n8n-mcp-community 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -6,6 +6,24 @@ All notable changes to this project will be documented here. The format follows
 
 ## [Unreleased]
 
+## [0.1.1] - 2026-07-21
+
+### Security
+
+- npm publication is now exclusively GitHub OIDC trusted publishing: the
+  v0.1.0 first-publish bootstrap token binding was removed from the release
+  workflow, and the release policy fails closed on any npm token reference.
+
+### Changed
+
+- Documentation now describes the published state: the README leads with the
+  pinned exact-version `npx` quick start, states up front that the safety
+  modes are progressive rather than restrictive, and the installation,
+  client, compatibility, and FAQ guides replace pre-release "planned"
+  wording with the released routes.
+- Release-asset links use the stable latest-release URL so documentation
+  links remain valid across versions.
+
 ## [0.1.0] - 2026-07-20
 
 ### Added
@@ -112,5 +130,6 @@ All notable changes to this project will be documented here. The format follows
   credentials, keys, and generated release artifacts cannot survive in that
   publishable history; authenticated public release receipts remain supported.
 
-[Unreleased]: https://github.com/drzamarian/n8n-mcp-community/compare/v0.1.0...HEAD
+[Unreleased]: https://github.com/drzamarian/n8n-mcp-community/compare/v0.1.1...HEAD
+[0.1.1]: https://github.com/drzamarian/n8n-mcp-community/releases/tag/v0.1.1
 [0.1.0]: https://github.com/drzamarian/n8n-mcp-community/releases/tag/v0.1.0

package/README.md

@@ -2,20 +2,27 @@
 
 **A security-focused Model Context Protocol server for self-hosted n8n Community Edition.**
 
-Connect an MCP client to n8n through 44 carefully bounded tools for workflows,
-executions, credentials, tags, users, diagnostics, and instance metadata. The
-server starts offline, defaults to read-only, uses the supported n8n Public API,
-and never sends workflow data to an external AI provider.
-
-> **v0.1.0:** install the exact published version or use a source checkout. See
-> [Installation](docs/installation.md) for the pinned npm and signed MCPB
-> options.
+Connect an MCP client to the **full n8n management surface**: create, edit,
+activate, and delete workflows, update individual nodes surgically, and manage
+executions, credentials, tags, users, diagnostics, and instance metadata — 44
+carefully bounded tools in total. Safety here is **progressive, not
+restrictive**: the server defaults to read-only, `write` unlocks authoring,
+and `unsafe` unlocks every tool with an exact per-call confirmation phrase for
+each destructive operation. It starts offline, uses the supported n8n Public
+API, and never sends workflow data to an external AI provider.
+
+> **v0.1.1 is published:** exact-version npm
+> ([`n8n-mcp-community@0.1.1`](https://www.npmjs.com/package/n8n-mcp-community)
+> with provenance attestations), a signed MCPB in the
+> [v0.1.1 release](https://github.com/drzamarian/n8n-mcp-community/releases/latest),
+> and the MCP Registry entry `io.github.drzamarian/n8n-mcp-community`. See
+> [Installation](docs/installation.md).
 
 [Read the synthetic terminal demo transcript](docs/demo-transcript.md). It shows
-the planned exact-version startup, 44-tool inventory, and local Introspect
+the exact-version startup, 44-tool inventory, and local Introspect
 diagnostics using only synthetic identifiers and documented output shapes.
 
-[![Animated synthetic terminal demonstration showing the planned exact-version startup, MCP inventory, and local Introspect result](docs/assets/demo.gif)](docs/demo-transcript.md)
+[![Animated synthetic terminal demonstration showing the exact-version startup, MCP inventory, and local Introspect result](docs/assets/demo.gif)](docs/demo-transcript.md)
 
 ## Why this project
 
@@ -57,11 +64,46 @@ repository-pinned MCPB signing identity, a human artifact-baseline receipt,
 tag-scoped protected-environment approval, and an externally signed MCPB
 handoff verified byte for byte against the reviewed unsigned candidate.
 
