one user by stable ID or exact email.                        |
+| [`n8n_users_create`](docs/tools.md#n8n_users_create) | Unsafe    | Invite a member or admin after exact email confirmation.          |
+| [`n8n_users_delete`](docs/tools.md#n8n_users_delete) | Unsafe    | Delete one API-eligible user without unsupported transfer claims. |
+
+### Diagnostics and instance metadata
+
+| Tool                                                                       | Mode      | Purpose                                                             |
+| -------------------------------------------------------------------------- | --------- | ------------------------------------------------------------------- |
+| [`n8n_health`](docs/tools.md#n8n_health)                                   | Read-only | Perform a bounded same-origin health check.                         |
+| [`n8n_insights_summary`](docs/tools.md#n8n_insights_summary)               | Read-only | Read the official insights summary with optional date filters.      |
+| [`n8n_audit_generate`](docs/tools.md#n8n_audit_generate)                   | Unsafe    | Generate n8n's instance security audit after exact confirmation.    |
+| [`n8n_search_workflows`](docs/tools.md#n8n_search_workflows)               | Read-only | Search one workflow page locally by name, node type, or tag.        |
+| [`n8n_get_node_docs`](docs/tools.md#n8n_get_node_docs)                     | Read-only | Read one of four immutable offline core-node references.            |
+| [`n8n_list_node_types`](docs/tools.md#n8n_list_node_types)                 | Read-only | Inventory node types observed in bounded accessible workflow pages. |
+| [`n8n_introspect`](docs/tools.md#n8n_introspect)                           | Read-only | Run deterministic local workflow and execution diagnostics.         |
+| [`n8n_community_packages_list`](docs/tools.md#n8n_community_packages_list) | Read-only | List installed community-package metadata without mutation paths.   |
+
+## Resources and prompts
+
+The server also exposes five static resources:
+
+- `n8n://usage-guide`
+- `n8n://node-docs/webhook`
+- `n8n://node-docs/code`
+- `n8n://node-docs/http-request`
+- `n8n://node-docs/if`
+
+Four prompts guide safe workflow creation, debugging, optimization, and
+credential management: `create-workflow`, `debug-workflow`,
+`optimize-workflow`, and `manage-credentials`.
+
+## Security model in one minute
+
+- The server uses local stdio; it does not expose an inbound HTTP listener.
+- Connected requests are same-origin and limited to the configured n8n host.
+- Redirects are rejected; request and response bodies are bounded to 2 MiB.
+- Generic output is validated, sanitized, bounded to 256 KiB, and wrapped as
+  `{ "data": ..., "redacted": boolean, "untrusted": true }`.
+- Raw credential values and generic execution payload values are never returned.
+- `n8n_introspect` uses fixed local rules and has no external-model code path.
+- Security controls reduce risk; they do not make untrusted n8n content safe to
+  execute or authorize broader API-key permissions.
+
+Read the complete [security model](docs/security-model.md) and use
+[SECURITY.md](SECURITY.md) to report a vulnerability privately.
+
+## Documentation
+
+- [Documentation map](docs/README.md)
+- [Getting started](docs/getting-started.md)
+- [Installation and upgrades](docs/installation.md)
+- [Configuration](docs/configuration.md)
+- [Complete tool reference](docs/tools.md)
+- [Tested examples](docs/examples.md)
+- [FAQ](docs/faq.md)
+- [Client configuration](docs/clients.md)
+- [Architecture](docs/architecture.md)
+- [Security model](docs/security-model.md)
+- [Compatibility](docs/compatibility.md)
+- [Troubleshooting](docs/troubleshooting.md)
+- [Provenance](docs/provenance.md)
+- [Roadmap](ROADMAP.md)
+- [Changelog](CHANGELOG.md)
+
+## Development
+
+```bash
+npm ci
+npm run check
+npm run sbom > sbom.cdx.json
+```
+
+`npm run check` verifies formatting, dependency licenses/notices, strict
+TypeScript, all tests, the compiled runtime, and documentation inventory parity.
+See [CONTRIBUTING.md](CONTRIBUTING.md) before opening a change.
+
+## Scope and non-affiliation
+
+This project is not affiliated with, endorsed by, or sponsored by n8n GmbH.
+“n8n” is used only to identify compatibility with the n8n product and Public
+API. The project does not redistribute the `n8n-nodes-base` catalog and does not
+use browser cookies, interactive session routes, or runtime package downloads to
+construct one.
+
+The v0.1.0 surface intentionally excludes arbitrary workflow execution,
+credential/workflow transfer, folders, data tables, beta evaluation endpoints,
+and execution annotations. See the [roadmap](ROADMAP.md) for the annotation
+proposal retained outside the release target.
+
+## License and maintainer
+
+The project is released under the [MIT License](LICENSE). Third-party
+dependencies retain their own licenses.
+
+Created and maintained by
+[Dr. Walter Zamarian Jr.](https://www.walterzamarianjr.com/).

