n8n-mcp-community 0.1.4 → 0.2.0

package/CHANGELOG.md

@@ -6,6 +6,50 @@ All notable changes to this project will be documented here. The format follows
 
 ## [Unreleased]
 
+## [0.2.0] - Frozen release candidate
+
+Version 0.2.0 is a frozen release candidate. Availability is established only
+by matching npm provenance, GitHub Release assets and signatures, and MCP
+Registry readbacks; this immutable entry is not rewritten after publication.
+
+### Removed
+
+- **Breaking input-schema change:** the 14 unsafe tools no longer publish or
+  require the former `confirmation` input. Normal MCP clients refresh this
+  schema when they reconnect; raw scripted callers must stop sending that
+  field. This incompatible `0.x` change is released as a new minor version.
+
+### Changed
+
+- Selecting `N8N_MCP_MODE=unsafe` is now the complete server-side authorization
+  gate for the 14 elevated tools. Strict mode separation, MCP safety
+  annotations, n8n API permissions, input validation, and metadata-only mutation
+  audit events remain.
+- The README and client guides now use
+  `npm install --global n8n-mcp-community@latest` as the primary installation
+  path, with `npx` as the no-global-install alternative and exact version pins
+  retained for audit and rollback.
+- The README now follows a short landing-page flow: value, install, connect,
+  proof, and deeper docs. Copyable commands and clear npm, npx, and MCPB paths
+  replace the former release-review-first setup.
+- The demo now shows installation, connection, and a useful Introspect finding
+  with a clear fix. Its command uses `@latest`, and every frame uses synthetic
+  data.
+- Homebrew is listed as a planned CLI install channel. It remains separate from
+  MCPB updates and is not yet available.
+
+### Upgrade from 0.1.x
+
+- Existing URL, API-key, and mode values do not change.
+- Global npm users run the same install command again. Users who followed the
+  0.1.x pinned npx guide must replace `n8n-mcp-community@0.1.4` in their client
+  `args` with `n8n-mcp-community@latest` or `n8n-mcp-community@0.2.0`.
+- Privately distributed MCPB files update manually: download and install the
+  new signed bundle. The install guide also gives a remove-and-reinstall
+  rollback path.
+- Restart the MCP client after updating so it reloads `tools/list`. Custom code
+  that calls unsafe tools as raw JSON must remove the old `confirmation` field.
+
 ## [0.1.4] - Frozen release candidate
 
 Version 0.1.4 is a frozen release candidate. Availability is established only
@@ -241,6 +285,7 @@ Registry readbacks; this immutable entry is not rewritten after publication.
   publishable history; authenticated public release receipts remain supported.
 
 [Unreleased]: #unreleased
+[0.2.0]: #020---frozen-release-candidate
 [0.1.4]: #014---frozen-release-candidate
 [0.1.3]: #013---frozen-release-candidate
 [0.1.2]: #012---frozen-release-candidate

package/README.md

@@ -2,29 +2,81 @@
 
 [![n8n-mcp-community MCP server](https://glama.ai/mcp/servers/drzamarian/n8n-mcp-community/badges/score.svg)](https://glama.ai/mcp/servers/drzamarian/n8n-mcp-community)
 