-## Quick start from source
+## Quick start
 
 Requirements: Node.js 22 or 24, npm, a self-hosted n8n Community Edition
 instance, and an n8n Public API key with only the permissions you need.
 
+Configure your MCP client to run the published exact version:
+
+```json
+{
+  "mcpServers": {
+    "n8n-community": {
+      "command": "npx",
+      "args": ["--yes", "n8n-mcp-community@0.1.1"],
+      "env": {
+        "N8N_API_URL": "https://n8n.example.com",
+        "N8N_API_KEY": "replace-with-a-dedicated-api-key",
+        "N8N_MCP_MODE": "read-only"
+      }
+    }
+  }
+}
+```
+
+`read-only` is the recommended starting point, not a capability ceiling: the
+same 44-tool surface includes full workflow authoring. Set
+`N8N_MCP_MODE=write` to create and edit workflows, nodes, credentials, and
+tags, or `N8N_MCP_MODE=unsafe` to enable every tool — activation, deletion,
+retries, and the other destructive operations, each still guarded by an exact
+per-call confirmation phrase. See [Safety modes](#safety-modes).
+
+Restart the MCP client and confirm exactly 44 tools, 5 resources, and 4
+prompts. Compatible desktop clients can instead install the signed MCPB from
+the
+[v0.1.1 release](https://github.com/drzamarian/n8n-mcp-community/releases/latest);
+verify its checksum against the release `SHA256SUMS` first.
+
+## Quick start from source
+
+Requirements: Node.js 22 or 24, npm, and a Git checkout of this repository.
+
 ```bash
 npm ci
 npm run build
@@ -257,7 +299,7 @@ API. The project does not redistribute the `n8n-nodes-base` catalog and does not
 use browser cookies, interactive session routes, or runtime package downloads to
 construct one.
 
-The v0.1.0 surface intentionally excludes arbitrary workflow execution,
+The v0.1.1 surface intentionally excludes arbitrary workflow execution,
 credential/workflow transfer, folders, data tables, beta evaluation endpoints,
 and execution annotations. See the [roadmap](ROADMAP.md) for the annotation
 proposal retained outside the release target.

package/dist/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = "0.1.0";
+export const PACKAGE_VERSION = "0.1.1";

package/docs/clients.md

@@ -1,8 +1,8 @@
 # MCP client configuration
 
-The pre-release candidate uses standard MCP over stdio. No client-specific
-support claim is made until the final npm and MCPB artifacts complete an
-end-to-end client matrix.
+The server uses standard MCP over stdio. No client-specific support claim is
+made until the published npm and MCPB artifacts complete an end-to-end client
+matrix.
 
 ## Generic source configuration
 
@@ -30,17 +30,16 @@ only in the client's environment or secret UI, and restart the client after any
 configuration change. The exact file location and outer JSON shape belong to
 the client and may differ from this generic fragment.
 
-## Planned exact-version npx configuration
+## Exact-version npx configuration
 
-After the first npm release, a portable configuration will run the reviewed
-version explicitly:
+The portable configuration runs the reviewed published version explicitly:
 
 ```json
 {
   "mcpServers": {
     "n8n-community": {
       "command": "npx",
-      "args": ["--yes", "n8n-mcp-community@0.1.0"],
+      "args": ["--yes", "n8n-mcp-community@0.1.1"],
       "env": {
         "N8N_API_URL": "https://n8n.example.com",
         "N8N_API_KEY": "replace-with-a-dedicated-api-key",
@@ -51,26 +50,26 @@ version explicitly:
 }
 ```
 
-Do not use this until `0.1.0` is published and verified. Do not replace the
-exact version with `@latest`; explicit pins make review, rollback, and incident
-response deterministic.
+Verify the published provenance attestation before first use. Do not replace
+the exact version with `@latest`; explicit pins make review, rollback, and
+incident response deterministic.
 
 On Windows, a client that cannot launch `npx` directly may use:
 
