n8n-mcp-community 0.1.2 → 0.1.4

package/CHANGELOG.md

@@ -6,6 +6,81 @@ All notable changes to this project will be documented here. The format follows
 
 ## [Unreleased]
 
+## [0.1.4] - Frozen release candidate
+
+Version 0.1.4 is a frozen release candidate. Availability is established only
+by matching npm provenance, GitHub Release assets and signatures, and MCP
+Registry readbacks; this immutable entry is not rewritten after publication.
+
+### Security
+
+- `n8n_credentials_test` now consumes only the upstream success/error status
+  and returns fixed public messages. Provider-supplied diagnostic text is never
+  exposed because it can contain credential material or other sensitive data.
+
+### Changed
+
+- All 44 tool definitions now describe their specific side effects,
+  authorization boundary, compatibility constraints, and return semantics in
+  native-quality English.
+- MCP destructive hints now distinguish five reviewed additive or
+  non-destructive operations from destructive mutations without weakening the
+  independent read-only, write, and unsafe authorization classes.
+- A complete 44-tool definition matrix binds the final `tools/list` surface to
+  the documented operation classes, annotations, authorization requirements,
+  return contracts, and tool-specific semantics. Controlled synthetic
+  mutations prove that every matrix invariant can fail.
+- The README now includes the Glama score badge used by MCP directory listings.
+
+## [0.1.3] - Frozen release candidate
+
+Version 0.1.3 is a frozen release candidate. Availability is established only
+by matching npm provenance, GitHub Release assets and signatures, and MCP
+Registry readbacks; this immutable entry is not rewritten after publication.
+
+### Security
+
+- MCP SDK 1.30.0 now permits the patched `@hono/node-server` 2.x line in a
+  clean standalone downstream install, so the temporary package-root override
+  is removed. The no-override consumer gate now rejects every non-zero
+  production audit and every `@hono/node-server` release below 2.0.5 or outside
+  major version 2.
+- Published 0.1.2 installations remain pinned to MCP SDK 1.29.0 and do not gain
+  this corrected downstream resolution. Its former clean-consumer closure path
+  is superseded: upgrade to 0.1.3 only after npm, GitHub, and MCP Registry
+  readbacks all verify that release.
+- The reviewed lockfile resolves `fast-uri` 3.1.5 for
+  [GHSA-7p8r-x3mc-p8w7](https://github.com/advisories/GHSA-7p8r-x3mc-p8w7)
+  (high), `hono` 4.13.0 for
+  [GHSA-8j4g-w8fx-2239](https://github.com/advisories/GHSA-8j4g-w8fx-2239)
+  (moderate), and `ip-address` 10.4.0 for
+  [GHSA-mwp4-54f8-5fhr](https://github.com/advisories/GHSA-mwp4-54f8-5fhr)
+  (high),
+  [GHSA-4xrf-jv44-h6hh](https://github.com/advisories/GHSA-4xrf-jv44-h6hh)
+  (moderate), and
+  [GHSA-22jq-vg5j-6vgg](https://github.com/advisories/GHSA-22jq-vg5j-6vgg)
+  (moderate). Development-only `brace-expansion` 5.0.9 closes
+  [GHSA-mh99-v99m-4gvg](https://github.com/advisories/GHSA-mh99-v99m-4gvg)
+  and
+  [GHSA-rgw5-rvv9-x895](https://github.com/advisories/GHSA-rgw5-rvv9-x895),
+  both high severity.
+- The published 0.1.2 MCPB vendors the earlier advisory-flagged lockfile and
+  should be upgraded only after the 0.1.3 external readbacks agree. The npm
+  tarball does not bundle transitives, so a fresh 0.1.2 npm install currently
+  re-resolves the three runtime packages to patched releases; development-only
+  `brace-expansion` is absent from that consumer graph. Its separate MCP SDK
+  1.29.0 / `@hono/node-server` residual remains until the upgrade.
+
+### Changed
+
+- Downstream dependency verification now fails closed on any advisory instead
+  of retaining the former exact 1.x backport exception.
+- The public synthetic demo now renders 0.1.3 in every version-bearing frame;
+  a version history anchored to the previous annotated release tag must extend
+  without deletion or rewriting and use a unique GIF digest per release. It
+  joins the frame-review, timing, dimension, transcript, and digest checks to
+  reject a version-only bump that silently leaves the animation stale.
+
 ## [0.1.2] - Frozen release candidate
 
 Version 0.1.2 is a frozen release candidate. Availability is established only
@@ -166,6 +241,8 @@ Registry readbacks; this immutable entry is not rewritten after publication.
   publishable history; authenticated public release receipts remain supported.
 
 [Unreleased]: #unreleased
+[0.1.4]: #014---frozen-release-candidate
+[0.1.3]: #013---frozen-release-candidate
 [0.1.2]: #012---frozen-release-candidate
 [0.1.1]: https://github.com/drzamarian/n8n-mcp-community/releases/tag/v0.1.1
 [0.1.0]: https://github.com/drzamarian/n8n-mcp-community/releases/tag/v0.1.0

package/README.md

@@ -1,5 +1,7 @@
 # n8n MCP Community
 
+[![n8n-mcp-community MCP server](https://glama.ai/mcp/servers/drzamarian/n8n-mcp-community/badges/score.svg)](https://glama.ai/mcp/servers/drzamarian/n8n-mcp-community)
+
 **A security-focused Model Context Protocol server for self-hosted n8n Community Edition.**
 
 Connect an MCP client to a **bounded 44-tool n8n Community Edition management surface**: create, edit,
@@ -47,15 +49,14 @@ diagnostics using only synthetic identifiers and documented output shapes.
 The current source candidate has been verified with:
 
 - exactly **44 tools**, **5 resources**, and **4 prompts** over real stdio;
-- **291 passing tests** and the complete verification gate on Node.js 22.23.1
+- **295 passing tests** and the complete verification gate on Node.js 22.23.1
   and 24.18.0;
 - zero findings from Gitleaks, Semgrep, Trivy, and both project-root
   production/full `npm audit` runs; all three source scanners are reproduced in
   CI, with immutable scanner/action identities;
-- a separate no-override consumer install that resolves the reviewed
-  `@hono/node-server@1.19.15` backport, accepts only an exact
-  GHSA-frvp-7c67-39w9 advisory or a fully clean advisory readback while registry
-  metadata converges, and proves the stdio runtime and exact 44/5/4 inventory;
+- a separate no-override consumer install that resolves the patched
+  `@hono/node-server` 2.x line, requires a zero-finding production audit, and
+  proves the stdio runtime and exact 44/5/4 inventory;
 - a reproducible dependency-license gate covering 224 installed package paths;
 - bounded same-origin HTTP contracts and zero-request policy-denial tests;
 - all 44 compiled tool lifecycles on disposable n8n Community 2.30.5 and 2.30.7
@@ -305,7 +306,7 @@ API. The project does not redistribute the `n8n-nodes-base` catalog and does not
 use browser cookies, interactive session routes, or runtime package downloads to
 construct one.
 
-The v0.1.2 candidate surface intentionally excludes arbitrary workflow execution,
+The v0.1.4 candidate surface intentionally excludes arbitrary workflow execution,
 credential/workflow transfer, folders, data tables, beta evaluation endpoints,
 and execution annotations. See the [roadmap](ROADMAP.md) for the annotation
 proposal retained outside the release target.

package/THIRD_PARTY_NOTICES.md

@@ -11,13 +11,13 @@ LICENSE or NOTICE file. They are exact-pinned in the lockfile, are not present
 in the runtime package or MCPB, and are accepted only at the listed version,
 license, repository, and integrity hash:
 
-| Package                 | License      | Upstream repository                                                                             |
+| Package                 | License      | Source or immutable package record                                                              |
 | ----------------------- | ------------ | ----------------------------------------------------------------------------------------------- |
 | `@humanfs/types@0.15.0` | Apache-2.0   | [humanwhocodes/humanfs](https://github.com/humanwhocodes/humanfs)                               |
 | `esrecurse@4.3.0`       | BSD-2-Clause | [estools/esrecurse](https://github.com/estools/esrecurse)                                       |
 | `flora-colossus@2.0.0`  | MIT          | [MarshallOfSound/flora-colossus](https://github.com/MarshallOfSound/flora-colossus/tree/v2.0.0) |
 | `imurmurhash@0.1.4`     | MIT          | [jensyt/imurmurhash-js](https://github.com/jensyt/imurmurhash-js)                               |
-| `keyv@4.5.4`            | MIT          | [jaredwray/keyv](https://github.com/jaredwray/keyv)                                             |
+| `keyv@4.5.4`            | MIT          | [npm registry record](https://registry.npmjs.org/keyv/4.5.4)                                    |
 | `natural-compare@1.4.0` | MIT          | [litejs/natural-compare-lite](https://github.com/litejs/natural-compare-lite)                   |
 
 Their exact SHA-512 integrity values are enforced in
@@ -26,9 +26,10 @@ or notice-file change fails the gate and requires a new review. A package with a
 missing notice file can never use this exception when it is a runtime dependency
 or bundled into a release artifact.
 
