n8n-mcp-community 0.2.1 → 0.3.0

package/CHANGELOG.md

@@ -6,6 +6,45 @@ All notable changes to this project will be documented here. The format follows
 
 ## [Unreleased]
 
+## [0.3.0] - Frozen release candidate
+
+Version 0.3.0 is a frozen release candidate. Availability is established only
+by matching npm provenance, GitHub Release assets and signatures, and MCP
+Registry readbacks; this immutable entry is not rewritten after publication.
+
+### Removed
+
+- **Breaking input-schema change:** `n8n_audit_generate` no longer publishes or
+  accepts `daysAbandonedWorkflow`. n8n Community 2.30.x stores that request
+  override in a legacy setting while the reporter reads typed instance
+  configuration, so the input could not reliably change the audit. Normal MCP
+  clients refresh the smaller schema after reconnecting; raw callers must stop
+  sending the removed field, omit empty category arrays, and deduplicate category
+  names. This incompatible `0.x` change is released as a new minor version.
+
+### Changed
+
+- `n8n_audit_generate` now publishes truthful read-only and idempotent safety
+  hints while retaining the conservative unsafe authorization gate for its
+  sensitive instance-wide report. It makes one request, accepts 1–5 unique
+  categories, treats n8n's empty-array clean result as an empty report, and
+  accepts nullable version metadata from n8n's version feed. It fails
+  explicitly instead of returning a partial audit when sanitizer or final
+  256 KiB result limits are exceeded; multi-category callers can retry with
+  fewer categories, while single-category callers can review the full report in
+  n8n.
+- Sanitized read results now distinguish content redaction from size reduction.
+  Audit reports use validated higher collection bounds within the same final
+  256 KiB envelope, while ordinary read tools keep safe bounded projections.
+- The generic 256 KiB ceiling now covers the complete serialized MCP result,
+  including text and structured content. Large reads that previously fit only
+  the text-side check now fail safely; already-applied mutations return a
+  bounded success summary with `truncated=true` and `redacted=true`.
+- Record parsing now preserves own `__proto__` keys through validation and
+  rewrites prototype-like output keys safely. Workflow updates retain those
+  graph entries instead of silently dropping them.
+- Development dependency `globals` was updated from 17.8.0 to 17.9.0.
+
 ## [0.2.1] - Frozen release candidate
 
 Version 0.2.1 is a frozen release candidate. Availability is established only
@@ -304,6 +343,7 @@ Registry readbacks; this immutable entry is not rewritten after publication.
   publishable history; authenticated public release receipts remain supported.
 
 [Unreleased]: #unreleased
+[0.3.0]: #030---frozen-release-candidate
 [0.2.1]: #021---frozen-release-candidate
 [0.2.0]: #020---frozen-release-candidate
 [0.1.4]: #014---frozen-release-candidate

package/README.md

@@ -104,7 +104,7 @@ how to check the download.
 The current source candidate has been verified with:
 
 - exactly **44 tools**, **5 resources**, and **4 prompts** over real stdio;
-- **297 passing tests** locally on Node.js 24.18.1; CI and release gates require
+- **313 passing tests** locally on Node.js 24.19.0; CI and release gates require
   the pinned Node.js 22.23.1 and 24.18.0 matrix;
 - zero findings from Gitleaks, Semgrep, Trivy, and both project-root
   production/full `npm audit` runs; all three source scanners are reproduced in
@@ -291,7 +291,7 @@ API. The project does not redistribute the `n8n-nodes-base` catalog and does not
 use browser cookies, interactive session routes, or runtime package downloads to
 construct one.
 
-The v0.2.1 candidate surface intentionally excludes arbitrary workflow execution,
+The v0.3.0 candidate surface intentionally excludes arbitrary workflow execution,
 credential/workflow transfer, folders, data tables, beta evaluation endpoints,
 and execution annotations. See the [roadmap](ROADMAP.md) for the annotation
 proposal retained outside the release target.

package/ROADMAP.md

@@ -18,7 +18,7 @@ maintainer approval.
 
 ## Accepted backlog proposal
 
-Execution annotations remain a coherent two-tool proposal outside v0.2.1:
+Execution annotations remain a coherent two-tool proposal outside v0.3.0:
 
 - `n8n_executions_get_tags`
 - `n8n_executions_update_tags`

package/SECURITY.md

@@ -6,7 +6,7 @@ before public disclosure.
 
 ## Supported versions
 
-The latest maintained minor line — currently 0.2.x — receives security fixes.
+The latest maintained minor line — currently 0.3.x — receives security fixes.
 Older lines may be asked to upgrade when a safe backport is impractical.
 
 ## Report a vulnerability

package/dist/introspect/contracts.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { preservingRecord } from "../tools/schemas.js";
 import { INTROSPECT_RULE_IDS } from "./rule-ids.js";
 export const INTROSPECT_SCHEMA_VERSION = "1.0.0";
 export const INTROSPECT_ENGINE_VERSION = "2.0.0";
@@ -98,8 +99,8 @@ export const WorkflowNodeSchema = z
     onError: z.string().max(128).optional(),
     executeOnce: z.boolean().optional(),
     alwaysOutputData: z.boolean().optional(),
-    parameters: z.record(z.unknown()).optional(),
-    credentials: z.record(z.unknown()).optional(),
+    parameters: preservingRecord(z.unknown()).optional(),
+    credentials: preservingRecord(z.unknown()).optional(),
 })
     .passthrough();
 export const WorkflowResponseSchema = z
@@ -109,9 +110,9 @@ export const WorkflowResponseSchema = z
     active: z.boolean(),
     triggerCount: z.number().int().nonnegative().optional(),
     nodes: z.array(WorkflowNodeSchema).max(1_000).default([]),
-    connections: z.record(z.unknown()).default({}),
-    settings: z.record(z.unknown()).default({}),
-    pinData: z.record(z.unknown()).nullable().optional(),
+    connections: preservingRecord(z.unknown()).default({}),
+    settings: preservingRecord(z.unknown()).default({}),
+    pinData: preservingRecord(z.unknown()).nullable().optional(),
 })
     .passthrough();
 const ApiIdentifierSchema = z.union([z.string(), z.number()]).transform(String);
@@ -138,7 +139,7 @@ export const ExecutionListResponseSchema = z
 })
     .passthrough();
 export const ExecutionDetailResponseSchema = ExecutionMetadataSchema.extend({
-    data: z.record(z.unknown()).optional(),
+    data: preservingRecord(z.unknown()).optional(),
 }).passthrough();
 export const SeveritySchema = z.enum(["critical", "high", "medium", "low", "info"]);
 export const ConfidenceSchema = z.enum(["high", "medium", "low"]);
@@ -171,7 +172,7 @@ export const FindingSchema = z.object({
     }),
     evidence: z.object({
         summary: z.string(),
-        facts: z.record(FactValueSchema).optional(),
+        facts: preservingRecord(FactValueSchema).optional(),
     }),
     remediation: z.string(),
     documentationUrl: z