-**A security-focused Model Context Protocol server for self-hosted n8n Community Edition.**
-
-Connect an MCP client to a **bounded 44-tool n8n Community Edition management surface**: create, edit,
-activate, and delete workflows, update individual nodes surgically, and manage
-executions, credentials, tags, users, diagnostics, and instance metadata — 44
-carefully bounded tools in total. Safety here is **progressive, not
-restrictive**: the server defaults to read-only, `write` unlocks authoring,
-and `unsafe` unlocks every tool with an exact per-call confirmation phrase for
-each destructive operation. It starts offline, uses the supported n8n Public
-API, and never sends workflow data to an external AI provider.
-
-> **Release evidence:** install only a version that appears consistently on
-> [npm](https://www.npmjs.com/package/n8n-mcp-community), the
-> [latest GitHub release](https://github.com/drzamarian/n8n-mcp-community/releases/latest),
-> and the MCP Registry entry `io.github.drzamarian/n8n-mcp-community`. A version
-> in the source tree remains a candidate until those external readbacks agree.
-> See [Installation](docs/installation.md).
-
-[Read the synthetic terminal demo transcript](docs/demo-transcript.md). It shows
-the exact-version startup, 44-tool inventory, and local Introspect
-diagnostics using only synthetic identifiers and documented output shapes.
-
-[![Animated synthetic terminal demonstration showing the exact-version startup, MCP inventory, and local Introspect result](docs/assets/demo.gif)](docs/demo-transcript.md)
+# A security-focused Model Context Protocol server for self-hosted n8n Community Edition
+
+Give your AI client 44 tools for self-hosted n8n Community Edition. Manage
+workflows, nodes, runs, credentials, tags, users, and diagnostics. No paid n8n
+features. The server makes no external AI calls.
+
+[![Install with npm](https://img.shields.io/badge/Install_with-npm-CB3837?logo=npm&logoColor=white)](#install)
+[![Download MCPB](https://img.shields.io/badge/Download-MCPB-6B4EFF)](https://github.com/drzamarian/n8n-mcp-community/releases/latest)
+[![Read the docs](https://img.shields.io/badge/Read-the_docs-1F6FEB)](docs/README.md)
+
+## Install
+
+You need Node.js 22 or 24, your n8n URL, and an n8n API key.
+
+### Install
+
+```bash
+npm install --global n8n-mcp-community@latest
+```
+
+`--global` installs the command once. Use `npx` below if you do not want a
+global install.
+
+### Connect
+
+```json
+{
+  "mcpServers": {
+    "n8n-community": {
+      "command": "n8n-mcp-community",
+      "env": {
+        "N8N_API_URL": "https://n8n.example.com",
+        "N8N_API_KEY": "replace-with-a-dedicated-api-key",
+        "N8N_MCP_MODE": "read-only"
+      }
+    }
+  }
+}
+```
+
+Restart your client. You should see 44 tools, 5 resources, and 4 prompts.
+
+If the client cannot find the command, run `command -v n8n-mcp-community` on
+macOS/Linux or `where n8n-mcp-community` on Windows. Put that full path in
+`"command"`.
+
+Want no global install? Copy this command into the client configuration shown
+in the full guide:
+
+```bash
+npx --yes n8n-mcp-community@latest
+```
+
+Want the Claude Desktop app flow? Use the MCPB below. See the full
+[installation guide](docs/installation.md) for updates, rollback, and checks.
+
+### Claude Desktop: install the MCPB (no Node.js needed)
+
+1. Open the [latest GitHub release](https://github.com/drzamarian/n8n-mcp-community/releases/latest).
+2. Download the file that ends in `.mcpb`.
+3. In Claude Desktop, open **Settings → Extensions → Advanced settings →
+   Install Extension…**.
+4. Pick the file. Enter your n8n URL, API key, and mode.
+
+[Anthropic's MCPB guide](https://support.claude.com/en/articles/10949351-getting-started-with-local-mcp-servers-on-claude-desktop)
+explains the same steps. Our [installation guide](docs/installation.md) explains
+how to check the download.
+
+> Install public builds only from
+> [npm](https://www.npmjs.com/package/n8n-mcp-community) or the
+> [latest GitHub release](https://github.com/drzamarian/n8n-mcp-community/releases/latest).
+
+[![Animated demo showing installation, connection, and a useful local Introspect finding](docs/assets/demo.gif)](docs/demo-transcript.md)
+
+[Read the demo transcript](docs/demo-transcript.md).
 
 ## Why this project
 
@@ -32,8 +84,8 @@ diagnostics using only synthetic identifiers and documented output shapes.
   n8n Community Edition, without presenting paid-only capabilities as available.
 - **44 useful tools, one explicit contract.** Every tool has bounded inputs,
   documented side effects, MCP safety annotations, and contract tests.
-- **Safe by default.** Read-only mode is the default. Writes and destructive or
-  externally contacting operations require progressively stronger gates.
+- **Safe by default.** Read-only mode is the default. You choose when to allow
+  writes or the full tool set.
 - **Deterministic Introspect.** `n8n_introspect` runs a local 23-rule engine;
   it does not execute workflows, call an agent, or contact an external model.
 - **Surgical node updates.** `n8n_update_node` changes one validated node path
@@ -44,13 +96,16 @@ diagnostics using only synthetic identifiers and documented output shapes.
 - **Data minimization.** Credential values, raw execution values, pin data, and
   static workflow data are not returned by the generic public tools.
 
+<details>
+<summary><strong>See verification evidence</strong></summary>
+
 ## Current verification
 
 The current source candidate has been verified with:
 
 - exactly **44 tools**, **5 resources**, and **4 prompts** over real stdio;
-- **295 passing tests** and the complete verification gate on Node.js 22.23.1
-  and 24.18.0;
+- **296 passing tests** locally on Node.js 24.18.1; CI and release gates require
+  the pinned Node.js 22.23.1 and 24.18.0 matrix;
 - zero findings from Gitleaks, Semgrep, Trivy, and both project-root
   production/full `npm audit` runs; all three source scanners are reproduced in
   CI, with immutable scanner/action identities;
@@ -70,90 +125,20 @@ repository-pinned MCPB signing identity, a human artifact-baseline receipt,
 tag-scoped protected-environment approval, and an externally signed MCPB
 handoff verified byte for byte against the reviewed unsigned candidate.
 