 ```json
 {
   "command": "cmd",
-  "args": ["/c", "npx", "--yes", "n8n-mcp-community@0.1.0"]
+  "args": ["/c", "npx", "--yes", "n8n-mcp-community@0.1.1"]
 }
 ```
 
-This Windows form is planned, not yet release-tested.
+This Windows form is not yet release-tested.
 
-## Planned MCPB path
+## MCPB path
 
 Compatible clients may be able to install the signed MCPB without editing JSON.
-The bundle will contain the same compiled server and will request the same four
-settings documented in [Configuration](configuration.md). It will not contain
+The bundle contains the same compiled server and requests the same four
+settings documented in [Configuration](configuration.md). It does not contain
 an API key or instance URL.
 
 The project will publish client-specific MCPB instructions only after testing

package/docs/compatibility.md

@@ -1,8 +1,7 @@
 # Compatibility
 
-Compatibility claims are evidence-bound. This pre-release document separates
-completed local release-candidate evidence from the signing, client-matrix, and
-publication gates that remain closed.
+Compatibility claims are evidence-bound. This document separates completed
+release evidence from the client-matrix gates that remain open.
 
 ## Current source-candidate evidence
 
@@ -13,28 +12,28 @@ publication gates that remain closed.
 | MCP transport          | stdio inventory verified as 44 tools, 5 resources, 4 prompts |
 | macOS on Apple silicon | Development and local verification environment               |
 | Linux and Windows      | No public release claim yet                                  |
-| npm artifact           | Packed, clean-installed, and inspected locally; unpublished  |
-| MCPB artifact          | Deterministic unsigned bundle verified locally; unpublished  |
+| npm artifact           | Published as `n8n-mcp-community@0.1.1` with provenance       |
+| MCPB artifact          | Signed and published with the v0.1.1 GitHub release          |
 
 The package declares Node.js `>=22.0.0`. That engine range is an acceptance
 floor, not evidence that every later major has completed the release matrix.
-The supported release lines for v0.1.0 are Node.js 22 and 24.
+The supported release lines for v0.1.1 are Node.js 22 and 24.
 
 ## n8n Community Edition
 
-The v0.1.0 floor candidate is n8n Community Edition 2.30.5, with 2.30.7 as the
+The v0.1.1 floor candidate is n8n Community Edition 2.30.5, with 2.30.7 as the
 current comparison target. The compiled public 44-tool candidate passed fresh,
 disposable lifecycles on both versions with synthetic fixtures, API-key
 revocation, resource cleanup, enforced candidate-process egress isolation, and
-zero container or network residue. The project remains pre-release and
-unsupported until the remaining release gates close.
+zero container or network residue. Linux and Windows client-lifecycle claims
+remain gated on the release matrix.
 
 The server uses supported Public API routes and `/healthz`. It does not rely on
 browser cookies, interactive `/rest` routes, paid project transfers, arbitrary
 workflow execution, or runtime node-catalog downloads.
 
 `n8n_credentials_list` is supported only from n8n 2.30.5 onward. Project
-selectors are intentionally absent because v0.1.0 does not present paid project
+selectors are intentionally absent because v0.1.1 does not present paid project
 capabilities as Community features. Other tools may also depend on endpoint
 availability and the permissions assigned to the API key; an HTTP 403 does not
 by itself mean the endpoint is absent.
@@ -73,7 +72,7 @@ surface.
 
 ## Deliberate exclusions
 
-v0.1.0 does not include:
+v0.1.1 does not include:
 
 - folders or data tables;
 - beta evaluation endpoints;
@@ -91,7 +90,7 @@ The protocol implementation is client-neutral stdio. A generic source
 configuration is documented now; client-specific support claims require an
 end-to-end launch, inventory readback, resource read, prompt retrieval, tool
 call, restart, upgrade, and removal test for the final release artifact. See
-[Clients](clients.md) for the current pre-release boundary.
+[Clients](clients.md) for the current client boundary.
 
 ## How compatibility will be accepted
 

package/docs/demo-transcript.md

@@ -6,8 +6,8 @@ standards-based MCP client interaction into a short terminal-style sequence; it
 does not claim that the client narration is a project CLI command.
 