package/dist/security/redaction.js

@@ -54,6 +54,32 @@ export class OutputLimitError extends Error {
         this.name = "OutputLimitError";
     }
 }
+const DEFAULT_SANITIZATION_LIMITS = Object.freeze({
+    arrayLength: 1_000,
+    depth: 20,
+    nodes: 20_000,
+    objectEntries: 1_000,
+    stringInputLength: 131_072,
+    stringOutputLength: 32_768,
+});
+function resolvedLimit(value, fallback, name) {
+    if (value === undefined)
+        return fallback;
+    if (!Number.isSafeInteger(value) || value < 1) {
+        throw new RangeError(`${name} must be a positive safe integer.`);
+    }
+    return value;
+}
+function sanitizationLimits(options) {
+    return {
+        arrayLength: resolvedLimit(options.maxArrayLength, DEFAULT_SANITIZATION_LIMITS.arrayLength, "maxArrayLength"),
+        depth: resolvedLimit(options.maxDepth, DEFAULT_SANITIZATION_LIMITS.depth, "maxDepth"),
+        nodes: resolvedLimit(options.maxNodes, DEFAULT_SANITIZATION_LIMITS.nodes, "maxNodes"),
+        objectEntries: resolvedLimit(options.maxObjectEntries, DEFAULT_SANITIZATION_LIMITS.objectEntries, "maxObjectEntries"),
+        stringInputLength: resolvedLimit(options.maxStringInputLength, DEFAULT_SANITIZATION_LIMITS.stringInputLength, "maxStringInputLength"),
+        stringOutputLength: resolvedLimit(options.maxStringOutputLength, DEFAULT_SANITIZATION_LIMITS.stringOutputLength, "maxStringOutputLength"),
+    };
+}
 function compareStrings(left, right) {
     return left < right ? -1 : left > right ? 1 : 0;
 }
@@ -103,13 +129,16 @@ function looksLikeOpaquePathSegment(value) {
     }
     return entropy >= (value.length >= 32 ? 3.5 : 4);
 }
-function sanitizeString(value, structuralKey) {
-    const boundedInput = value.length > 131_072 ? value.slice(0, 131_072) : value;
+function sanitizeString(value, structuralKey, limits = DEFAULT_SANITIZATION_LIMITS) {
+    const boundedInput = value.length > limits.stringInputLength ? value.slice(0, limits.stringInputLength) : value;
     const normalizedInput = boundedInput.normalize("NFKC");
     let output = normalizedInput
-        .slice(0, 131_072)
+        .slice(0, limits.stringInputLength)
         .replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f]/g, "");
-    let redacted = boundedInput !== value || normalizedInput.length > 131_072 || output !== boundedInput;
+    let redacted = boundedInput !== value ||
+        normalizedInput.length > limits.stringInputLength ||
+        output !== boundedInput;
+    let sizeReduced = boundedInput !== value || normalizedInput.length > limits.stringInputLength;
     for (const [pattern, replacement] of HIGH_CONFIDENCE_CREDENTIAL_REDACTIONS) {
         pattern.lastIndex = 0;
         const filtered = output.replace(pattern, replacement);
@@ -132,7 +161,7 @@ function sanitizeString(value, structuralKey) {
         ((structuralKey === "documentationUrl" || structuralKey === "officialUrl") &&
             isOfficialN8nDocumentationUrl(output));
     if (validatedInternalValueIsSafe)
-        return { value: output, redacted };
+        return { value: output, redacted, sizeReduced };
     for (const [pattern, replacement] of MANDATORY_VALUE_REDACTIONS) {
         pattern.lastIndex = 0;
         const filtered = output.replace(pattern, replacement);
@@ -151,7 +180,7 @@ function sanitizeString(value, structuralKey) {
             STRUCTURAL_IDENTIFIER_KEY.test(structuralKey) &&
             SAFE_IDENTIFIER_VALUE.test(output);
     if (structuralValueIsSafe)
-        return { value: output, redacted };
+        return { value: output, redacted, sizeReduced };
     for (const [pattern, replacement] of TOKEN_REDACTIONS) {
         pattern.lastIndex = 0;
         const filtered = output.replace(pattern, replacement);
@@ -170,31 +199,35 @@ function sanitizeString(value, structuralKey) {
     const withPhone = redactPhone(output);
     redacted ||= withPhone !== output;
     output = withPhone;
-    if (output.length > 32_768) {
-        output = `${output.slice(0, 32_767)}\u2026`;
+    if (output.length > limits.stringOutputLength) {
+        output = `${output.slice(0, Math.max(0, limits.stringOutputLength - 1))}\u2026`;
         redacted = true;
+        sizeReduced = true;
     }
-    return { value: output, redacted };
+    return { value: output, redacted, sizeReduced };
 }
 function sanitizeValue(value, state, depth, structuralKey, preserveChildKeys = false, sensitiveDescriptor = false, treatSensitiveKeyAsStructural = false) {
     state.nodes += 1;
-    if (state.nodes > 20_000 || depth > 20) {
+    if (state.nodes > state.limits.nodes || depth > state.limits.depth) {
         state.redacted = true;
         state.structurallyReduced = true;
+        state.sizeReduced = true;
         return "[TRUNCATED]";
     }
     if (typeof value === "string") {
-        const result = sanitizeString(value, structuralKey);
+        const result = sanitizeString(value, structuralKey, state.limits);
         state.redacted ||= result.redacted;
+        state.sizeReduced ||= result.sizeReduced;
         return result.value;
     }
     if (value === null || typeof value === "boolean" || typeof value === "number")
         return value;
     if (Array.isArray(value)) {
-        const limit = Math.min(value.length, 1_000);
+        const limit = Math.min(value.length, state.limits.arrayLength);
         if (limit < value.length) {
             state.redacted = true;
             state.structurallyReduced = true;
+            state.sizeReduced = true;
         }
         return value
             .slice(0, limit)
@@ -225,14 +258,11 @@ function sanitizeValue(value, state, depth, structuralKey, preserveChildKeys = f
         typeof candidate === "string" &&
         SENSITIVE_KEY.test(candidate));
     const originalKeys = new Set(entries.map(([key]) => key));
-    for (const [entryIndex, [key, child]] of entries.slice(0, 1_000).entries()) {
-        if (PROTOTYPE_KEY.test(key)) {
-            state.redacted = true;
-            continue;
-        }
-        const sanitizedKey = sanitizeString(key);
+    for (const [entryIndex, [key, child]] of entries.slice(0, state.limits.objectEntries).entries()) {
+        const sanitizedKey = sanitizeString(key, undefined, state.limits);
+        state.sizeReduced ||= sanitizedKey.sizeReduced;
         let outputKey = key;
-        if (sanitizedKey.redacted) {
+        if (PROTOTYPE_KEY.test(key) || sanitizedKey.redacted) {
             let placeholderIndex = entryIndex + 1;
             do {
                 outputKey = `[REDACTED_KEY_${placeholderIndex}]`;
@@ -277,18 +307,26 @@ function sanitizeValue(value, state, depth, structuralKey, preserveChildKeys = f
         }
         output[outputKey] = sanitizeValue(child, state, depth + 1, key, STRUCTURAL_MAP_KEY.test(key), false);
     }
-    if (entries.length > 1_000) {
+    if (entries.length > state.limits.objectEntries) {
         state.redacted = true;
         state.structurallyReduced = true;
+        state.sizeReduced = true;
     }
     return output;
 }
 export function sanitizeForOutputDetailed(value, options = {}) {
-    const state = { nodes: 0, redacted: false, structurallyReduced: false };
+    const state = {
+        nodes: 0,
+        redacted: false,
+        structurallyReduced: false,
+        sizeReduced: false,
+        limits: sanitizationLimits(options),
+    };
     const data = sanitizeValue(value, state, 0, undefined, false, false, options.preserveValidatedRootRecordValues ?? false);
     return {
         output: { data, redacted: state.redacted, untrusted: true },
         structurallyReduced: state.structurallyReduced,
+        sizeReduced: state.sizeReduced,
     };
 }
 export function sanitizeForOutput(value, options = {}) {