-## Quick start
-
-Requirements: Node.js 22 or 24, npm, a self-hosted n8n Community Edition
-instance, and an n8n Public API key with only the permissions you need.
-
-First identify a version whose npm provenance and GitHub release assets you have
-verified, then replace `<VERIFIED_VERSION>` below. Keep the pin exact:
-
-```json
-{
-  "mcpServers": {
-    "n8n-community": {
-      "command": "npx",
-      "args": ["--yes", "n8n-mcp-community@<VERIFIED_VERSION>"],
-      "env": {
-        "N8N_API_URL": "https://n8n.example.com",
-        "N8N_API_KEY": "replace-with-a-dedicated-api-key",
-        "N8N_MCP_MODE": "read-only"
-      }
-    }
-  }
-}
-```
-
-`read-only` is the recommended starting point, not a capability ceiling: the
-same 44-tool surface includes full workflow authoring. Set
-`N8N_MCP_MODE=write` to create and edit workflows, nodes, credentials, and
-tags, or `N8N_MCP_MODE=unsafe` to enable every tool — activation, deletion,
-retries, and the other destructive operations, each still guarded by an exact
-per-call confirmation phrase. See [Safety modes](#safety-modes).
-
-Restart the MCP client and confirm exactly 44 tools, 5 resources, and 4
-prompts. Compatible desktop clients can instead install the signed MCPB from
-the [latest verified release](https://github.com/drzamarian/n8n-mcp-community/releases/latest);
-verify its checksum against the release `SHA256SUMS` first.
-
-## Quick start from source
-
-Requirements: Node.js 22 or 24, npm, and a Git checkout of this repository.
-
-```bash
-npm ci
-npm run verify:contributor
-```
-
-Configure your MCP client to run the compiled stdio entry point:
-
-```json
-{
-  "mcpServers": {
-    "n8n-community": {
-      "command": "node",
-      "args": ["/absolute/path/to/n8n-mcp-community/dist/index.js"],
-      "env": {
-        "N8N_API_URL": "https://n8n.example.com",
-        "N8N_API_KEY": "replace-with-your-api-key",
-        "N8N_MCP_MODE": "read-only"
-      }
-    }
-  }
-}
-```
-
-Restart the MCP client and list tools. The server can initialize and expose its
-inventory without n8n credentials; connected tools validate the URL and API key
-only when called.
-
-Verified releases provide both a signed MCPB for compatible clients and
-exact-version `npx` configuration for portability. `@latest`, global installs,
-and `curl | shell` are not reproducible defaults. See
-[Installation](docs/installation.md) for the release policy and client-specific
-guidance.
+</details>
 
 ## Safety modes
 
-| Mode      | What it allows                                                    | Required configuration                                     |
-| --------- | ----------------------------------------------------------------- | ---------------------------------------------------------- |
-| Read-only | Read-only tools only                                              | Default, or `N8N_MCP_MODE=read-only`                       |
-| Write     | Read-only and mutation tools without the unsafe confirmation gate | `N8N_MCP_MODE=write`                                       |
-| Unsafe    | All tools                                                         | `N8N_MCP_MODE=unsafe` plus the exact per-call confirmation |
+| Mode      | What it allows                                                  | Required configuration               |
+| --------- | --------------------------------------------------------------- | ------------------------------------ |
+| Read-only | Read-only tools only                                            | Default, or `N8N_MCP_MODE=read-only` |
+| Write     | Read-only and ordinary mutation tools                           | `N8N_MCP_MODE=write`                 |
+| Unsafe    | All tools, including destructive or external-contact operations | `N8N_MCP_MODE=unsafe`                |
 
-Unsafe mode is necessary but not sufficient. Every unsafe call also requires a
-confirmation such as `DELETE wf_123`, `STOP exec_123`, or `TEST cred_123`.
-The n8n API key remains the final upstream permission boundary.
+Selecting unsafe mode is the complete server-side authorization gate for unsafe
+tools. MCP safety annotations remain accurate so compatible clients can apply
+their native approval UX, and the n8n API key remains the final upstream
+permission boundary.
 