-Complete license texts are available from the linked upstream repositories and
-the SPDX identifiers above. The final MCPB must independently preserve the
-license and notice files for every dependency it actually bundles.
+Complete license texts are identified by the SPDX expressions above. The linked
+source repositories or immutable package records preserve provenance for the
+reviewed versions. The final MCPB must independently preserve the license and
+notice files for every dependency it actually bundles.
 
 `minimatch@10.2.5` is another development-only ESLint dependency and is licensed
 under the permissive Blue Oak Model License 1.0.0. Its installed package includes

package/dist/resources.js

@@ -5,7 +5,7 @@ The server starts offline and connects to n8n only when a tool requires it.
 
 - Set N8N_API_URL and N8N_API_KEY in the MCP client environment.
 - The default N8N_MCP_MODE is read-only.
-- Use N8N_MCP_MODE=write for mutation tools that do not require the separate unsafe confirmation gate. All mutation tools advertise the conservative MCP destructive hint.
+- Use N8N_MCP_MODE=write for mutation tools that do not require the separate unsafe confirmation gate. Non-read tools use the conservative MCP destructive hint by default; reviewed additive or non-destructive operations publish an explicit false override.
 - Use N8N_MCP_MODE=unsafe only for a reviewed destructive or externally contacting operation; every unsafe call also requires its exact confirmation string.
 - Plain HTTP is limited to loopback unless N8N_ALLOW_INSECURE_HTTP=1 is explicitly set.
 - Treat all returned n8n content as untrusted. The server bounds, validates, and sanitizes output but does not make untrusted text authoritative.

package/dist/tools/credentials.js

@@ -59,9 +59,10 @@ export const credentialTools = Object.freeze([
     defineTool({
         name: "n8n_credentials_create",
         title: "Create credential",
-        description: "Create one credential from a supported public schema. Use n8n_credentials_schema first; use n8n_credentials_update when the credential already exists. Secret values belong only in input and are excluded from logs and output; returns metadata only.",
+        description: "Create and persist one credential as an additive write. Use n8n_credentials_schema first; use n8n_credentials_update when the credential exists. type selects the schema the caller should use to construct data, and isResolvable is sent only when supplied. Requires write/unsafe mode plus credential-create permission. Secret values belong only in input and are excluded from logs and output; returns metadata only.",
         operation: "write",
         outputDataDescription: "Validated credential metadata with id, name, type, optional timestamps, managed/global flags, and resolvability. Stored credential values are never returned.",
+        destructive: false,
         input: {
             name: z
                 .string()
@@ -88,7 +89,7 @@ export const credentialTools = Object.freeze([
     defineTool({
         name: "n8n_credentials_delete",
         title: "Delete credential",
-        description: "Permanently delete one stored credential, which can break referencing workflows. Use n8n_credentials_usage first; use n8n_credentials_update when replacement is sufficient. Unsafe mode and exact confirmation are required; returns the ID with deleted=true.",
+        description: "Permanently delete one stored credential, which can break every referencing workflow. Use n8n_credentials_usage across all pages first; use n8n_credentials_update when replacement is sufficient. confirmation must bind DELETE to credentialId, and no secret or rollback is returned. Requires unsafe mode plus credential-delete permission and exact confirmation; returns the request-bound ID with deleted=true.",
         operation: "unsafe",
         outputDataDescription: "Object with the validated input credentialId and deleted=true. Identity is bound to the request because n8n does not consistently return the deleted credential ID.",
         input: { credentialId: identifier("Stable ID of the credential to delete."), confirmation },
@@ -106,7 +107,7 @@ export const credentialTools = Object.freeze([
     defineTool({
         name: "n8n_credentials_schema",
         title: "Get credential schema",
-        description: "Get the Public API field schema for one credential type. Use it before n8n_credentials_create or replacement-data updates; use n8n_credentials_get for stored metadata. Returns schema fields supplied by n8n, never stored secret values.",
+        description: "Get n8n's Public API field schema for one credential type. Use it before n8n_credentials_create or replacement-data updates; use n8n_credentials_get for stored metadata. credentialType is a route selector, not a stored credential ID, so this call never reads credential values. Requires schema-read permission; returns the validated upstream field contract without testing credentials.",
         operation: "read-only",
         outputDataDescription: "Validated Public API schema object for the requested credential type. It describes accepted fields and constraints but never contains stored credential values.",
         input: {
@@ -119,7 +120,7 @@ export const credentialTools = Object.freeze([
     defineTool({
         name: "n8n_credentials_list",
         title: "List credentials",
-        description: "List one page of credential metadata through the endpoint supported from n8n Community 2.30.5. Use it for discovery; use n8n_credentials_get when the ID is known. Returns metadata and a cursor, never credential values.",
+        description: "List one Public API page of credential metadata using the endpoint supported from n8n Community 2.30.5. Use it for discovery; use n8n_credentials_get when the ID is known. cursor resumes a prior page and limit bounds that single request; this call never auto-paginates. Requires credential-list permission; returns metadata and nextCursor, never stored values.",
         operation: "read-only",
         outputDataDescription: "Object with data (up to 100 credential metadata records) and nextCursor (string or null). Records contain allowlisted metadata only; credential values are rejected.",
         input: { limit: pageLimit(), cursor: cursor.optional() },
@@ -134,7 +135,7 @@ export const credentialTools = Object.freeze([
     defineTool({
         name: "n8n_credentials_get",
         title: "Get credential",
-        description: "Get public metadata for one stored credential. Use it when the ID is known; use n8n_credentials_list for discovery and n8n_credentials_schema for type fields. Returns validated metadata without retrieving secret values.",
+        description: "Get public metadata for one stored credential by stable ID. Use it for a known target; use n8n_credentials_list for discovery and n8n_credentials_schema for type fields. credentialId identifies stored metadata only: the endpoint and output contract do not retrieve credential values or test the external service. Requires credential-read permission; returns validated identity, type, flags, and timestamps.",
         operation: "read-only",
         outputDataDescription: "One validated credential metadata record with id, name, type, optional timestamps, managed/global flags, and resolvability; no stored credential values.",
         input: { credentialId: identifier("Stable ID of the credential metadata to retrieve.") },
@@ -143,7 +144,7 @@ export const credentialTools = Object.freeze([
     defineTool({
         name: "n8n_credentials_update",
         title: "Update credential",
-        description: "Update selected metadata or values on an existing credential. Use n8n_credentials_schema for data fields; use n8n_credentials_create for a new credential. Supply at least one field, and data when changing type; returns metadata without secret values.",
+        description: "Update selected metadata or values on one stored credential, potentially breaking dependent workflows. Use n8n_credentials_schema for data fields and n8n_credentials_create for a new credential. Supply at least one field; changing type also requires data. isPartialData=false treats data as replacement, while true requests a partial merge. Requires write/unsafe mode plus update permission; returns metadata without secret values.",
         operation: "write",
         outputDataDescription: "Updated credential metadata with id, name, type, optional timestamps, managed/global flags, and resolvability. Supplied credential values are never echoed.",
         destructive: true,
@@ -204,9 +205,9 @@ export const credentialTools = Object.freeze([
     defineTool({
         name: "n8n_credentials_test",
         title: "Test credential",
-        description: "Test one stored credential by allowing n8n to contact its external service. Use n8n_credentials_get for metadata-only inspection; do not call this when network contact is unwanted. Unsafe mode and exact confirmation are required; returns a bounded value-free status.",
+        description: "Test one stored credential by allowing n8n to contact its external service, which receives and may log the attempt. Use n8n_credentials_get for metadata-only inspection and do not call this when network contact is unwanted. confirmation must bind TEST to credentialId. Requires unsafe mode plus test permission and exact confirmation; returns only the target-bound OK/Error outcome and withholds the upstream diagnostic message because it may contain secrets.",
         operation: "unsafe",
-        outputDataDescription: "Object with credentialId, bounded status (at most 64 characters), optional message (at most 512 characters), and truncated=true when either upstream string was shortened.",
+        outputDataDescription: "Object with credentialId, status OK or Error, and a server-authored message that discloses only whether the test succeeded. The untrusted upstream diagnostic message is never returned.",
         openWorld: true,
         input: {
             credentialId: identifier("Stable ID of the stored credential to test."),
@@ -217,29 +218,21 @@ export const credentialTools = Object.freeze([
             expected: `TEST ${input.credentialId}`,
         }),
         handler: async (input, context) => {
-            // The external test already ran by the time this response arrives, so an over-long
-            // status/message must be truncated rather than rejected: discarding a completed outcome
-            // would report a generic error for a side effect that genuinely happened.
-            const raw = z.object({ status: z.string(), message: z.string().optional() }).parse(await context.client().request({
+            const raw = z.object({ status: z.enum(["OK", "Error"]) }).parse(await context.client().request({
                 method: "POST",
                 path: `/credentials/${pathSegment(input.credentialId)}/test`,
             }));
-            const status = raw.status.slice(0, 64);
-            const message = raw.message === undefined ? undefined : raw.message.slice(0, 512);
-            const truncated = status.length < raw.status.length ||
-                (raw.message !== undefined && message !== undefined && message.length < raw.message.length);
             return {
                 credentialId: input.credentialId,
-                status,
-                ...(message === undefined ? {} : { message }),
-                ...(truncated ? { truncated: true } : {}),
+                status: raw.status,
+                message: raw.status === "OK" ? "Credential test succeeded." : "Credential test failed.",
             };
         },
     }),
     defineTool({
         name: "n8n_credentials_usage",
         title: "Find credential usage",
-        description: "Scan one bounded workflow page for exact references to a credential ID. Use it before n8n_credentials_update or deletion; use n8n_credentials_get for metadata only. Continue nextCursor for full coverage; returns matching workflows/nodes and unresolved counts.",
+        description: "Scan one bounded workflow page for exact references to a credential ID. Use it before n8n_credentials_update or deletion; use n8n_credentials_get for metadata only. active filters upstream, cursor resumes the scan, and unresolved legacy references are counted but never matched; coverage is complete only when nextCursor is null. Requires workflow-list permission; returns bounded workflow/node matches and omission counts.",
         operation: "read-only",
         outputDataDescription: "Object with credentialId, workflowsExamined, matchingWorkflowCount, workflows with at most 200 total node details and 20 per workflow, nextCursor, scanComplete, truncation counts, referencesScanned, and referencesUnresolved.",
         input: {