package/dist/tools/common.js

@@ -1,10 +1,10 @@
 import { z } from "zod";
-import { cursor } from "./schemas.js";
+import { cursor, preservingRecord } from "./schemas.js";
 export const apiIdentifier = z.union([z.string(), z.number()]).transform(String);
 export const entitySchema = z.object({ id: apiIdentifier }).passthrough();
 export const listEnvelopeSchema = z
     .object({
-    data: z.array(z.record(z.unknown())).max(100),
+    data: z.array(preservingRecord(z.unknown())).max(100),
     nextCursor: cursor.nullable().optional(),
 })
     .passthrough();

package/dist/tools/credentials.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { defineTool } from "./definition.js";
 import { booleanQuery, numberQuery } from "./common.js";
-import { assertSafeJson, cursor, identifier, pageLimit, pathSegment, safeJsonValue, } from "./schemas.js";
+import { assertSafeJson, cursor, identifier, pageLimit, pathSegment, preservingRecord, safeJsonValue, } from "./schemas.js";
 import { credentialTypeSchema } from "./response-contracts.js";
 const credentialMetadataSchema = z.object({
     id: identifier(),
@@ -47,7 +47,7 @@ const usageWorkflowSchema = z.object({
         id: identifier().optional(),
         name: z.string().min(1).max(256),
         type: z.string().min(1).max(256),
-        credentials: z.record(workflowCredentialReferenceSchema).optional(),
+        credentials: preservingRecord(workflowCredentialReferenceSchema).optional(),
     }))
         .max(1_000),
 });
@@ -73,9 +73,7 @@ export const credentialTools = Object.freeze([
                 .string()
                 .regex(/^[A-Za-z0-9_.-]{1,128}$/)
                 .describe("Public n8n credential type returned by n8n_credentials_schema."),
-            data: z
-                .record(safeJsonValue)
-                .describe("Credential field values matching the selected public schema; never returned."),
+            data: preservingRecord(safeJsonValue).describe("Credential field values matching the selected public schema; never returned."),
             isResolvable: z
                 .boolean()
                 .optional()
@@ -157,8 +155,7 @@ export const credentialTools = Object.freeze([
                 .regex(/^[A-Za-z0-9_.-]{1,128}$/)
                 .optional()
                 .describe("Replacement public credential type; requires replacement data when supplied."),
-            data: z
-                .record(safeJsonValue)
+            data: preservingRecord(safeJsonValue)
                 .optional()
                 .describe("Replacement or partial credential field values; never returned."),
             isGlobal: z.boolean().optional().describe("Optional replacement for the n8n global flag."),