 ```text
-$ npx --yes n8n-mcp-community@0.1.0 --version
-0.1.0
+$ npx --yes n8n-mcp-community@0.1.1 --version
+0.1.1
 
 MCP client initialized n8n-community
 44 tools | 5 resources | 4 prompts
@@ -20,8 +20,8 @@ schema 1.0.0 | engine 2.0.0 | status: complete
 findings: 0 critical | 0 high | 0 medium | 0 low | 0 info
 ```
 
-The version command is the planned exact-version installation route for v0.1.0;
-it becomes valid only after that version is published and verified. The initialization and tool call lines represent MCP protocol
+The version command is the published exact-version installation route for
+v0.1.1. The initialization and tool call lines represent MCP protocol
 events, not shell commands. The Introspect output is the documented empty
 finding example: the real direct structured result also includes coverage, rule
 outcomes, and limitations. Its fields remain untrusted n8n-derived diagnostics

package/docs/faq.md

@@ -14,9 +14,9 @@ and contract-test inventories are checked together.
 
 ## What is the easiest installation method?
 
-For a compatible desktop client, the planned signed MCPB will be the easiest.
-Exact-version `npx` will be the portable alternative. Neither has been published
-yet, so source checkout is the only current evaluation path.
+For a compatible desktop client, the signed MCPB from the v0.1.1 GitHub
+release is the easiest. Exact-version `npx` (`n8n-mcp-community@0.1.1`) is the
+portable alternative. A source checkout remains the contributor path.
 
 ## Will I need both MCPB and npx?
 
@@ -27,7 +27,7 @@ for portable configuration.
 ## Can Homebrew update the MCPB?
 
 No. An MCPB is not a Homebrew formula. No Homebrew formula is planned for
-v0.1.0; bundle updates will use explicit signed releases or a compatible
+v0.1.1; bundle updates will use explicit signed releases or a compatible
 client's verified update flow.
 
 ## Why do the npx examples avoid `@latest`?

package/docs/getting-started.md

@@ -1,7 +1,7 @@
 # Getting started
 
-This guide runs the pre-release source candidate as a local MCP stdio server.
-No npm package or MCPB has been published yet.
+This guide runs a source checkout as a local MCP stdio server. The published
+npm and signed MCPB routes are documented in [Installation](installation.md).
 
 ## What you need
 

package/docs/installation.md

@@ -2,16 +2,16 @@
 
 ## Availability
 
-| Method              | Current status                    | Intended use                                              |
-| ------------------- | --------------------------------- | --------------------------------------------------------- |
-| Source checkout     | Available for local evaluation    | Contributors and pre-release review                       |
-| Exact-version `npx` | Planned for the first npm release | Portable configuration across MCP clients                 |
-| Signed MCPB         | Planned for the first release     | Easiest installation in compatible desktop clients        |
-| Homebrew            | Not planned for v0.1.0            | No formula exists and Homebrew does not update MCPB files |
+| Method              | Current status                           | Intended use                                              |
+| ------------------- | ---------------------------------------- | --------------------------------------------------------- |
+| Source checkout     | Available for local evaluation           | Contributors and release review                           |
+| Exact-version `npx` | Published: `n8n-mcp-community@0.1.1`     | Portable configuration across MCP clients                 |
+| Signed MCPB         | Published with the v0.1.1 GitHub release | Easiest installation in compatible desktop clients        |
+| Homebrew            | Not planned for v0.1.1                   | No formula exists and Homebrew does not update MCPB files |
 
-The source, npm package, and MCPB must expose the same 44-tool runtime. Until a
-signed release exists, do not configure an unpublished package name as though it
-were available.
+The source, npm package, and MCPB expose the same 44-tool runtime. Configure
+only an exact published version; never configure an unpublished version as
+though it were available.
 
 ## Source installation
 
@@ -39,16 +39,16 @@ npm run check
 
 Use a release tag rather than `dev` after public releases begin.
 
-## Exact-version npx after release
+## Exact-version npx
 
-The recommended portable configuration will pin a reviewed version:
+The recommended portable configuration pins the reviewed published version:
 