package/dist/tools/executions.js

@@ -56,7 +56,7 @@ export const executionTools = Object.freeze([
     defineTool({
         name: "n8n_executions_list",
         title: "List executions",
-        description: "List one page of saved execution metadata, optionally filtered by status or workflow. Use it for discovery and bounded triage; use n8n_executions_get when an execution ID is known. Returns metadata and a cursor, never raw workflow payload values.",
+        description: "List one Public API page of saved execution metadata. Use it for discovery and bounded triage; use n8n_executions_get when an ID is known. status and workflowId filter upstream, cursor resumes one prior page, and includeData only reports whether data exists—values remain withheld. Requires execution-list permission and never auto-paginates; returns metadata and nextCursor.",
         operation: "read-only",
         outputDataDescription: "Object with data (up to 100 allowlisted execution metadata records) and nextCursor. Each record includes identity/status/timing/retry metadata plus value-free dataPolicy; raw execution values are never returned.",
         input: {
@@ -90,7 +90,7 @@ export const executionTools = Object.freeze([
     defineTool({
         name: "n8n_executions_get",
         title: "Get execution",
-        description: "Get metadata for one saved execution. Use it when the ID is known; use n8n_executions_list to discover or filter executions. Returns status, timing, workflow identity, and data presence without exposing node inputs or outputs.",
+        description: "Get metadata for one saved execution by stable ID. Use it for a known target; use n8n_executions_list to discover or filter executions. includeData changes only whether n8n is asked about payload presence—the tool never returns node inputs or outputs. Requires permission to read the execution; returns identity, status, timing, retry fields, and value-free dataPolicy.",
         operation: "read-only",
         outputDataDescription: "One allowlisted execution metadata record with identity, status, mode, workflow/timing/retry fields when present, and value-free dataPolicy. Raw execution values are never returned.",
         input: {
@@ -111,7 +111,7 @@ export const executionTools = Object.freeze([
     defineTool({
         name: "n8n_executions_delete",
         title: "Delete execution",
-        description: "Permanently delete one saved execution. Use it only after n8n_executions_get confirms the target and retained history is no longer needed; inspection alone should use the read tools. Unsafe mode and exact confirmation are required; returns deleted=true.",
+        description: "Permanently delete one saved execution and its retained history. Use it only after n8n_executions_get confirms the target; use read tools for inspection. confirmation must bind DELETE to the same executionId, and the server provides no recovery or rollback. Requires unsafe mode plus execution-delete permission and exact confirmation; returns the request-bound ID with deleted=true.",
         operation: "unsafe",
         outputDataDescription: "Object with the validated input executionId and deleted=true. Identity is bound to the request and does not rely on an upstream response body.",
         input: { executionId, confirmation },
@@ -129,7 +129,7 @@ export const executionTools = Object.freeze([
     defineTool({
         name: "n8n_executions_retry",
         title: "Retry execution",
-        description: "Retry one eligible saved execution, which may repeat external side effects. Use it only after n8n_executions_get review; use n8n_executions_stop for a currently running execution. Unsafe mode and exact confirmation are required; returns value-free retry metadata.",
+        description: "Retry one eligible saved execution, potentially repeating every external effect already reached. Use it only after n8n_executions_get review; use n8n_executions_stop for a running execution. loadWorkflow=true uses the currently saved workflow, while false uses the original execution snapshot. Requires unsafe mode, retry permission, and RETRY bound to executionId; returns metadata without payload values.",
         operation: "unsafe",
         outputDataDescription: "Allowlisted metadata for the new or retried execution, including scalar identity/status/timing/retry fields when supplied by n8n; raw execution values are omitted.",
         input: {
@@ -153,7 +153,7 @@ export const executionTools = Object.freeze([
     defineTool({
         name: "n8n_executions_stop",
         title: "Stop execution",
-        description: "Request cancellation of one running execution without rolling back completed external effects. Use n8n_executions_get for inspection or n8n_executions_retry for an eligible saved failure. Unsafe mode and exact confirmation are required; returns stopped, already_finished, or unknown.",
+        description: "Request cancellation of one running execution without rolling back completed external effects. Use n8n_executions_get for inspection or n8n_executions_retry for an eligible saved failure. confirmation must bind STOP to executionId; a successful HTTP response alone does not prove cancellation. Requires unsafe mode plus stop permission and exact confirmation; returns stopped, already_finished, or unknown from validated state.",
         operation: "unsafe",
         outputDataDescription: "Object with executionId, stopped, state (stopped, already_finished, or unknown), and optional finished/status/stoppedAt metadata. HTTP success alone never asserts that a stop occurred.",
         input: { executionId, confirmation },

package/dist/tools/output-contracts.js

@@ -331,9 +331,8 @@ const outputDataSchemas = Object.freeze({
     n8n_credentials_test: z
         .object({
         credentialId: text(),
-        status: text(),
-        message: text().optional(),
-        truncated: z.literal(true).optional(),
+        status: z.enum(["OK", "Error"]),
+        message: z.enum(["Credential test succeeded.", "Credential test failed."]),
     })
         .strict(),
     n8n_credentials_usage: z