package/dist/tools/definition.js

@@ -6,12 +6,15 @@ import { authorizeOperation } from "../security/operation-policy.js";
 import { boundedJson, OutputLimitError, sanitizeForOutput, sanitizeForOutputDetailed, } from "../security/redaction.js";
 import { TOOL_ENDPOINT_CONTRACTS } from "./endpoint-contracts.js";
 import { genericToolOutputContract, MUTATION_IDENTITY_KEYS } from "./output-contracts.js";
+const MAX_SERIALIZED_TOOL_RESULT_BYTES = 256 * 1024;
+const DEFAULT_READ_ONLY_OUTPUT_LIMIT_MESSAGE = "The sanitized result exceeded safe output limits. Use narrower inputs when available; otherwise inspect the full object in n8n.";
 function annotationsFor(spec) {
+    const readOnly = spec.readOnly ?? spec.operation === "read-only";
     return {
         title: spec.title,
-        readOnlyHint: spec.operation === "read-only",
+        readOnlyHint: readOnly,
         destructiveHint: spec.destructive ?? spec.operation !== "read-only",
-        idempotentHint: spec.idempotent ?? spec.operation === "read-only",
+        idempotentHint: spec.idempotent ?? readOnly,
         openWorldHint: spec.openWorld ?? true,
     };
 }
@@ -40,8 +43,8 @@ function errorResult(error, correlationId, toolName) {
 }
 class ToolOutputError extends Error {
     code = "invalid_output";
-    constructor() {
-        super("The tool produced a result that did not match its published output contract.");
+    constructor(message = "The tool produced a result that did not match its published output contract.") {
+        super(message);
         this.name = "ToolOutputError";
     }
 }
@@ -52,13 +55,21 @@ function validatedOutput(value, outputSchema) {
     return parsed.data;
 }
 function resultFromValidatedOutput(safe) {
-    return {
+    const result = {
         content: [{ type: "text", text: boundedJson(safe) }],
         structuredContent: { ...safe },
     };
+    // The MCP result carries both the compatibility text and structured content. Bound their
+    // combined serialized form so consumers never receive a nominally successful result above
+    // the documented 256 KiB envelope.
+    if (Buffer.byteLength(JSON.stringify(result)) > MAX_SERIALIZED_TOOL_RESULT_BYTES) {
+        throw new OutputLimitError();
+    }
+    return result;
 }
 function fallbackResult(value, outputSchema) {
-    return resultFromValidatedOutput(validatedOutput(sanitizeForOutput(value), outputSchema));
+    const sanitized = sanitizeForOutput(value);
+    return resultFromValidatedOutput(validatedOutput({ ...sanitized, redacted: true }, outputSchema));
 }
 // When a mutation's full result exceeds the output cap, the write already landed upstream, so
 // summarize it to a bounded, stable shape (truncated + the scalar identity fields) instead of
@@ -84,11 +95,17 @@ function truncatedMutationResult(value) {
         identity,
     };
 }
-function buildSuccessResult(value, operation, primaryDataSchema, outputSchema, preserveValidatedRootRecordValues = false) {
+function buildSuccessResult(value, readOnly, primaryDataSchema, outputSchema, preserveValidatedRootRecordValues = false, sanitizationOptions = {}, failOnSanitizerLimit = false, readOnlyOutputLimitMessage) {
     // A handler may return only its official primary shape. The public mutation fallback is a
     // server-generated recovery form and can never be supplied directly by an upstream handler.
     validatedOutput(value, primaryDataSchema);
-    const sanitized = sanitizeForOutputDetailed(value, { preserveValidatedRootRecordValues });
+    const sanitized = sanitizeForOutputDetailed(value, {
+        ...sanitizationOptions,
+        preserveValidatedRootRecordValues,
+    });
+    if (failOnSanitizerLimit && sanitized.sizeReduced) {
+        throw new ToolOutputError(readOnlyOutputLimitMessage ?? DEFAULT_READ_ONLY_OUTPUT_LIMIT_MESSAGE);
+    }
     let safe;
     try {
         safe = validatedOutput(sanitized.output, outputSchema);
@@ -96,9 +113,7 @@ function buildSuccessResult(value, operation, primaryDataSchema, outputSchema, p
     catch (error) {
         // A completed mutation falls back only when the sanitizer explicitly reduced structure
         // because of its depth/node/breadth bounds. Ordinary post-sanitization schema drift must fail.
-        if (operation === "read-only" ||
-            !(error instanceof ToolOutputError) ||
-            !sanitized.structurallyReduced) {
+        if (readOnly || !(error instanceof ToolOutputError) || !sanitized.structurallyReduced) {
             throw error;
         }
         return fallbackResult(truncatedMutationResult(value), outputSchema);
@@ -107,7 +122,10 @@ function buildSuccessResult(value, operation, primaryDataSchema, outputSchema, p
         return resultFromValidatedOutput(safe);
     }
     catch (error) {
-        if (operation === "read-only" || !(error instanceof OutputLimitError))
+        if (readOnly && error instanceof OutputLimitError) {
+            throw new ToolOutputError(readOnlyOutputLimitMessage ?? DEFAULT_READ_ONLY_OUTPUT_LIMIT_MESSAGE);
+        }
+        if (readOnly || !(error instanceof OutputLimitError))
             throw error;
         // A mutating tool has already applied its write, so an over-cap result is a
         // truthful, bounded success summary rather than a misleading failure.
@@ -124,6 +142,12 @@ export function createToolContext(startup) {
 }
 export function defineTool(spec) {
     const annotations = annotationsFor(spec);
+    if (annotations.readOnlyHint === true && annotations.destructiveHint === true) {
+        throw new Error(`Tool ${spec.name} cannot be both read-only and destructive.`);
+    }
+    if (spec.failOnSanitizerLimit === true && annotations.readOnlyHint !== true) {
+        throw new Error(`Tool ${spec.name} can fail on sanitizer limits only when it is read-only.`);
+    }
     const endpointContract = TOOL_ENDPOINT_CONTRACTS[spec.name];
     if (endpointContract === undefined) {
         throw new Error(`Tool ${spec.name} is missing its endpoint documentation contract.`);
@@ -131,7 +155,7 @@ export function defineTool(spec) {
     const inputShape = { ...spec.input };
     const inputSchema = z.object(inputShape).strict();
     const genericOutput = spec.outputSchema === undefined
-        ? genericToolOutputContract(spec.name, spec.operation, spec.outputDataDescription)
+        ? genericToolOutputContract(spec.name, annotations.readOnlyHint === true, spec.outputDataDescription)
         : undefined;
     const outputSchema = spec.outputSchema ?? genericOutput?.outputSchema;
     if (outputSchema === undefined) {
@@ -166,7 +190,7 @@ export function defineTool(spec) {
                         if (genericOutput === undefined) {
                             throw new Error(`Tool ${spec.name} is missing its primary output contract.`);
                         }
-                        result = buildSuccessResult(value, spec.operation, genericOutput.primaryDataSchema, outputSchema, spec.preserveValidatedRootRecordValues);
+                        result = buildSuccessResult(value, annotations.readOnlyHint === true, genericOutput.primaryDataSchema, outputSchema, spec.preserveValidatedRootRecordValues, spec.sanitizationOptions, spec.failOnSanitizerLimit, spec.readOnlyOutputLimitMessage);
                     }
                     if (spec.operation !== "read-only") {
                         console.error(JSON.stringify({