 Plain HTTP is accepted automatically only for loopback URLs. A non-loopback
 HTTP instance additionally requires `N8N_ALLOW_INSECURE_HTTP=1`, which accepts
@@ -173,14 +158,14 @@ failure, and security reference.
 | [`n8n_workflows_create`](docs/tools.md#n8n_workflows_create)           | Write     | Create a validated workflow through the Public API.                    |
 | [`n8n_workflows_update`](docs/tools.md#n8n_workflows_update)           | Write     | Guard and update selected fields while preserving omitted fields.      |
 | [`n8n_update_node`](docs/tools.md#n8n_update_node)                     | Write     | Change one validated node property with non-atomic concurrency guards. |
-| [`n8n_workflows_delete`](docs/tools.md#n8n_workflows_delete)           | Unsafe    | Permanently delete one workflow after exact confirmation.              |
-| [`n8n_workflows_activate`](docs/tools.md#n8n_workflows_activate)       | Unsafe    | Activate one workflow after exact confirmation.                        |
-| [`n8n_workflows_deactivate`](docs/tools.md#n8n_workflows_deactivate)   | Unsafe    | Deactivate one workflow after exact confirmation.                      |
+| [`n8n_workflows_delete`](docs/tools.md#n8n_workflows_delete)           | Unsafe    | Permanently delete one workflow.                                       |
+| [`n8n_workflows_activate`](docs/tools.md#n8n_workflows_activate)       | Unsafe    | Activate one workflow.                                                 |
+| [`n8n_workflows_deactivate`](docs/tools.md#n8n_workflows_deactivate)   | Unsafe    | Deactivate one workflow.                                               |
 | [`n8n_workflows_get_version`](docs/tools.md#n8n_workflows_get_version) | Read-only | Retrieve one retained historical workflow version.                     |
 | [`n8n_workflows_get_tags`](docs/tools.md#n8n_workflows_get_tags)       | Read-only | List tags assigned to a workflow.                                      |
 | [`n8n_workflows_update_tags`](docs/tools.md#n8n_workflows_update_tags) | Write     | Replace a workflow's complete tag assignment.                          |
-| [`n8n_workflows_archive`](docs/tools.md#n8n_workflows_archive)         | Unsafe    | Archive one workflow after exact confirmation.                         |
-| [`n8n_workflows_unarchive`](docs/tools.md#n8n_workflows_unarchive)     | Unsafe    | Restore one archived workflow after exact confirmation.                |
+| [`n8n_workflows_archive`](docs/tools.md#n8n_workflows_archive)         | Unsafe    | Archive one workflow.                                                  |
+| [`n8n_workflows_unarchive`](docs/tools.md#n8n_workflows_unarchive)     | Unsafe    | Restore one archived workflow.                                         |
 | [`n8n_workflows_diff`](docs/tools.md#n8n_workflows_diff)               | Read-only | Compare nodes and connections without returning raw values.            |
 
 ### Executions
@@ -222,7 +207,7 @@ failure, and security reference.
 | ---------------------------------------------------- | --------- | ----------------------------------------------------------------- |
 | [`n8n_users_list`](docs/tools.md#n8n_users_list)     | Read-only | List users visible to the API key.                                |
 | [`n8n_users_get`](docs/tools.md#n8n_users_get)       | Read-only | Read one user by stable ID or exact email.                        |
-| [`n8n_users_create`](docs/tools.md#n8n_users_create) | Unsafe    | Invite a member or admin after exact email confirmation.          |
+| [`n8n_users_create`](docs/tools.md#n8n_users_create) | Unsafe    | Invite a member or admin.                                         |
 | [`n8n_users_delete`](docs/tools.md#n8n_users_delete) | Unsafe    | Delete one API-eligible user without unsupported transfer claims. |
 
 ### Diagnostics and instance metadata
@@ -231,7 +216,7 @@ failure, and security reference.
 | -------------------------------------------------------------------------- | --------- | ------------------------------------------------------------------- |
 | [`n8n_health`](docs/tools.md#n8n_health)                                   | Read-only | Perform a bounded same-origin health check.                         |
 | [`n8n_insights_summary`](docs/tools.md#n8n_insights_summary)               | Read-only | Read the official insights summary with optional date filters.      |
-| [`n8n_audit_generate`](docs/tools.md#n8n_audit_generate)                   | Unsafe    | Generate n8n's instance security audit after exact confirmation.    |
+| [`n8n_audit_generate`](docs/tools.md#n8n_audit_generate)                   | Unsafe    | Generate n8n's instance security audit.                             |
 | [`n8n_search_workflows`](docs/tools.md#n8n_search_workflows)               | Read-only | Search one workflow page locally by name, node type, or tag.        |
 | [`n8n_get_node_docs`](docs/tools.md#n8n_get_node_docs)                     | Read-only | Read one of four immutable offline core-node references.            |
 | [`n8n_list_node_types`](docs/tools.md#n8n_list_node_types)                 | Read-only | Inventory node types observed in bounded accessible workflow pages. |
@@ -306,7 +291,7 @@ API. The project does not redistribute the `n8n-nodes-base` catalog and does not
 use browser cookies, interactive session routes, or runtime package downloads to
 construct one.
 