package/dist/tools/tags.js

@@ -18,7 +18,7 @@ export const tagTools = Object.freeze([
     defineTool({
         name: "n8n_tags_list",
         title: "List tags",
-        description: "List one page of workflow tags. Use it to discover stable tag IDs; use n8n_tags_get instead when the ID is already known. Returns validated tag metadata and an optional cursor for the next page.",
+        description: "List one Public API page of workflow tags. Use it to discover stable tag IDs; use n8n_tags_get when the ID is already known. cursor resumes the prior page and limit bounds only this request, so continue nextCursor until null when complete coverage matters. Requires tag-list permission and never changes assignments; returns validated metadata and nextCursor.",
         operation: "read-only",
         outputDataDescription: "Object with data (up to 100 validated tag records) and nextCursor (string or null). Each tag includes id, name, and optional createdAt/updatedAt timestamps.",
         input: { limit: pageLimit(), cursor: cursor.optional() },
@@ -33,7 +33,7 @@ export const tagTools = Object.freeze([
     defineTool({
         name: "n8n_tags_get",
         title: "Get tag",
-        description: "Get one workflow tag by its stable ID. Use it to verify a known tag before assigning, renaming, or deleting it; use n8n_tags_list for discovery. Returns validated tag metadata without changing workflows.",
+        description: "Get one workflow tag by stable ID. Use it to verify a known target before assigning, renaming, or deleting it; use n8n_tags_list for discovery. tagId identifies the reusable tag itself, not a workflow assignment, so this call neither lists nor changes assigned workflows. Requires tag-read permission; returns validated ID, name, and optional timestamps.",
         operation: "read-only",
         outputDataDescription: "One validated tag record with id, name, and optional createdAt/updatedAt timestamps.",
         input: { tagId: identifier("Stable ID of the workflow tag to retrieve.") },
@@ -42,9 +42,10 @@ export const tagTools = Object.freeze([
     defineTool({
         name: "n8n_tags_create",
         title: "Create tag",
-        description: "Create one workflow tag. Use it for a new reusable label; use n8n_tags_update when the tag already exists, and n8n_workflows_update_tags to assign it. Returns validated metadata and never assigns the new tag automatically.",
+        description: "Create and persist one workflow tag as an additive write. Use it for a new reusable label; use n8n_tags_update when the tag exists and n8n_workflows_update_tags to assign it. name must already be trimmed, and duplicate-name handling belongs to n8n; creation never changes any workflow assignment. Requires write/unsafe mode plus tag-create permission; returns validated metadata.",
         operation: "write",
         outputDataDescription: "Created tag record with validated id, name, and optional createdAt/updatedAt timestamps.",
+        destructive: false,
         input: { name: tagName },
         handler: async (input, context) => tagSchema.parse(await context
             .client()
@@ -53,7 +54,7 @@ export const tagTools = Object.freeze([
     defineTool({
         name: "n8n_tags_update",
         title: "Update tag",
-        description: "Rename one workflow tag without changing its stable ID or assignments. Use it for an existing tag; use n8n_tags_create for a new label and n8n_workflows_update_tags for assignments. Returns validated updated metadata.",
+        description: "Rename one existing workflow tag while preserving its stable ID and current assignments. Use n8n_tags_create for a new label and n8n_workflows_update_tags to change assignments. tagId selects the existing record and name is its complete replacement; duplicate-name acceptance belongs to n8n. Requires write/unsafe mode plus tag-update permission; returns validated metadata.",
         operation: "write",
         outputDataDescription: "Updated tag record with validated id, name, and optional createdAt/updatedAt timestamps.",
         input: { tagId: identifier("Stable ID of the workflow tag to rename."), name: tagName },
@@ -66,7 +67,7 @@ export const tagTools = Object.freeze([
     defineTool({
         name: "n8n_tags_delete",
         title: "Delete tag",
-        description: "Permanently delete one workflow tag. Use it only after n8n_tags_get and affected-workflow review; use n8n_tags_update when a rename is sufficient. Unsafe mode and exact confirmation are required; returns the ID with deleted=true.",
+        description: "Permanently delete one workflow tag, which can remove that label from multiple workflows. Use n8n_tags_get plus affected-workflow review first; use n8n_tags_update when a rename is sufficient. confirmation must bind DELETE to tagId, and no rollback is provided. Requires unsafe mode plus tag-delete permission and exact confirmation; returns the request-bound ID with deleted=true.",
         operation: "unsafe",
         outputDataDescription: "Object with the validated input tagId and deleted=true. Identity is bound to the request and does not rely on an upstream response body.",
         input: { tagId: identifier("Stable ID of the workflow tag to delete."), confirmation },

package/dist/tools/users.js

@@ -45,7 +45,7 @@ export const userTools = Object.freeze([
     defineTool({
         name: "n8n_users_list",
         title: "List users",
-        description: "List one page of users visible through the n8n Public API. Use it for discovery; use n8n_users_get when a stable ID or exact email is already known. Returns validated user metadata and an optional next-page cursor.",
+        description: "List one Public API page of users. Use it for discovery; use n8n_users_get when a stable ID or exact email is known. includeRole=true only asks n8n for roles, which may still be omitted by permission; cursor resumes one prior page and this call never auto-paginates. Requires user-list permission; returns redaction-protected metadata and nextCursor.",
         operation: "read-only",
         outputDataDescription: "Object with data (up to 100 validated user records) and nextCursor. Records include id and optional email/name/role/status/timestamps; recognized personal values may be redacted.",
         input: {
@@ -71,7 +71,7 @@ export const userTools = Object.freeze([
     defineTool({
         name: "n8n_users_get",
         title: "Get user",
-        description: "Get one user by stable ID or exact email address. Use it for targeted verification before an administrative action; use n8n_users_list for discovery. Returns validated identity, role, and account state without changing the user.",
+        description: "Get one user by stable ID or exact email. Use it for targeted verification before an administrative action; use n8n_users_list for discovery. userIdOrEmail chooses ID lookup or an exact percent-encoded email lookup; includeRole=true requests but cannot guarantee role visibility. Requires user-read permission; returns redaction-protected identity and account state without mutation.",
         operation: "read-only",
         outputDataDescription: "One validated user record with id and optional email, firstName, lastName, role, disabled/pending status, and timestamps. Recognized personal values may be redacted.",
         input: {
@@ -89,9 +89,10 @@ export const userTools = Object.freeze([
     defineTool({
         name: "n8n_users_create",
         title: "Invite user",
-        description: "Invite one non-owner user by email with a supported global role. Use n8n_users_get first when the address may already exist; this tool is not an update operation. Unsafe mode and exact email confirmation are required; returns delivery state without an acceptance URL.",
+        description: "Create a pending non-owner invitation as an additive write that may send email. Use n8n_users_get first when the address may exist; this is not an update or project-membership tool. role defaults to global:member, and confirmation must bind INVITE to the exact email. Requires unsafe mode plus invite permission. An inconclusive response may still mean a pending user exists; returns delivery state but never the acceptance URL.",
         operation: "unsafe",
         outputDataDescription: "Confirmed invitation outcome with userCreated, invited, userId, email, requestedRole, roleConfirmedByResponse, emailSent, delivery, and inviteAcceptUrlReturned=false. Acceptance URLs are never returned.",
+        destructive: false,
         input: {
             email,
             role: z
@@ -135,7 +136,7 @@ export const userTools = Object.freeze([
     defineTool({
         name: "n8n_users_delete",
         title: "Delete user",
-        description: "Delete one API-eligible user; ownership handling follows n8n's Public API. Use it only after n8n_users_get verifies the target and consequences; read tools should be used for inspection. Unsafe mode and exact confirmation are required; returns deleted=true.",
+        description: "Permanently delete one API-eligible user. Use n8n_users_get to verify the target first; use read tools for inspection. userId accepts no transfer target, so ownership handling remains entirely with n8n, and confirmation must bind DELETE to that ID. Requires unsafe mode plus user-delete permission and exact confirmation; returns the request-bound ID with deleted=true and provides no rollback claim.",
         operation: "unsafe",
         outputDataDescription: "Object with the validated input userId and deleted=true. The tool makes no ownership-transfer claim and accepts n8n's successful empty response.",
         input: { userId: identifier("Stable ID of the API-eligible user to delete."), confirmation },