package/dist/tools/output-contracts.js

@@ -1,10 +1,11 @@
 import { z } from "zod";
 import { credentialTypeSchema, securityAuditSchema, workflowLifecycleMetadataSchema, } from "./response-contracts.js";
+import { preservingRecord } from "./schemas.js";
 const text = () => z.string();
 const nullableText = () => z.string().nullable();
 const count = () => z.number().int().nonnegative();
 const cursor = () => z.string().nullable();
-const unknownObject = () => z.record(z.unknown());
+const unknownObject = () => preservingRecord(z.unknown());
 function workflowNode() {
     return z
         .object({
@@ -466,12 +467,12 @@ const outputDataSchemas = Object.freeze({
         .strict()),
 });
 export const TOOL_OUTPUT_CONTRACT_NAMES = Object.freeze(Object.keys(outputDataSchemas).sort());
-export function genericToolOutputContract(toolName, operation, dataDescription) {
+export function genericToolOutputContract(toolName, readOnly, dataDescription) {
     const expectedData = outputDataSchemas[toolName];
     if (expectedData === undefined) {
         throw new Error(`Tool ${toolName} is missing its output data contract.`);
     }
-    const dataSchema = operation === "read-only" ? expectedData : z.union([expectedData, truncatedMutation()]);
+    const dataSchema = readOnly ? expectedData : z.union([expectedData, truncatedMutation()]);
     return {
         primaryDataSchema: expectedData,
         outputSchema: z

package/dist/tools/response-contracts.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
+import { preservingRecord } from "./schemas.js";
 function boundedRecord(valueSchema, maximumKeys, maximumKeyLength) {
-    return z.record(valueSchema).superRefine((value, context) => {
+    return preservingRecord(valueSchema).superRefine((value, context) => {
         const keys = Object.keys(value);
         if (keys.length > maximumKeys) {
             context.addIssue({
@@ -42,7 +43,7 @@ function credentialDependency() {
         .object({
         if: z
             .object({
-            properties: boundedRecord(z.record(z.unknown()), 1_000, 256),
+            properties: boundedRecord(preservingRecord(z.unknown()), 1_000, 256),
             required: textArray().optional(),
         })
             .strict()
@@ -136,7 +137,7 @@ function auditedWorkflowNode() {
         type: z.string(),
         typeVersion: z.number().finite(),
         position: z.array(z.number().finite()).length(2),
-        parameters: z.record(z.unknown()),
+        parameters: preservingRecord(z.unknown()),
         iconData: z
             .object({
             type: z.string(),
@@ -155,10 +156,10 @@ function nextVersion() {
         createdAt: z.string(),
         description: z.string(),
         documentationUrl: z.string(),
-        hasBreakingChange: z.boolean(),
-        hasSecurityFix: z.boolean(),
-        hasSecurityIssue: z.boolean(),
-        securityIssueFixVersion: z.string(),
+        hasBreakingChange: z.boolean().nullable().optional(),
+        hasSecurityFix: z.boolean().nullable().optional(),
+        hasSecurityIssue: z.boolean().nullable().optional(),
+        securityIssueFixVersion: z.string().nullable().optional(),
     })
         .strict();
 }
@@ -193,6 +194,9 @@ function instanceAuditReport() {
 /**
  * n8n Community 2.30.7 Public API security-audit response.
  *
+ * The endpoint's official empty-array state is normalized to an empty map by the tool handler
+ * before this report-map schema runs.
+ *
  * Report titles are upstream-defined map keys, while every report, section, and location is
  * discriminated by the official n8n audit types. Breadth limits keep validation deterministic.
  */

package/dist/tools/schemas.js

@@ -2,6 +2,7 @@ import { z } from "zod";
 const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/;
 const IDENTIFIER = /^[A-Za-z0-9_-]{1,128}$/;
 const PROTOTYPE_SEGMENT = /^(?:__proto__|prototype|constructor)$/;
+const OWN_RECORD_ESCAPE_PREFIX = "\u0000n8n-mcp-own-key:";
 const MAX_SAFE_JSON_NODES = 20_000;
 export const MUTABLE_NODE_ROOTS = [
     "parameters",
@@ -48,6 +49,45 @@ export const tagName = z
 export function isRecord(value) {
     return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
+function escapedOwnRecordKey(key) {
+    if (key === "__proto__")
+        return `${OWN_RECORD_ESCAPE_PREFIX}p`;
+    return key.startsWith(OWN_RECORD_ESCAPE_PREFIX) ? `${OWN_RECORD_ESCAPE_PREFIX}k${key}` : key;
+}
+function restoredOwnRecordKey(key) {
+    if (key === `${OWN_RECORD_ESCAPE_PREFIX}p`)
+        return "__proto__";
+    const escapedPrefix = `${OWN_RECORD_ESCAPE_PREFIX}k`;
+    return key.startsWith(escapedPrefix) ? key.slice(escapedPrefix.length) : key;
+}
+// Zod v3 intentionally skips an own `__proto__` key while parsing records. Reversibly escape
+// every colliding key before its value validation. Safe-key records keep ordinary object
+// semantics; records with prototype-related keys use a null prototype so trusted upstream JSON
+// can never disappear or mutate Object.prototype before sanitization.
+export function preservingRecord(valueSchema) {
+    const parsed = z.preprocess((value) => {
+        if (!isRecord(value))
+            return value;
+        const escaped = Object.create(null);
+        for (const [key, child] of Object.entries(value)) {
+            escaped[escapedOwnRecordKey(key)] = child;
+        }
+        return escaped;
+    }, z.record(valueSchema));
+    return parsed.transform((value) => {
+        const restoredEntries = Object.entries(value).map(([key, child]) => [restoredOwnRecordKey(key), child]);
+        const restored = (restoredEntries.some(([key]) => PROTOTYPE_SEGMENT.test(key)) ? Object.create(null) : {});
+        for (const [key, child] of restoredEntries) {
+            Object.defineProperty(restored, key, {
+                configurable: true,
+                enumerable: true,
+                value: child,
+                writable: true,
+            });
+        }
+        return restored;
+    });
+}
 export function assertSafeJson(value) {
     const stack = [{ value, depth: 0 }];
     let visited = 0;