-The v0.1.4 candidate surface intentionally excludes arbitrary workflow execution,
+The v0.2.0 candidate surface intentionally excludes arbitrary workflow execution,
 credential/workflow transfer, folders, data tables, beta evaluation endpoints,
 and execution annotations. See the [roadmap](ROADMAP.md) for the annotation
 proposal retained outside the release target.

package/ROADMAP.md

@@ -5,7 +5,7 @@ proposal enters the release surface only after a versioned specification,
 Community Edition evidence, security review, documentation, tests, and
 maintainer approval.
 
-## v0.1.0 release gate
+## Current release gate
 
 - Complete native-English documentation and inventory parity.
 - Pass disposable release-candidate lifecycles on n8n Community 2.30.5 and
@@ -14,11 +14,11 @@ maintainer approval.
   dependency notices.
 - Pass two independent adversarial implementation audits with zero actionable
   findings.
-- Enable repository security controls before the first public release.
+- Keep repository security controls and protected release gates enabled.
 
 ## Accepted backlog proposal
 
-Execution annotations remain a coherent two-tool proposal outside v0.1.0:
+Execution annotations remain a coherent two-tool proposal outside v0.2.0:
 
 - `n8n_executions_get_tags`
 - `n8n_executions_update_tags`

package/SECURITY.md

@@ -6,7 +6,7 @@ before public disclosure.
 
 ## Supported versions
 
-The latest maintained minor line — currently 0.1.x — receives security fixes.
+The latest maintained minor line — currently 0.2.x — receives security fixes.
 Older lines may be asked to upgrade when a safe backport is impractical.
 
 ## Report a vulnerability

package/dist/prompts.js

@@ -61,7 +61,7 @@ export function registerPrompts(server) {
                 role: "user",
                 content: {
                     type: "text",
-                    text: `Handle this credential objective safely: ${objective}\n\nUse n8n_credentials_schema before creation or value changes. Never repeat, log, or place credential values in prose. Use metadata and usage tools for discovery. Explain that credential testing may contact an external service and requires unsafe mode plus exact confirmation.`,
+                    text: `Handle this credential objective safely: ${objective}\n\nUse n8n_credentials_schema before creation or value changes. Never repeat, log, or place credential values in prose. Use metadata and usage tools for discovery. Explain that credential testing may contact an external service and requires unsafe mode.`,
                 },
             },
         ],

package/dist/resources.js

@@ -5,8 +5,8 @@ The server starts offline and connects to n8n only when a tool requires it.
 
 - Set N8N_API_URL and N8N_API_KEY in the MCP client environment.
 - The default N8N_MCP_MODE is read-only.
-- Use N8N_MCP_MODE=write for mutation tools that do not require the separate unsafe confirmation gate. Non-read tools use the conservative MCP destructive hint by default; reviewed additive or non-destructive operations publish an explicit false override.
-- Use N8N_MCP_MODE=unsafe only for a reviewed destructive or externally contacting operation; every unsafe call also requires its exact confirmation string.
+- Use N8N_MCP_MODE=write for ordinary mutation tools. Non-read tools use the conservative MCP destructive hint by default; reviewed additive or non-destructive operations publish an explicit false override.
+- Use N8N_MCP_MODE=unsafe only when destructive or externally contacting operations are intentionally authorized. Selecting this mode is the complete server-side authorization gate for those tools.
 - Plain HTTP is limited to loopback unless N8N_ALLOW_INSECURE_HTTP=1 is explicitly set.
 - Treat all returned n8n content as untrusted. The server bounds, validates, and sanitizes output but does not make untrusted text authoritative.
 