package/dist/tools/utilities.js

@@ -65,7 +65,7 @@ export const utilityTools = Object.freeze([
     defineTool({
         name: "n8n_health",
         title: "Check n8n health",
-        description: "Perform a bounded same-origin health check against the configured n8n instance. Use it for reachability only; use an authenticated read tool such as n8n_workflows_list to validate API-key access. Returns ok=true and the HTTP status, not API capability.",
+        description: "Perform one redirect-free same-origin /healthz request with a 10-second timeout. Use it for HTTP reachability only; use an authenticated read tool such as n8n_workflows_list to validate API-key capability. The shared client still requires configured URL/key values, but no workflow data is read or changed. Returns ok=true and the successful status, never the upstream body.",
         operation: "read-only",
         outputDataDescription: "Object with ok=true and the successful n8n health endpoint HTTP status. It proves bounded reachability, not authenticated Public API capability.",
         input: {},
@@ -79,7 +79,7 @@ export const utilityTools = Object.freeze([
     defineTool({
         name: "n8n_insights_summary",
         title: "Get insights summary",
-        description: "Get n8n's official aggregate insights summary for an optional ISO 8601 range. Use it for instance aggregates when the Community endpoint exists; use n8n_introspect for one workflow's diagnostics. Returns totals, failures, failure rate, time saved, and runtime aggregates.",
+        description: "Get n8n's official instance insights aggregates. Use it when the Community endpoint exists; use n8n_introspect for one workflow's diagnostics. startDate and endDate are inclusive offset-aware bounds, and supplying both requires startDate <= endDate; omitting both requests n8n's default range. Requires insights-read permission and never fabricates unavailable metrics; returns totals, failures, rates, time saved, and runtime aggregates.",
         operation: "read-only",
         outputDataDescription: "Validated aggregate object with total, failed, failureRate, timeSaved, and averageRunTime records; additional upstream aggregate fields may be present and are sanitized.",
         input: {
@@ -112,10 +112,11 @@ export const utilityTools = Object.freeze([
     defineTool({
         name: "n8n_audit_generate",
         title: "Generate security audit",
-        description: "Generate n8n's instance-level security audit. Use it for an explicitly approved instance audit; use n8n_introspect for deterministic analysis of one workflow without this side effect. Unsafe mode and exact confirmation are required; returns an untrusted report.",
+        description: "Run n8n's broad, non-destructive instance security scan. Use it for an owner-approved audit; use n8n_introspect for local analysis of one workflow. Omitting categories lets n8n choose its complete default, while daysAbandonedWorkflow changes only the inactive-workflow threshold. Requires unsafe mode, owner-authorized API access, and exact GENERATE AUDIT confirmation; returns a sanitized but untrusted report without changing instance configuration.",
         operation: "unsafe",
         preserveValidatedRootRecordValues: true,
         outputDataDescription: "Map of upstream report titles to validated reports. Each report has one official risk category and bounded sections with recommendations plus typed locations or instance details; all content is sanitized and untrusted.",
+        destructive: false,
         input: {
             categories: z
                 .array(z.enum(["credentials", "database", "nodes", "filesystem", "instance"]))
@@ -153,7 +154,7 @@ export const utilityTools = Object.freeze([
     defineTool({
         name: "n8n_search_workflows",
         title: "Search workflows",
-        description: "Search one bounded workflow page locally by name, node type, or tag name. Use it for substring matching; use n8n_workflows_list for an unsearched API page. Continue nextCursor because this is not an instance-wide index; returns value-free matches and coverage state.",
+        description: "Search one workflow page locally with a case-insensitive substring. Use it for name, node-type, or tag-name matching; use n8n_workflows_list for an unsearched API page. searchIn selects local fields after active filters upstream; cursor and limit select one page, not a global index, so continue nextCursor for coverage. Requires workflow-list permission; returns at most 50 value-free matches and explicit scan state.",
         operation: "read-only",
         outputDataDescription: "Object with query, workflowsExamined, matches (up to 50 identity/state records with matchedIn scopes), nextCursor, scanComplete, and truncated. It covers one requested workflow page, not a global index.",
         input: {
@@ -219,7 +220,7 @@ export const utilityTools = Object.freeze([
     defineTool({
         name: "n8n_get_node_docs",
         title: "Get node documentation",
-        description: "Return a bounded bundled reference for one of four allowlisted core n8n nodes. Use it for offline orientation; use n8n_list_node_types to inventory observed types, and official docs for other nodes. Performs no fetch and returns a title, summary, guidance, official URL, and provenance.",
+        description: "Return one immutable bundled reference selected by the four-value node key. Use it for offline orientation; use n8n_list_node_types to inventory observed types and official docs for any other node. Requires no n8n URL, API key, network, or elevated mode; it never follows the included URL. Returns source/fetched provenance, canonical type, title, summary, guidance, and official URL.",
         operation: "read-only",
         outputDataDescription: "Bundled reference with source=bundled_offline_reference, fetched=false, node type, title, concise summary/guidance, and official documentation URL. No network fetch occurs.",
         openWorld: false,
@@ -237,7 +238,7 @@ export const utilityTools = Object.freeze([
     defineTool({
         name: "n8n_list_node_types",
         title: "List observed node types",
-        description: "List node types observed across bounded workflow pages. Use it for usage inventory, not installed-package availability; use n8n_get_node_docs for bundled references or n8n_community_packages_list for package metadata. Returns counts and scan coverage.",
+        description: "Inventory node-type strings observed across bounded workflow pages. Use it for usage evidence, not installed availability; use n8n_get_node_docs for bundled references or n8n_community_packages_list for package metadata. cursor selects the start, maxPages bounds continuation, and active filters upstream; a complete result requires starting at the first page and reaching the end. Requires workflow-list permission; returns counts and exact coverage under 30-second/20,000-node budgets.",
         operation: "read-only",
         outputDataDescription: "Observed-workflow inventory with scope/availabilityStatement, up to 500 sorted types and counts, page/workflow/node counters, coverage booleans, nextCursor, resultComplete, truncated, and omittedTypeCount.",
         input: {
@@ -339,7 +340,7 @@ export const utilityTools = Object.freeze([
     defineTool({
         name: "n8n_introspect",
         title: "Inspect n8n workflow",
-        description: "Inspect one workflow and bounded saved executions with deterministic local rules. Use quick for triage and deep for limited redacted details; use n8n_audit_generate for instance security or n8n_workflows_get for raw structure. Never executes; returns findings and coverage.",
+        description: "Inspect one workflow and saved executions with 23 deterministic local rules. profile sets paired defaults: quick uses 24h/20 and caps maxExecutions at 25; deep uses 168h/50 and reads at most four redacted details. includeSanitizedLabels=false keeps labels opaque; true opts into bounded sanitized labels. Use n8n_audit_generate for instance security or n8n_workflows_get for raw structure. Requires workflow/execution read permission; never executes or calls AI; returns findings and coverage.",
         operation: "read-only",
         outputDataDescription: "Direct Introspect result containing schema/engine versions, status, workflow facts, sample coverage, finding/rule counts, metrics, bounded findings, rule coverage, limitations, and guidance. Every top-level field has its own published schema description.",
         outputSchema: IntrospectResultSchema,
@@ -403,7 +404,7 @@ export const utilityTools = Object.freeze([
     defineTool({
         name: "n8n_community_packages_list",
         title: "List community packages",
-        description: "List bounded metadata for installed n8n community packages. Use it for package inventory; use n8n_list_node_types for types observed in workflows. It never installs, updates, or removes packages and returns at most 100 untrusted records plus truncation counts.",
+        description: "List bounded metadata for installed n8n community packages. Use it for package inventory; use n8n_list_node_types for types actually observed in workflows. This zero-input call retains at most 100 of the endpoint's records and reports exact total/omitted counts; it does not download or inspect package contents. Requires package-list permission, never installs, updates, or removes packages, and returns untrusted metadata with author emails redacted.",
         operation: "read-only",
         outputDataDescription: "Object with data (at most 100 package metadata records), totalCount, truncated, and exact omittedCount. Records may include packageName, installedVersion, author metadata, and timestamps; author emails are redacted.",
         input: {},