 ```json
 {
   "mcpServers": {
     "n8n-community": {
       "command": "npx",
-      "args": ["--yes", "n8n-mcp-community@0.1.0"],
+      "args": ["--yes", "n8n-mcp-community@0.1.1"],
       "env": {
         "N8N_API_URL": "https://n8n.example.com",
         "N8N_API_KEY": "replace-with-a-dedicated-api-key",
@@ -59,10 +59,17 @@ The recommended portable configuration will pin a reviewed version:
 }
 ```
 
-This example becomes valid only after `0.1.0` is published and its provenance
-is verified. Windows clients that do not launch `npx` directly may use
+`read-only` in this example is a safe starting default, not a limitation of
+the server: `N8N_MCP_MODE=write` enables workflow and node authoring, and
+`N8N_MCP_MODE=unsafe` enables the complete 44-tool surface with exact
+per-call confirmations for destructive operations.
+
+`0.1.1` is published with npm provenance attestations that link the package to
+this repository's release workflow; verify the attestation on the npm package
+page or with `npm audit signatures` before first use. Windows clients that do
+not launch `npx` directly may use
 `"command": "cmd"` with
-`"args": ["/c", "npx", "--yes", "n8n-mcp-community@0.1.0"]`.
+`"args": ["/c", "npx", "--yes", "n8n-mcp-community@0.1.1"]`.
 
 Do not use `@latest`. An exact version makes upgrades deliberate, reviewable,
 and reversible. To upgrade, replace the version only after reading the
@@ -72,18 +79,21 @@ restore the last known-good exact version and restart the MCP client.
 `npx` may download the pinned package on first use. Normal npm cache behavior
 applies; this project does not add a second updater.
 
-## MCPB after release
+## Signed MCPB
 
-The MCPB manifest declares Linux, macOS, and Windows because the bundle contains
-the same portable Node.js stdio server on each platform. A signed release will
-not claim client compatibility on any operating system until installation,
-upgrade, rollback, and removal have passed there. Once verified, MCPB is intended
-to be the simplest path for non-developers: inspect the signature and checksum,
-open the bundle in a compatible client, supply connection settings through that
-client's secret configuration UI, and confirm the 44-tool inventory.
+The signed MCPB is published as a
+[v0.1.1 release asset](https://github.com/drzamarian/n8n-mcp-community/releases/latest)
+together with `SHA256SUMS` and an SBOM. The manifest declares Linux, macOS, and
+Windows because the bundle contains the same portable Node.js stdio server on
+each platform; the release does not claim client compatibility on an operating
+system until installation, upgrade, rollback, and removal have passed there.
+MCPB is intended to be the simplest path for non-developers: inspect the
+signature and checksum, open the bundle in a compatible client, supply
+connection settings through that client's secret configuration UI, and confirm
+the 44-tool inventory.
 
 An MCPB is not a Homebrew package. Homebrew cannot update it unless a separate
-formula is created, and no formula is planned for v0.1.0. MCPB updates will be
+formula is created, and no formula is planned for v0.1.1. MCPB updates will be
 explicit signed release downloads or a compatible client's verified update
 flow; the exact process will be documented only after it is tested end to end.
 

package/docs/security-model.md

@@ -1,6 +1,6 @@
 # Security model
 
-This document describes the controls and residual risks of the v0.1.0 source
+This document describes the controls and residual risks of the v0.1.1 source
 candidate. It is a threat model, not a claim that the software or the connected
 n8n instance is invulnerable.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "n8n-mcp-community",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "A security-focused MCP server for self-hosted n8n Community Edition.",
   "private": false,
   "license": "MIT",

package/server.json

@@ -8,13 +8,13 @@
     "url": "https://github.com/drzamarian/n8n-mcp-community",
     "source": "github"
   },
-  "version": "0.1.0",
+  "version": "0.1.1",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "n8n-mcp-community",
-      "version": "0.1.0",
+      "version": "0.1.1",
       "transport": {
         "type": "stdio"
       },