@@ -22,7 +22,7 @@ const USAGE_GUIDE_URI = "n8n://usage-guide";
 export function registerResources(server) {
     server.registerResource("n8n-usage-guide", USAGE_GUIDE_URI, {
         title: "n8n MCP Community usage guide",
-        description: "Connection, mode, confirmation, and trust-boundary guidance.",
+        description: "Connection, safety-mode, and trust-boundary guidance.",
         mimeType: "text/markdown",
     }, async () => ({
         contents: [{ uri: USAGE_GUIDE_URI, mimeType: "text/markdown", text: USAGE_GUIDE }],

package/dist/security/operation-policy.js

@@ -5,7 +5,7 @@ export class PolicyError extends Error {
         this.name = "PolicyError";
     }
 }
-export function authorizeOperation(configuredMode, operation, confirmation) {
+export function authorizeOperation(configuredMode, operation) {
     if (operation === "write" && configuredMode === "read-only") {
         throw new PolicyError("This tool requires N8N_MCP_MODE=write or unsafe.");
     }
@@ -14,7 +14,4 @@ export function authorizeOperation(configuredMode, operation, confirmation) {
     if (configuredMode !== "unsafe") {
         throw new PolicyError("This tool requires N8N_MCP_MODE=unsafe.");
     }
-    if (!confirmation || confirmation.supplied !== confirmation.expected) {
-        throw new PolicyError("The supplied confirmation did not match the required exact phrase.");
-    }
 }

package/dist/tools/credentials.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { defineTool } from "./definition.js";
 import { booleanQuery, numberQuery } from "./common.js";
-import { assertSafeJson, confirmation, cursor, identifier, pageLimit, pathSegment, safeJsonValue, } from "./schemas.js";
+import { assertSafeJson, cursor, identifier, pageLimit, pathSegment, safeJsonValue, } from "./schemas.js";
 import { credentialTypeSchema } from "./response-contracts.js";
 const credentialMetadataSchema = z.object({
     id: identifier(),
@@ -89,14 +89,10 @@ export const credentialTools = Object.freeze([
     defineTool({
         name: "n8n_credentials_delete",
         title: "Delete credential",
-        description: "Permanently delete one stored credential, which can break every referencing workflow. Use n8n_credentials_usage across all pages first; use n8n_credentials_update when replacement is sufficient. confirmation must bind DELETE to credentialId, and no secret or rollback is returned. Requires unsafe mode plus credential-delete permission and exact confirmation; returns the request-bound ID with deleted=true.",
+        description: "Permanently delete one stored credential, which can break every referencing workflow. Use n8n_credentials_usage across all pages first; use n8n_credentials_update when replacement is sufficient. No secret or rollback is returned. Requires unsafe mode plus credential-delete permission; returns the request-bound ID with deleted=true.",
         operation: "unsafe",
         outputDataDescription: "Object with the validated input credentialId and deleted=true. Identity is bound to the request because n8n does not consistently return the deleted credential ID.",
-        input: { credentialId: identifier("Stable ID of the credential to delete."), confirmation },
-        confirmation: (input) => ({
-            supplied: input.confirmation,
-            expected: `DELETE ${input.credentialId}`,
-        }),
+        input: { credentialId: identifier("Stable ID of the credential to delete.") },
         handler: async (input, context) => {
             await context
                 .client()
@@ -205,18 +201,11 @@ export const credentialTools = Object.freeze([
     defineTool({
         name: "n8n_credentials_test",
         title: "Test credential",
-        description: "Test one stored credential by allowing n8n to contact its external service, which receives and may log the attempt. Use n8n_credentials_get for metadata-only inspection and do not call this when network contact is unwanted. confirmation must bind TEST to credentialId. Requires unsafe mode plus test permission and exact confirmation; returns only the target-bound OK/Error outcome and withholds the upstream diagnostic message because it may contain secrets.",
+        description: "Test one stored credential by allowing n8n to contact its external service, which receives and may log the attempt. Use n8n_credentials_get for metadata-only inspection and do not call this when network contact is unwanted. Requires unsafe mode plus test permission; returns only the target-bound OK/Error outcome and withholds the upstream diagnostic message because it may contain secrets.",
         operation: "unsafe",
         outputDataDescription: "Object with credentialId, status OK or Error, and a server-authored message that discloses only whether the test succeeded. The untrusted upstream diagnostic message is never returned.",
         openWorld: true,
-        input: {
-            credentialId: identifier("Stable ID of the stored credential to test."),
-            confirmation,
-        },
-        confirmation: (input) => ({
-            supplied: input.confirmation,
-            expected: `TEST ${input.credentialId}`,
-        }),
+        input: { credentialId: identifier("Stable ID of the stored credential to test.") },
         handler: async (input, context) => {
             const raw = z.object({ status: z.enum(["OK", "Error"]) }).parse(await context.client().request({
                 method: "POST",