package/dist/tools/workflows.js

@@ -651,7 +651,7 @@ export const workflowTools = Object.freeze([
     defineTool({
         name: "n8n_workflows_list",
         title: "List workflows",
-        description: "List one page of workflows visible to the configured API key. Use it for unsearched discovery; use n8n_search_workflows for local substring matching or n8n_workflows_get when the ID is known. Returns projected workflows and a cursor, never pin/static values.",
+        description: "List one Public API page of workflows visible to the configured API key. Use it for unsearched discovery; use n8n_search_workflows for local substring matching or n8n_workflows_get when the ID is known. Filters are applied upstream, cursor resumes a prior page, and this call never auto-paginates. Requires workflow-list permission; returns projected workflows and nextCursor, never pin/static values.",
         operation: "read-only",
         outputDataDescription: "Object with data (up to 100 projected workflows) and nextCursor (string or null). Each workflow includes structure/state plus pinDataPresent and staticDataPresent presence markers, but never pinned or static values.",
         input: {
@@ -698,7 +698,7 @@ export const workflowTools = Object.freeze([
     defineTool({
         name: "n8n_workflows_get",
         title: "Get workflow",
-        description: "Get one current workflow by stable ID for inspection or reviewed editing. Use n8n_workflows_get_version for retained history or n8n_workflows_list for discovery. Returns structure, state, settings, and presence flags; pin/static values are always withheld.",
+        description: "Get one current workflow by stable ID for inspection or reviewed editing. Use n8n_workflows_get_version for retained history or n8n_workflows_list for discovery. excludePinnedData controls only the upstream request and presence reporting; values are always withheld. Requires permission to read the target; returns structure, state, settings, and presence flags.",
         operation: "read-only",
         outputDataDescription: "Current workflow projection with id, optional versionId/description/state, name, nodes, connections, settings, and pinDataPresent/staticDataPresent markers. Pinned and static values are never returned.",
         input: {
@@ -716,9 +716,10 @@ export const workflowTools = Object.freeze([
     defineTool({
         name: "n8n_workflows_create",
         title: "Create workflow",
-        description: "Create one workflow from a complete validated definition. Use it for a new workflow; use n8n_workflows_update for an existing workflow and n8n_workflows_activate separately for triggers. Validates the graph and returns a projection without pin/static values.",
+        description: "Create and persist one workflow as an additive write without activating its triggers. Use it for a new workflow; use n8n_workflows_update for an existing one and n8n_workflows_activate separately for triggers. nodes and connections must describe one complete consistent graph; optional pin/static inputs are accepted but never returned. Requires write or unsafe mode plus create permission; returns the validated projection.",
         operation: "write",
         outputDataDescription: "Created workflow projection with id, optional versionId/description/state, name, nodes, connections, settings, and withheld pin/static presence markers. Pinned and static values are never returned.",
+        destructive: false,
         input: {
             name: z.string().min(1).max(128).describe("Workflow name (1-128 characters)."),
             description: z
@@ -763,7 +764,7 @@ export const workflowTools = Object.freeze([
     defineTool({
         name: "n8n_workflows_update",
         title: "Update workflow",
-        description: "Update selected top-level workflow fields while preserving omitted writable fields. Use n8n_update_node for one node property and n8n_workflows_update_tags for tag assignments. Requires the current versionId, performs a non-atomic full PUT, and returns the confirmed projection.",
+        description: "Update selected top-level workflow fields through a non-atomic full PUT. Use n8n_update_node for one node property and n8n_workflows_update_tags for tag assignments. expectedVersionId must match both pre-write reads; omitted writable fields are preserved, while supplied nodes or other composite fields replace that field completely. Requires write/unsafe mode plus read and update permission; returns the confirmed projection.",
         operation: "write",
         outputDataDescription: "Confirmed updated workflow projection with id, version/state, name, optional description, nodes, connections, settings, and withheld pin/static presence markers. Omitted writable fields come from the immediate pre-write read.",
         destructive: true,
@@ -837,7 +838,7 @@ export const workflowTools = Object.freeze([
     defineTool({
         name: "n8n_update_node",
         title: "Update one workflow node",
-        description: "Update one validated mutable property on one workflow node while preserving the rest. Use it instead of n8n_workflows_update for a single-node change; use the full update for top-level or multi-node edits. Requires version/risk guards and returns the path plus non-atomic risk.",
+        description: "Update one validated path on one workflow node while preserving sibling data. Use it instead of n8n_workflows_update for a single-node change; use the full update for top-level or multi-node edits. path selects the mutable root whose contract validates value, and both version/risk guards must match before the non-atomic PUT. Requires write/unsafe mode plus read and update permission; returns the changed path and residual race risk.",
         operation: "write",
         outputDataDescription: "Object with workflowId, versionId, nodeId, path, updated=true, atomic=false, and residualRisk describing the Public API's non-atomic full-workflow PUT limitation.",
         destructive: true,
@@ -915,7 +916,7 @@ export const workflowTools = Object.freeze([
     defineTool({
         name: "n8n_workflows_delete",
         title: "Delete workflow",
-        description: "Permanently delete one workflow and its saved definition. Use n8n_workflows_archive when reversible removal is sufficient and n8n_workflows_get for inspection. Unsafe mode and exact target confirmation are required; returns the ID with deleted=true.",
+        description: "Permanently delete one workflow and its saved definition. Use n8n_workflows_archive when reversible removal is sufficient and n8n_workflows_get for inspection. confirmation must bind DELETE to the same workflowId; no rollback or transfer is provided. Requires unsafe mode plus delete permission and exact confirmation; returns the request-bound ID with deleted=true.",
         operation: "unsafe",
         outputDataDescription: "Object with the validated input workflowId and deleted=true. Identity is bound to the request and does not rely on an upstream response body.",
         input: { workflowId: identifier("Stable ID of the workflow to delete."), confirmation },
@@ -934,8 +935,8 @@ export const workflowTools = Object.freeze([
         name: `n8n_workflows_${action}`,
         title: `${action === "activate" ? "Activate" : "Deactivate"} workflow`,
         description: action === "activate"
-            ? "Activate one workflow so production triggers can accept future events. Use it only after n8n_workflows_get review; use n8n_workflows_deactivate to stop future triggers. Unsafe mode and exact confirmation are required; returns allowlisted state metadata."
-            : "Deactivate one workflow's production triggers without deleting saved data or stopping current work. Use n8n_workflows_activate to reverse this state or n8n_workflows_archive for lifecycle removal. Unsafe mode and exact confirmation are required; returns state metadata.",
+            ? "Activate one workflow so production triggers can accept future events; this does not execute it immediately. Use it only after n8n_workflows_get review; use n8n_workflows_deactivate to stop future triggers. confirmation must bind ACTIVATE to workflowId. Requires unsafe mode plus activation permission and exact confirmation; returns target-validated active state metadata."
+            : "Deactivate one workflow's future production triggers without deleting saved data or stopping executions already running. Use n8n_workflows_activate to reverse this state or n8n_workflows_archive for lifecycle removal. confirmation must bind DEACTIVATE to workflowId. Requires unsafe mode plus deactivation permission and exact confirmation; returns target-validated inactive state metadata.",
         operation: "unsafe",
         outputDataDescription: action === "activate"
             ? "Target-bound workflow metadata with required id and active=true; optional name, type, archive state, versionId, and timestamps are included when supplied by n8n, while all other fields are omitted."
@@ -956,7 +957,7 @@ export const workflowTools = Object.freeze([
     defineTool({
         name: "n8n_workflows_get_version",
         title: "Get workflow version",
-        description: "Get one retained historical workflow snapshot. Use it when exact historical nodes/connections are needed; use n8n_workflows_get for current state or n8n_workflows_diff for value-free comparison. Returns validated identity and structure, subject to Community retention.",
+        description: "Get one retained historical workflow snapshot selected by workflowId and versionId. Use it when exact historical nodes/connections are needed; use n8n_workflows_get for current state or n8n_workflows_diff for value-free comparison. Both returned IDs must match the selectors; a missing endpoint and a pruned version share an explicit ambiguous 404 outcome. Requires history-read permission; returns validated structure subject to retention.",
         operation: "read-only",
         outputDataDescription: "Historical snapshot with workflowId, versionId, optional name, nodes, and connections. Historical settings, pin data, and static data are unavailable from the supported Public API.",
         input: {
@@ -972,7 +973,7 @@ export const workflowTools = Object.freeze([
     defineTool({
         name: "n8n_workflows_get_tags",
         title: "Get workflow tags",
-        description: "List the tags currently assigned to one workflow. Use it before n8n_workflows_update_tags when assignments must be preserved; use n8n_tags_list to discover all available tags. Returns a bounded validated collection with exact truncation counts.",
+        description: "List the tags currently assigned to one workflow. Use it before n8n_workflows_update_tags when assignments must be preserved; use n8n_tags_list to discover all available tags. This endpoint has no cursor: the tool retains at most 100 records and reports totalCount plus exact omissions. Requires permission to read the workflow's assignments; returns validated tag metadata.",
         operation: "read-only",
         outputDataDescription: "Object with data (at most 100 validated tag records), totalCount, truncated, and exact omittedCount. Each tag may include id, name, createdAt, and updatedAt.",
         input: {
@@ -985,7 +986,7 @@ export const workflowTools = Object.freeze([
     defineTool({
         name: "n8n_workflows_update_tags",
         title: "Update workflow tags",
-        description: "Replace the complete tag assignment for one workflow; this is not a merge. Use n8n_workflows_get_tags first to preserve existing assignments and n8n_tags_create for a missing tag; an empty array clears all tags. Returns n8n's validated assignment.",
+        description: "Replace the complete tag assignment for one workflow; this is not a merge. Use n8n_workflows_get_tags first to preserve IDs and n8n_tags_create for a missing tag. tagIds is the entire desired set, so omitted IDs are removed and an empty array clears all tags. Requires write/unsafe mode plus assignment permission; returns n8n's validated replacement.",
         operation: "write",
         outputDataDescription: "Array of at most 100 validated tag records returned by n8n after replacing the workflow's complete assignment. An empty returned array represents no assigned tags.",
         destructive: true,
@@ -1009,8 +1010,8 @@ export const workflowTools = Object.freeze([
         name: `n8n_workflows_${action}`,
         title: `${action === "archive" ? "Archive" : "Unarchive"} workflow`,
         description: action === "archive"
-            ? "Archive one workflow without deleting it. Use it instead of n8n_workflows_delete when reversible lifecycle removal is required; use n8n_workflows_deactivate only to stop triggers. Unsafe mode and exact confirmation are required; returns archive state."
-            : "Restore one archived workflow without activating it. Use it to reverse n8n_workflows_archive; call n8n_workflows_activate separately only if triggers should resume. Unsafe mode and exact confirmation are required; returns archive state.",
+            ? "Archive one workflow without deleting its saved definition. Use it instead of n8n_workflows_delete for reversible lifecycle removal; use n8n_workflows_deactivate only to stop triggers. confirmation must bind ARCHIVE to workflowId, and the availability change can disrupt callers. Requires unsafe mode plus archive permission and exact confirmation; returns target-validated archive state."
+            : "Restore one archived workflow without activating its triggers. Use it to reverse n8n_workflows_archive; call n8n_workflows_activate separately only if triggers should resume. confirmation must bind UNARCHIVE to workflowId; current active state is not inferred. Requires unsafe mode plus unarchive permission and exact confirmation; returns target-validated archive state.",
         operation: "unsafe",
         outputDataDescription: action === "archive"
             ? "Target-bound workflow metadata with required id and isArchived=true; optional name, type, active state, versionId, and timestamps are included when supplied by n8n, while all other fields are omitted."
@@ -1031,7 +1032,7 @@ export const workflowTools = Object.freeze([
     defineTool({
         name: "n8n_workflows_diff",
         title: "Compare workflow versions",
-        description: "Compare one retained workflow version with another or current state. Use it for value-free review; use n8n_workflows_get_version when raw historical structure is needed. Returns counts, coverage, and up to 200 changes; unavailable historical fields are explicit.",
+        description: "Compare one retained workflow version with another or current state without returning changed values. Use it for review; use n8n_workflows_get_version when raw historical structure is needed. Omitting toVersionId selects current, while ignoreLayout=true suppresses position-only changes; selectors must differ. Requires workflow/history read permission; returns coverage, counts, and a byte-bounded prefix of up to 200 changes.",
         operation: "read-only",
         outputDataDescription: "Value-free comparison with workflowId, from/to selectors, comparisonCoverage, summary counts, byte-budgeted changes (up to 200), truncated, and exact omittedDetails. Modified nodes name changed fields; parameterChanges expose only sanitized paths, presence, value types, changed=true, and exact truncation metadata, while credential changes expose only referenceChanged=true. Raw values and webhook identifiers are never returned.",
         input: {