package/ROADMAP.md

@@ -0,0 +1,41 @@
+# Roadmap
+
+This roadmap communicates direction, not a promise of features or dates. A
+proposal enters the release surface only after a versioned specification,
+Community Edition evidence, security review, documentation, tests, and
+maintainer approval.
+
+## v0.1.0 release gate
+
+- Complete native-English documentation and inventory parity.
+- Pass disposable release-candidate lifecycles on n8n Community 2.30.5 and
+  2.30.7 using synthetic data and no production credentials.
+- Inspect clean npm and MCPB artifacts, SBOMs, checksums, signatures, and
+  dependency notices.
+- Pass two independent adversarial implementation audits with zero actionable
+  findings.
+- Enable repository security controls before the first public release.
+
+## Accepted backlog proposal
+
+Execution annotations remain a coherent two-tool proposal outside v0.1.0:
+
+- `n8n_executions_get_tags`
+- `n8n_executions_update_tags`
+
+They will not be added individually. A future proposal must prove that both
+operate through supported Community Edition endpoints and define strict IDs,
+write policy, bounds, redaction, tests, and migration behavior.
+
+## Areas for future evaluation
+
+- Additional deterministic Introspect rules backed by counterexamples and
+  stable evidence.
+- More immutable offline node references where provenance and maintenance cost
+  are clear.
+- Client-specific MCPB installation verification as compatible clients evolve.
+- Performance and pagination improvements justified by measured workloads.
+
+Folders, data tables, beta evaluation APIs, paid-only project transfers,
+arbitrary workflow execution, browser-cookie access, and runtime package
+downloads are not implied by this roadmap.

package/SECURITY.md

@@ -0,0 +1,53 @@
+# Security policy
+
+Security is part of the product contract. Please report suspected
+vulnerabilities privately and give the maintainer reasonable time to investigate
+before public disclosure.
+
+## Supported versions
+
+No public version is supported until the first signed release. After release,
+the latest maintained minor line will receive security fixes. Older lines may be
+asked to upgrade when a safe backport is impractical.
+
+## Report a vulnerability
+
+Use GitHub's **Security → Report a vulnerability** form. This repository will
+not be published until GitHub private vulnerability reporting is enabled and
+verified. Do not open a public issue with exploit details, credentials, workflow
+payloads, or identifying instance data.
+
+If the private form is unavailable, open a public issue containing only the
+sentence “Private security contact requested.” Do not include technical details
+until a private channel has been established.
+
+Include, when safe:
+
+- the affected version or commit;
+- the tool, resource, prompt, or package path involved;
+- a minimal reproduction using synthetic data;
+- the expected and observed security boundary;
+- impact and any known prerequisites;
+- whether the issue may already have been exploited.
+
+Never send a real n8n API key, credential value, cookie, workflow payload,
+execution payload, or private instance URL. Replace them with unmistakable
+placeholders.
+
+## Response process
+
+The maintainer will acknowledge a complete report, reproduce it against a safe
+environment, classify impact, prepare a fix and regression test, and coordinate
+disclosure. Timelines depend on severity and reproducibility; no fixed response
+time is promised before the project has a public support process.
+
+Security fixes must pass the normal Node 22/24 checks, secret and static scans,
+package inspection, and independent review before release.
+
+## Security boundaries
+
+The MCP server reduces risk but does not replace n8n access control. The n8n API
+key determines upstream permissions; unsafe mode can authorize destructive
+requests; explicitly allowing non-loopback HTTP accepts transport risk; and all
+n8n content remains untrusted after sanitization. See
+[docs/security-model.md](docs/security-model.md) for the complete model.

package/SUPPORT.md

@@ -0,0 +1,19 @@
+# Support
+
+This project is pre-release and currently has no guaranteed support response
+time. Before requesting help, read the
+[getting-started guide](docs/getting-started.md),
+[configuration reference](docs/configuration.md), and
+[troubleshooting guide](docs/troubleshooting.md).
+
+Use a GitHub issue for reproducible, non-sensitive bugs and documentation
+questions after the public repository is available. Include the project version,
+Node version, n8n Community version, operating system, MCP client, configured
+mode, safe reproduction steps, and sanitized error code. Never include secrets,
+cookies, real workflow or execution payloads, or a private instance URL.
+
+Feature requests should explain the Community Edition Public API path, user
+outcome, security and compatibility implications, and why an existing tool
+cannot satisfy the need.
+
+Report vulnerabilities privately according to [SECURITY.md](SECURITY.md).