package/dist/tools/utilities.js

@@ -4,7 +4,7 @@ import { sanitizeIntrospectResultForOutput } from "../introspect/sanitize.js";
 import { NODE_DOCUMENTATION } from "../content/node-docs.js";
 import { defineTool } from "./definition.js";
 import { booleanQuery, numberQuery, requireSafeAscii } from "./common.js";
-import { cursor, identifier, pageLimit } from "./schemas.js";
+import { cursor, identifier, pageLimit, preservingRecord } from "./schemas.js";
 import { compareCodeUnits } from "../introspect/order.js";
 import { securityAuditSchema } from "./response-contracts.js";
 const workflowSearchSchema = z.object({
@@ -51,11 +51,11 @@ function boundedCommunityPackageCollection(value) {
 }
 const insightsSchema = z
     .object({
-    total: z.record(z.unknown()),
-    failed: z.record(z.unknown()),
-    failureRate: z.record(z.unknown()),
-    timeSaved: z.record(z.unknown()),
-    averageRunTime: z.record(z.unknown()),
+    total: preservingRecord(z.unknown()),
+    failed: preservingRecord(z.unknown()),
+    failureRate: preservingRecord(z.unknown()),
+    timeSaved: preservingRecord(z.unknown()),
+    averageRunTime: preservingRecord(z.unknown()),
 })
     .passthrough();
 function includesQuery(value, query) {
@@ -112,39 +112,44 @@ export const utilityTools = Object.freeze([
     defineTool({
         name: "n8n_audit_generate",
         title: "Generate security audit",
-        description: "Run n8n's broad, non-destructive instance security scan. Omit categories to use n8n's complete default, or supply the exact risk areas to include. daysAbandonedWorkflow is independent: it changes only the inactive-workflow age threshold and does not select categories. Use n8n_introspect for one workflow. Requires unsafe mode and owner-authorized API access; returns a sanitized but untrusted report without changing configuration.",
+        description: "Run one read-only n8n security scan. Omit categories to use n8n's complete default, or provide 1-5 unique risk areas; an empty array is rejected. It makes exactly one POST /audit request and never changes resources or configuration. It is safe to retry but remains unsafe-mode and owner-authorized because the report can expose sensitive security posture. Use n8n_introspect for one workflow. Returns a sanitized, untrusted report; a clean scan returns an empty map. If it cannot fit, retry with fewer categories or read the full report in n8n.",
         operation: "unsafe",
         preserveValidatedRootRecordValues: true,
-        outputDataDescription: "Map of upstream report titles to validated reports. Each report has one official risk category and bounded sections with recommendations plus typed locations or instance details; all content is sanitized and untrusted.",
+        sanitizationOptions: {
+            maxArrayLength: 10_000,
+            maxDepth: 100,
+            maxNodes: 200_000,
+            maxObjectEntries: 10_000,
+            maxStringInputLength: 262_144,
+            maxStringOutputLength: 262_144,
+        },
+        failOnSanitizerLimit: true,
+        outputDataDescription: "Possibly empty map of upstream report titles to validated reports. Each report has one official risk category and bounded sections with recommendations plus typed locations or instance details; all content is sanitized and untrusted.",
+        readOnly: true,
+        readOnlyOutputLimitMessage: "The audit report exceeded safe output limits. If you selected multiple categories, retry with fewer; otherwise review the full report in n8n.",
         destructive: false,
+        idempotent: true,
         input: {
             categories: z
                 .array(z.enum(["credentials", "database", "nodes", "filesystem", "instance"]))
-                .max(5)
-                .optional()
-                .describe("Optional audit categories; omit to let n8n use its default complete selection."),
-            daysAbandonedWorkflow: z
-                .number()
-                .int()
                 .min(1)
-                .max(3_650)
+                .max(5)
+                .refine((values) => new Set(values).size === values.length, {
+                message: "categories must not contain duplicates.",
+            })
                 .optional()
-                .describe("Age threshold in days for classifying an inactive workflow as abandoned."),
+                .describe("Optional 1-5 unique audit categories; omit to let n8n use its complete default selection."),
+        },
+        handler: async (input, context) => {
+            const result = await context.client().request({
+                method: "POST",
+                path: "/audit",
+                body: input.categories === undefined
+                    ? {}
+                    : { additionalOptions: { categories: input.categories } },
+            });
+            return Array.isArray(result) && result.length === 0 ? {} : securityAuditSchema.parse(result);
         },
-        handler: async (input, context) => securityAuditSchema.parse(await context.client().request({
-            method: "POST",
-            path: "/audit",
-            body: input.categories === undefined && input.daysAbandonedWorkflow === undefined
-                ? {}
-                : {
-                    additionalOptions: {
-                        ...(input.categories === undefined ? {} : { categories: input.categories }),
-                        ...(input.daysAbandonedWorkflow === undefined
-                            ? {}
-                            : { daysAbandonedWorkflow: input.daysAbandonedWorkflow }),
-                    },
-                },
-        })),
     }),
     defineTool({
         name: "n8n_search_workflows",