package/dist/tools/definition.js

@@ -6,7 +6,6 @@ import { authorizeOperation } from "../security/operation-policy.js";
 import { boundedJson, OutputLimitError, sanitizeForOutput, sanitizeForOutputDetailed, } from "../security/redaction.js";
 import { TOOL_ENDPOINT_CONTRACTS } from "./endpoint-contracts.js";
 import { genericToolOutputContract, MUTATION_IDENTITY_KEYS } from "./output-contracts.js";
-import { confirmation as confirmationField } from "./schemas.js";
 function annotationsFor(spec) {
     return {
         title: spec.title,
@@ -129,19 +128,7 @@ export function defineTool(spec) {
     if (endpointContract === undefined) {
         throw new Error(`Tool ${spec.name} is missing its endpoint documentation contract.`);
     }
-    // Make the required confirmation phrase discoverable in the tool schema by deriving it from the
-    // tool's own confirmation function (single source of truth, so the documented phrase can never
-    // drift from the enforced one). A placeholder proxy turns `DELETE ${input.workflowId}` into the
-    // template `DELETE <workflowId>`. The phrase is documented on the field but is deliberately never
-    // echoed back on a mismatch, so the guard still demands a deliberate, constructed confirmation.
     const inputShape = { ...spec.input };
-    let confirmationPhrase;
-    if (spec.confirmation && "confirmation" in inputShape) {
-        const placeholder = new Proxy({}, { get: (_target, property) => (typeof property === "string" ? `<${property}>` : undefined) });
-        confirmationPhrase = spec.confirmation(placeholder).expected;
-        const substitution = confirmationPhrase.includes("<") ? " — substitute the real value(s)" : "";
-        inputShape.confirmation = confirmationField.describe(`Deliberate-action guard. Must equal exactly: ${confirmationPhrase}${substitution}. A mismatch is rejected without echoing the expected phrase.`);
-    }
     const inputSchema = z.object(inputShape).strict();
     const genericOutput = spec.outputSchema === undefined
         ? genericToolOutputContract(spec.name, spec.operation, spec.outputDataDescription)
@@ -158,7 +145,6 @@ export function defineTool(spec) {
         annotations,
         endpointContract: Object.freeze([...endpointContract]),
         outputDataDescription: spec.outputDataDescription,
-        ...(confirmationPhrase === undefined ? {} : { confirmationPhrase }),
         validateInput: (input) => inputSchema.parse(input),
         register(server, context) {
             server.registerTool(spec.name, {
@@ -170,7 +156,7 @@ export function defineTool(spec) {
             }, async (input) => {
                 const correlationId = randomUUID();
                 try {
-                    authorizeOperation(context.startup.mode, spec.operation, spec.confirmation?.(input));
+                    authorizeOperation(context.startup.mode, spec.operation);
                     const value = await spec.handler(input, context);
                     let result;
                     if (spec.formatResult) {