package/dist/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = "0.1.2";
+export const PACKAGE_VERSION = "0.1.4";

package/docs/compatibility.md

@@ -17,11 +17,11 @@ release evidence from the client-matrix gates that remain open.
 
 The package declares Node.js `>=22.0.0`. That engine range is an acceptance
 floor, not evidence that every later major has completed the release matrix.
-The supported release lines for v0.1.2 are Node.js 22 and 24.
+The supported release lines for v0.1.4 are Node.js 22 and 24.
 
 ## n8n Community Edition
 
-The v0.1.2 floor candidate is n8n Community Edition 2.30.5, with 2.30.7 as the
+The v0.1.4 floor candidate is n8n Community Edition 2.30.5, with 2.30.7 as the
 current comparison target. The compiled public 44-tool candidate passed fresh,
 disposable lifecycles on both versions with synthetic fixtures, API-key
 revocation, resource cleanup, enforced candidate-process egress isolation, and
@@ -33,7 +33,7 @@ browser cookies, interactive `/rest` routes, paid project transfers, arbitrary
 workflow execution, or runtime node-catalog downloads.
 
 `n8n_credentials_list` is supported only from n8n 2.30.5 onward. Project
-selectors are intentionally absent because v0.1.2 does not present paid project
+selectors are intentionally absent because v0.1.4 does not present paid project
 capabilities as Community features. Other tools may also depend on endpoint
 availability and the permissions assigned to the API key; an HTTP 403 does not
 by itself mean the endpoint is absent.
@@ -72,7 +72,7 @@ surface.
 
 ## Deliberate exclusions
 
-v0.1.2 does not include:
+v0.1.4 does not include:
 
 - folders or data tables;
 - beta evaluation endpoints;
@@ -106,9 +106,9 @@ The release gate requires, for each n8n target version:
 The local npm and unsigned MCPB candidates already pass reviewed artifact
 installation under the committed dependency policy, inventory parity,
 license/notice, SBOM generation, and checksum/reproducibility checks. The
-separate no-override consumer probe retains the upstream residual documented in
-the security model. Signature verification plus client-specific install,
-upgrade, rollback, and uninstall evidence on every claimed operating system
-remain release gates.
+separate no-override consumer probe requires the patched
+`@hono/node-server` 2.x line and a zero-finding production audit. Signature
+verification plus client-specific install, upgrade, rollback, and uninstall
+evidence on every claimed operating system remain release gates.
 
 [Back to the documentation map](README.md)

package/docs/demo-transcript.md

@@ -6,8 +6,8 @@ standards-based MCP client interaction into a short terminal-style sequence; it
 does not claim that the client narration is a project CLI command.
 
 ```text
-$ npx --yes n8n-mcp-community@0.1.2 --version
-0.1.2
+$ npx --yes n8n-mcp-community@0.1.4 --version
+0.1.4
 
 MCP client initialized n8n-community
 44 tools | 5 resources | 4 prompts
@@ -20,7 +20,7 @@ schema 1.0.0 | engine 2.0.0 | status: complete
 findings: 0 critical | 0 high | 0 medium | 0 low | 0 info
 ```
 
-The version command depicts the v0.1.2 source candidate and becomes an
+The version command depicts the v0.1.4 source candidate and becomes an
 installation route only after external npm, GitHub, and Registry readback agree.
 The initialization and tool call lines represent MCP protocol
 events, not shell commands. The Introspect output is the documented empty

package/docs/security-model.md

@@ -1,6 +1,6 @@
 # Security model
 
-This document describes the controls and residual risks of the v0.1.2 source
+This document describes the controls and residual risks of the v0.1.4 source
 candidate. It is a threat model, not a claim that the software or the connected
 n8n instance is invulnerable.
 
@@ -45,8 +45,9 @@ The runtime has three local modes:
 
 - `read-only` allows only tools classified as read-only;
 - `write` also allows mutation tools that do not use the separate unsafe
-  confirmation gate; all mutation tools still advertise the conservative MCP
-  destructive hint;
+  confirmation gate. Non-read tools use the conservative MCP destructive hint
+  by default; reviewed additive or non-destructive operations publish an
+  explicit false override;
 - `unsafe` allows all tools, but each unsafe call requires an exact,
   input-bound confirmation phrase.
 
@@ -153,18 +154,23 @@ invitations may have irreversible or externally visible effects.
 
 ### Downstream dependency resolution
 
-The repository and bundled MCPB use a root override to resolve the patched
-`@hono/node-server` 2.x line. npm does not inherit overrides from dependency
-packages, so a fresh consumer of the npm tarball currently resolves
-`@hono/node-server@1.19.15` through MCP SDK 1.29.0. That release contains the
-reviewed backport for encoded backslashes, while advisory registries may still
-report GHSA-frvp-7c67-39w9 during metadata convergence. The affected
-`serve-static` HTTP adapter is not imported by this stdio-only server. The
-verification gate installs the candidate in a disposable consumer without
-overrides, accepts only the exact known advisory or a fully clean advisory
-readback, pins the reviewed backport version, and proves the MCP inventory still
-starts. Closure still requires a new reviewed release and a clean no-override
-consumer audit of that released version.
+MCP SDK 1.30.0 permits the patched `@hono/node-server` 2.x line directly, so
+this project no longer needs a package-root override that downstream consumers
+would not inherit. The verification gate packs the candidate, installs it in a
+disposable consumer without overrides, rejects `@hono/node-server` versions
+below 2.0.5 or outside major version 2, requires a zero-finding production
+audit, and proves the exact MCP inventory still starts. Candidate evidence does
+not establish publication: the released version must pass the same clean
+consumer audit after npm provenance and the other external release readbacks
+agree.
+
+The SDK dependency range also permits the legacy 1.x line. A separate host
+project that co-installs another dependency constraining `@hono/node-server` to
+1.x may therefore resolve a different graph from the clean standalone probe.
+This server is distributed as a standalone stdio process, not as an embeddable
+library. Projects that intentionally embed it must audit their complete
+production graph and ensure `@hono/node-server` resolves to a patched 2.x
+release.
 