package/dist/tools/workflows.js

@@ -2,7 +2,7 @@ import { z } from "zod";
 import { N8nApiError } from "../n8n/client.js";
 import { boundedJson, sanitizeForOutput, sanitizePathSegmentForOutput, } from "../security/redaction.js";
 import { defineTool } from "./definition.js";
-import { assertBoundedDepth, assertSafeJson, cursor, identifier, isRecord, MUTABLE_NODE_ROOTS, pageLimit, pathSegment, requiredSafeJsonValue, safeJsonValue, setUnknownPath, validateDotPath, } from "./schemas.js";
+import { assertBoundedDepth, assertSafeJson, cursor, identifier, isRecord, MUTABLE_NODE_ROOTS, pageLimit, pathSegment, preservingRecord, requiredSafeJsonValue, safeJsonValue, setUnknownPath, validateDotPath, } from "./schemas.js";
 import { booleanQuery, numberQuery } from "./common.js";
 import { parseWorkflowLifecycleMetadata } from "./response-contracts.js";
 // Trusted server-returned workflow data is carried through unchanged (large or prototype-named
@@ -26,8 +26,8 @@ const nodeSchema = z
         .array(z.number().finite())
         .length(2)
         .describe("Node canvas position as exactly two finite numbers."),
-    parameters: z.record(z.unknown()).default({}),
-    credentials: z.record(z.unknown()).optional(),
+    parameters: preservingRecord(z.unknown()).default({}),
+    credentials: preservingRecord(z.unknown()).optional(),
     disabled: z.boolean().optional(),
     webhookId: identifier("Stable dynamic-webhook routing identifier when present.").optional(),
 })
@@ -39,8 +39,10 @@ const connectionTargetSchema = z
     index: z.number().int().nonnegative().max(1_000),
 })
     .passthrough();
-const connectionsSchema = z.record(z.record(z.array(z.array(connectionTargetSchema).max(1_000)).max(1_000)));
-const staticDataSchema = z.union([z.record(z.unknown()), z.string().max(1024 * 1024)]).nullable();
+const connectionsSchema = preservingRecord(preservingRecord(z.array(z.array(connectionTargetSchema).max(1_000)).max(1_000)));
+const staticDataSchema = z
+    .union([preservingRecord(z.unknown()), z.string().max(1024 * 1024)])
+    .nullable();
 const workflowSchema = z.object({
     id: identifier(),
     versionId: identifier().optional(),
@@ -50,8 +52,8 @@ const workflowSchema = z.object({
     isArchived: z.boolean().optional(),
     nodes: z.array(nodeSchema).max(1_000),
     connections: connectionsSchema,
-    settings: z.record(z.unknown()).default({}),
-    pinData: z.record(z.unknown()).nullable().optional(),
+    settings: preservingRecord(z.unknown()).default({}),
+    pinData: preservingRecord(z.unknown()).nullable().optional(),
     staticData: staticDataSchema.optional(),
     nodeGroups: z.array(z.unknown()).max(1_000).optional(),
 });
@@ -106,12 +108,10 @@ const workflowWriteFields = {
     connections: connectionsSchema
         .optional()
         .describe("Complete replacement connection graph keyed by node name."),
-    settings: z
-        .record(z.unknown())
+    settings: preservingRecord(z.unknown())
         .optional()
         .describe("Complete replacement workflow settings object."),
-    pinData: z
-        .record(z.unknown())
+    pinData: preservingRecord(z.unknown())
         .nullable()
         .optional()
         .describe("Complete replacement pinned-data map, or null to clear it; values are never returned."),
@@ -136,7 +136,7 @@ class WorkflowContractError extends Error {
 // MUTABLE_NODE_ROOTS exactly; every allowed root is bounded so a corrupt value (a string
 // for a boolean, a non-integer retry count, an unknown onError enum) is rejected before PUT.
 const NODE_ROOT_VALUE_CONTRACTS = {
-    parameters: z.record(z.unknown()),
+    parameters: preservingRecord(z.unknown()),
     position: z.tuple([z.number().finite(), z.number().finite()]),
     disabled: z.boolean(),
     retryOnFail: z.boolean(),
@@ -339,9 +339,8 @@ function diffSnapshot(value) {
 }
 const MAX_PARAMETER_PATH_SEGMENTS = 16;
 const MAX_PARAMETER_CHANGE_DETAILS = 200;
-// Fit the exact sanitized MCP success envelope with headroom below the shared 256 KiB
-// transport ceiling. This accounts for NFKC expansion, redaction markers, selectors,
-// summaries, coverage, omission metadata, and pretty-print indentation.
+// Keep the compact workflow-diff data below 128 KiB so its duplicated structured and pretty-text
+// forms retain bounded headroom inside the shared 256 KiB serialized-result ceiling.
 const MAX_WORKFLOW_DIFF_OUTPUT_BYTES = 128 * 1024;
 function diffValueType(value) {
     if (value === null)
@@ -733,8 +732,7 @@ export const workflowTools = Object.freeze([
                 .max(1_000)
                 .describe("Complete non-empty node array with unique names; supplied IDs, when present, must also be unique."),
             connections: connectionsSchema.describe("Complete connection graph keyed by existing node names."),
-            settings: z
-                .record(z.unknown())
+            settings: preservingRecord(z.unknown())
                 .default({})
                 .describe("Workflow settings object (default empty object)."),
             nodeGroups: z
@@ -745,8 +743,7 @@ export const workflowTools = Object.freeze([
             staticData: staticDataSchema
                 .optional()
                 .describe("Optional static workflow data; accepted for creation but never returned."),
-            pinData: z
-                .record(z.unknown())
+            pinData: preservingRecord(z.unknown())
                 .nullable()
                 .optional()
                 .describe("Optional pinned-data map or null; accepted for creation but never returned."),

package/dist/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = "0.2.1";
+export const PACKAGE_VERSION = "0.3.0";

package/docs/compatibility.md

@@ -9,7 +9,7 @@ release evidence from the client-matrix gates that remain open.
 | ---------------------- | ------------------------------------------------------------- |
 | Node.js 22.23.1        | Pinned CI/release target; exact candidate proof comes from CI |
 | Node.js 24.18.0        | Pinned CI/release target; exact candidate proof comes from CI |
-| Node.js 24.18.1        | Current complete local candidate gate                         |
+| Node.js 24.19.0        | Current complete local candidate gate                         |
 | MCP transport          | stdio inventory verified as 44 tools, 5 resources, 4 prompts  |
 | macOS on Apple silicon | Development and local verification environment                |
 | Linux and Windows      | No public release claim yet                                   |
@@ -18,17 +18,40 @@ release evidence from the client-matrix gates that remain open.
 
 The package declares Node.js `>=22.0.0`. That engine range is an acceptance
 floor, not evidence that every later major has completed the release matrix.
-The supported release lines for v0.2.1 are Node.js 22 and 24.
+The supported release lines for v0.3.0 are Node.js 22 and 24.
+
+## Upgrading to 0.3.0
+
+Install `n8n-mcp-community@latest` again, then restart the MCP client. The
+connection values, command, modes, inventory, and non-audit inputs are unchanged.
+
+The 256 KiB generic output limit now covers the complete serialized MCP result,
+including both text and structured content. Large single-object reads that fit
+in 0.2.x can therefore fail safely in 0.3.0. Use narrower inputs when the tool
+offers them; otherwise inspect the full object in n8n. Mutations that already
+landed return a bounded success summary with `truncated=true` and `redacted=true`
+instead of inviting a retry.
+
+`n8n_audit_generate` no longer accepts `daysAbandonedWorkflow`. n8n Community
+2.30.x writes that request value to a legacy setting, while the audit reporter
+reads typed instance configuration, so callers could not rely on the override.
+Normal MCP clients refresh the smaller schema when they reconnect. Raw scripted
+callers must stop sending that field. Use the n8n instance setting when the
+upstream product exposes a working configuration path.
+
+Raw audit callers must also omit `categories` when they want n8n's complete
+default, instead of sending an empty array, and must remove duplicate category
+names. MCP clients receive these constraints when they reconnect.
 
 ## Upgrading from 0.1.x
 
 The connection values are unchanged. Global npm users keep the same client
 entry. Users who followed the 0.1.x npx guide must replace the pinned
 `n8n-mcp-community@0.1.4` argument with `n8n-mcp-community@latest` or
-`n8n-mcp-community@0.2.0`. After updating, restart the MCP client and confirm the
+`n8n-mcp-community@0.3.0`. After updating, restart the MCP client and confirm the
 version and 44/5/4 inventory.
 