package/dist/tools/executions.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { defineTool } from "./definition.js";
 import { booleanQuery, numberQuery } from "./common.js";
-import { confirmation, cursor, identifier, pageLimit, pathSegment } from "./schemas.js";
+import { cursor, identifier, pageLimit, pathSegment } from "./schemas.js";
 const executionId = z
     .union([
     identifier("Stable string ID of the saved execution."),
@@ -111,14 +111,10 @@ export const executionTools = Object.freeze([
     defineTool({
         name: "n8n_executions_delete",
         title: "Delete execution",
-        description: "Permanently delete one saved execution and its retained history. Use it only after n8n_executions_get confirms the target; use read tools for inspection. confirmation must bind DELETE to the same executionId, and the server provides no recovery or rollback. Requires unsafe mode plus execution-delete permission and exact confirmation; returns the request-bound ID with deleted=true.",
+        description: "Permanently delete one saved execution and its retained history. Use it only after n8n_executions_get confirms the target; use read tools for inspection. The server provides no recovery or rollback. Requires unsafe mode plus execution-delete permission; returns the request-bound ID with deleted=true.",
         operation: "unsafe",
         outputDataDescription: "Object with the validated input executionId and deleted=true. Identity is bound to the request and does not rely on an upstream response body.",
-        input: { executionId, confirmation },
-        confirmation: (input) => ({
-            supplied: input.confirmation,
-            expected: `DELETE ${input.executionId}`,
-        }),
+        input: { executionId },
         handler: async (input, context) => {
             await context
                 .client()
@@ -129,7 +125,7 @@ export const executionTools = Object.freeze([
     defineTool({
         name: "n8n_executions_retry",
         title: "Retry execution",
-        description: "Retry one eligible saved execution, potentially repeating every external effect already reached. Use it only after n8n_executions_get review; use n8n_executions_stop for a running execution. loadWorkflow=true uses the currently saved workflow, while false uses the original execution snapshot. Requires unsafe mode, retry permission, and RETRY bound to executionId; returns metadata without payload values.",
+        description: "Retry one eligible saved execution, potentially repeating every external effect already reached. Use it only after n8n_executions_get review; use n8n_executions_stop for a running execution. loadWorkflow=true uses the currently saved workflow, while false uses the original execution snapshot. Requires unsafe mode and retry permission; returns metadata without payload values.",
         operation: "unsafe",
         outputDataDescription: "Allowlisted metadata for the new or retried execution, including scalar identity/status/timing/retry fields when supplied by n8n; raw execution values are omitted.",
         input: {
@@ -138,12 +134,7 @@ export const executionTools = Object.freeze([
                 .boolean()
                 .default(true)
                 .describe("Load the currently saved workflow definition for the retry (default true)."),
-            confirmation,
         },
-        confirmation: (input) => ({
-            supplied: input.confirmation,
-            expected: `RETRY ${input.executionId}`,
-        }),
         handler: async (input, context) => summarizeExecution(executionSchema.parse(await context.client().request({
             method: "POST",
             path: `/executions/${pathSegment(input.executionId)}/retry`,
@@ -153,14 +144,10 @@ export const executionTools = Object.freeze([
     defineTool({
         name: "n8n_executions_stop",
         title: "Stop execution",
-        description: "Request cancellation of one running execution without rolling back completed external effects. Use n8n_executions_get for inspection or n8n_executions_retry for an eligible saved failure. confirmation must bind STOP to executionId; a successful HTTP response alone does not prove cancellation. Requires unsafe mode plus stop permission and exact confirmation; returns stopped, already_finished, or unknown from validated state.",
+        description: "Request cancellation of one running execution without rolling back completed external effects. Use n8n_executions_get for inspection or n8n_executions_retry for an eligible saved failure. A successful HTTP response alone does not prove cancellation. Requires unsafe mode plus stop permission; returns stopped, already_finished, or unknown from validated state.",
         operation: "unsafe",
         outputDataDescription: "Object with executionId, stopped, state (stopped, already_finished, or unknown), and optional finished/status/stoppedAt metadata. HTTP success alone never asserts that a stop occurred.",
-        input: { executionId, confirmation },
-        confirmation: (input) => ({
-            supplied: input.confirmation,
-            expected: `STOP ${input.executionId}`,
-        }),
+        input: { executionId },
         handler: async (input, context) => {
             const upstream = z
                 .object({

package/dist/tools/schemas.js

@@ -38,7 +38,6 @@ export const pageLimit = (maximum = 100, defaultValue = maximum) => z
     .max(maximum)
     .default(defaultValue)
     .describe(`Maximum records to request in this page (1-${maximum}; default ${defaultValue}).`);
-export const confirmation = z.string().min(1).max(300);
 export const tagName = z
     .string()
     .min(1)

package/dist/tools/tags.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { defineTool } from "./definition.js";
 import { numberQuery } from "./common.js";
-import { confirmation, cursor, identifier, pageLimit, pathSegment, tagName } from "./schemas.js";
+import { cursor, identifier, pageLimit, pathSegment, tagName } from "./schemas.js";
 const tagSchema = z
     .object({
     id: identifier(),
@@ -67,11 +67,10 @@ export const tagTools = Object.freeze([
     defineTool({
         name: "n8n_tags_delete",
         title: "Delete tag",
-        description: "Permanently delete one workflow tag, which can remove that label from multiple workflows. Use n8n_tags_get plus affected-workflow review first; use n8n_tags_update when a rename is sufficient. confirmation must bind DELETE to tagId, and no rollback is provided. Requires unsafe mode plus tag-delete permission and exact confirmation; returns the request-bound ID with deleted=true.",
+        description: "Permanently delete one workflow tag, which can remove that label from multiple workflows. Use n8n_tags_get plus affected-workflow review first; use n8n_tags_update when a rename is sufficient. No rollback is provided. Requires unsafe mode plus tag-delete permission; returns the request-bound ID with deleted=true.",
         operation: "unsafe",
         outputDataDescription: "Object with the validated input tagId and deleted=true. Identity is bound to the request and does not rely on an upstream response body.",
-        input: { tagId: identifier("Stable ID of the workflow tag to delete."), confirmation },
-        confirmation: (input) => ({ supplied: input.confirmation, expected: `DELETE ${input.tagId}` }),
+        input: { tagId: identifier("Stable ID of the workflow tag to delete.") },
         handler: async (input, context) => {
             await context
                 .client()