 ## Threats outside this boundary
 

package/docs/tools.md

@@ -83,9 +83,9 @@ reviewed edit.
 Creates a workflow from a complete validated workflow definition.
 
 - **Policy and endpoint:** write; `POST /workflows`;
-  `RO=false, D=true, I=false, OW=true`. Requires mode `write` or `unsafe`.
+  `RO=false, D=false, I=false, OW=true`. Requires mode `write` or `unsafe`.
 - **Requirements:** Requires mode `write` or `unsafe` and API-key permission to create workflows.
-- **Community Edition:** Verified on Community 2.30.5 and 2.30.7. Creation targets the caller's Community workspace and does not accept paid-project assignment.
+- **Community Edition:** Verified on Community 2.30.5 and 2.30.7. Creation is an additive write, targets the caller's Community workspace, does not activate triggers, and does not accept paid-project assignment.
 - **Inputs:** required `name` (1–128), `nodes` (1–1,000), and `connections`
   object; optional `description` (up to 16,384), `settings` object (default
   `{}`), `nodeGroups` (up to 1,000 safe JSON values), `staticData` (object,
@@ -463,9 +463,9 @@ Creates a credential while preventing credential values from entering MCP
 output or security logs.
 
 - **Policy and endpoint:** write; `POST /credentials`;
-  `RO=false, D=true, I=false, OW=true`. Requires mode `write` or `unsafe`.
+  `RO=false, D=false, I=false, OW=true`. Requires mode `write` or `unsafe`.
 - **Requirements:** Requires mode `write` or `unsafe` and API-key permission to create the requested credential type.
-- **Community Edition:** Verified on Community 2.30.5 and 2.30.7. Paid-project placement is intentionally absent, and credential values are output-prohibited.
+- **Community Edition:** Verified on Community 2.30.5 and 2.30.7. Creation is additive; paid-project placement is intentionally absent, and credential values are output-prohibited.
 - **Inputs:** required `name` (1–128), `type` (1–128 ASCII letters, digits,
   `_`, `.`, or `-`), and `data` (safe JSON object); optional
   `isResolvable?: boolean`.
@@ -581,15 +581,14 @@ Tests one stored credential through n8n.
 - **Community Edition:** Verified on Community 2.30.5 and 2.30.7. Success depends on the credential type and its external service; no credential value is returned.
 - **Inputs:** required `credentialId`; `confirmation` must equal
   `TEST <credentialId>`.
-- **Returns:** the input ID plus an allowlisted status and optional bounded
-  message. Over-long upstream status or message text is truncated to the
-  bounded caps (64 and 512 characters) with `truncated: true` rather than
-  rejected, so the completed test outcome is always preserved.
+- **Returns:** the input ID, the allowlisted `OK` or `Error` status, and a
+  server-authored success/failure message. The upstream diagnostic message is
+  withheld because it is untrusted and may contain credential or service data.
 - **Failures and privacy:** this call may contact the credential's external
   service and cause observable authentication traffic. Denied mode or
-  confirmation issues zero requests; returned messages are sanitized.
+  confirmation issues zero requests; no upstream diagnostic text is returned.
 - **Example:** `{ "credentialId": "cred_1", "confirmation": "TEST cred_1" }` →
-  `{ "data": { "credentialId": "cred_1", "status": "OK", "message": "Connection succeeded" }, "redacted": false, "untrusted": true }`.
+  `{ "data": { "credentialId": "cred_1", "status": "OK", "message": "Credential test succeeded." }, "redacted": false, "untrusted": true }`.
 
 ## n8n_credentials_usage
 
@@ -651,9 +650,9 @@ Reads one workflow tag by ID.
 Creates a workflow tag.
 
 - **Policy and endpoint:** write; `POST /tags`;
-  `RO=false, D=true, I=false, OW=true`. Requires mode `write` or `unsafe`.
+  `RO=false, D=false, I=false, OW=true`. Requires mode `write` or `unsafe`.
 - **Requirements:** Requires mode `write` or `unsafe` and API-key permission to create workflow tags.
-- **Community Edition:** Verified on Community 2.30.5 and 2.30.7 with the live Community 1–24 character name bound.
+- **Community Edition:** Verified on Community 2.30.5 and 2.30.7 with the live Community 1–24 character name bound. Creation is additive and never assigns the new tag to a workflow.
 - **Inputs:** required `name`, 1–24 characters, trimmed, with no control
   characters. The 24-character limit reflects live n8n behavior that is stricter
   than the historical OpenAPI schema.
@@ -738,9 +737,9 @@ Reads one user by stable ID or exact email address.
 Invites one non-owner user.
 
 - **Policy and endpoint:** unsafe; `POST /users`;
-  `RO=false, D=true, I=false, OW=true`.
+  `RO=false, D=false, I=false, OW=true`.
 - **Requirements:** Requires mode `unsafe`, exact email-bound confirmation, and API-key permission to invite users with the selected global role.
-- **Community Edition:** Verified on Community 2.30.5 and 2.30.7. It invites a global member/admin only and does not manage paid project membership.
+- **Community Edition:** Verified on Community 2.30.5 and 2.30.7. The invitation is additive but may send email; it invites a global member/admin only and does not manage paid project membership.
 - **Inputs:** required `email` (valid email up to 254);
   `role?: "global:member" | "global:admin"` defaults to `global:member`;
   `confirmation` must equal `INVITE <email>`.
@@ -817,15 +816,15 @@ Reads n8n's official insights summary, optionally constrained by date.
 
 ## n8n_audit_generate
 
-Requests n8n's instance security audit. Although the endpoint is intended to
-generate a report, it uses POST and can perform broad instance inspection, so
-this server applies the conservative unsafe policy.
+Requests n8n's instance security audit. The endpoint performs broad instance
+inspection and uses POST, so this server applies the conservative unsafe
+operation policy even though the scan is non-destructive.
 
 - **Policy and endpoint:** unsafe; `POST /audit`;
-  `RO=false, D=true, I=false, OW=true`. Requires mode `unsafe` and exact
+  `RO=false, D=false, I=false, OW=true`. Requires mode `unsafe` and exact
   confirmation `GENERATE AUDIT`.
 - **Requirements:** Requires mode `unsafe`, exact `GENERATE AUDIT` confirmation, and API-key permission to generate the instance audit.
-- **Community Edition:** Verified on Community 2.30.5 and 2.30.7. The POST report endpoint is conservatively marked destructive; category support still depends on n8n.
+- **Community Edition:** Verified on Community 2.30.5 and 2.30.7. The POST report endpoint remains unsafe-gated but is annotated non-destructive because it does not change instance resources or configuration; category support still depends on n8n.
 - **Inputs:** optional `categories`, an array of at most five selections
   from `credentials`, `database`, `nodes`, `filesystem`, and `instance`;
   optional `daysAbandonedWorkflow` integer from 1 through 3,650; required

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "n8n-mcp-community",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "A security-focused MCP server for self-hosted n8n Community Edition.",
   "private": false,
   "releaseState": "candidate",
@@ -64,8 +64,7 @@
     "node": ">=22.0.0"
   },
   "overrides": {
-    "tmp": "0.2.7",
-    "@hono/node-server": "^2.0.11"
+    "tmp": "0.2.7"
   },
   "allowScripts": {},
   "scripts": {
@@ -114,7 +113,7 @@
     "verify:contributor": "npm run check:contributor && npm run test:coverage && npm run check:distribution:contributor && npm run check:consumer && npm run check:registry"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "1.29.0",
+    "@modelcontextprotocol/sdk": "1.30.0",
     "zod": "3.25.76"
   },
   "devDependencies": {
@@ -123,12 +122,12 @@
     "@types/node": "22.20.1",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",
-    "eslint": "10.7.0",
+    "eslint": "10.8.0",
     "fflate": "0.8.3",
-    "globals": "17.7.0",
-    "prettier": "3.9.5",
+    "globals": "17.8.0",
+    "prettier": "3.9.6",
     "typescript": "5.9.3",
-    "typescript-eslint": "8.64.0",
+    "typescript-eslint": "8.65.0",
     "yaml": "2.9.0"
   }
 }

package/server.json

@@ -8,13 +8,13 @@
     "url": "https://github.com/drzamarian/n8n-mcp-community",
     "source": "github"
   },
-  "version": "0.1.2",
+  "version": "0.1.4",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "n8n-mcp-community",
-      "version": "0.1.2",
+      "version": "0.1.4",
       "transport": {
         "type": "stdio"
       },