-The 14 unsafe tools no longer publish or require a `confirmation` field;
+Since 0.2.0, the 14 unsafe tools no longer publish or require a `confirmation` field;
 `N8N_MCP_MODE=unsafe` is the only server-side mode gate. Raw scripted callers
 must stop sending that removed field. Privately distributed MCPB updates are
 manual; the [install guide](installation.md#update-or-roll-back-the-mcpb) gives
@@ -36,7 +59,7 @@ update and rollback steps.
 
 ## n8n Community Edition
 
-The v0.2.1 floor candidate is n8n Community Edition 2.30.5, with 2.30.7 as the
+The v0.3.0 floor candidate is n8n Community Edition 2.30.5, with 2.30.7 as the
 current comparison target. The compiled public 44-tool candidate passed fresh,
 disposable lifecycles on both versions with synthetic fixtures, API-key
 revocation, resource cleanup, enforced candidate-process egress isolation, and
@@ -48,7 +71,7 @@ browser cookies, interactive `/rest` routes, paid project transfers, arbitrary
 workflow execution, or runtime node-catalog downloads.
 
 `n8n_credentials_list` is supported only from n8n 2.30.5 onward. Project
-selectors are intentionally absent because v0.2.1 does not present paid project
+selectors are intentionally absent because v0.3.0 does not present paid project
 capabilities as Community features. Other tools may also depend on endpoint
 availability and the permissions assigned to the API key; an HTTP 403 does not
 by itself mean the endpoint is absent.
@@ -87,7 +110,7 @@ surface.
 
 ## Deliberate exclusions
 
-v0.2.1 does not include:
+v0.3.0 does not include:
 
 - folders or data tables;
 - beta evaluation endpoints;

package/docs/installation.md

@@ -83,15 +83,16 @@ Node versions.
 Run the install command again to update. To roll back, replace `latest` with a
 version, such as `0.1.4`.
 
-### Upgrade from 0.1.x to 0.2.0
+### Upgrade from 0.1.x
 
 Your n8n URL, API key, and `N8N_MCP_MODE` values stay the same. Update the
-package, then restart the MCP client so it reloads the tool schemas. Unsafe
-mode alone now unlocks unsafe tools; there is no second confirmation input.
+package, then restart the MCP client so it reloads the tool schemas. Version
+0.2.0 removed the second confirmation input; unsafe mode alone now unlocks
+unsafe tools.
 
 Global npm users do not edit the client entry. If you followed the 0.1.x npx
 guide, your client is pinned to `n8n-mcp-community@0.1.4`: replace that argument
-with `n8n-mcp-community@latest` or `n8n-mcp-community@0.2.0`. Restart the client,
+with `n8n-mcp-community@latest` or `n8n-mcp-community@0.3.0`. Restart the client,
 run the npx version check below, and confirm the 44/5/4 inventory.
 
 If custom code sends raw tool-call JSON, remove the former `confirmation` field

package/docs/security-model.md

@@ -1,6 +1,6 @@
 # Security model
 
-This document describes the controls and residual risks of the v0.2.1 source
+This document describes the controls and residual risks of the v0.3.0 source
 candidate. It is a threat model, not a claim that the software or the connected
 n8n instance is invulnerable.
 
@@ -94,6 +94,9 @@ The shared sanitizer:
 - bounds strings, arrays, object entries, depth, and total traversed nodes.
 
 Generic serialized results are limited to 256 KiB and marked `untrusted: true`.
+That limit covers the complete MCP result, including its text and structured
+forms. A mutation summary sets `redacted: true` whenever the original result was
+truncated, even when the retained identity fields need no additional redaction.
 `redacted: false` means no configured sanitizer matched; it does not certify
 that content is harmless, anonymous, or free of unknown secret formats.
 Introspect emits its allowlisted reduced schema directly after applying the

package/docs/tools.md

@@ -21,14 +21,19 @@ result envelope in abbreviated form.
   tool-specific `data` contract in `tools/list`; the sections below are the
   normative human-readable detail. The sanitized envelope is validated against
   that same contract before a success is returned. The final serialized result is limited to
-  256 KiB. When a successful write or unsafe operation produces a
+  256 KiB. `redacted=true` means untrusted content was removed, replaced, or
+  shortened, so generic reads are safe projections rather than byte-exact
+  exports. When a successful operation with `RO=false` produces a
   result above that cap, the tool reports a truncated success summary
   (`truncated: true`, `outcome: "success"`, and bounded identity fields)
-  instead of an error, because the mutation has already been applied;
-  read-only tools keep the over-cap error. `n8n_introspect` applies the shared sanitizer and returns
-  its declared diagnostic schema directly, with one concise summary block and
-  one exact JSON fallback; its dedicated reducer and combined-output budget are
-  documented below.
+  instead of an error, because a mutation may already have been applied;
+  tools with `RO=true` keep the over-cap error even when their authorization
+  class is unsafe. When a generic read has no narrowing input, inspect the full
+  object in n8n. `n8n_introspect` applies the shared sanitizer and returns its
+  declared diagnostic schema directly, with one concise summary block and one
+  exact JSON fallback. Its dedicated limits are 128 KiB for structured output
+  and 320 KiB for the combined summary/JSON rendering; they are separate from
+  the generic envelope cap.
 - **HTTP:** Public API paths are relative to `/api/v1`; `/healthz` is the only
   root path. Requests are same-origin, redirect-free, time-bounded, and limited
   to 2 MiB in each direction.
@@ -813,25 +818,30 @@ Reads n8n's official insights summary, optionally constrained by date.
 ## n8n_audit_generate
 
 Requests n8n's instance security audit. The endpoint performs broad instance
-inspection and uses POST, so this server applies the conservative unsafe
-operation policy even though the scan is non-destructive.
+inspection and uses POST. The scan is read-only and safe to retry, but this
+server keeps it behind the conservative unsafe policy because the report can
+expose sensitive security posture.
 
 - **Policy and endpoint:** unsafe; `POST /audit`;
-  `RO=false, D=false, I=false, OW=true`. Requires mode `unsafe`.
+  `RO=true, D=false, I=true, OW=true`. Requires mode `unsafe`; the policy class
+  controls authorization, while the annotations describe external effects.
 - **Requirements:** Requires mode `unsafe` and API-key permission to generate the instance audit.
-- **Community Edition:** Verified on Community 2.30.5 and 2.30.7. The POST report endpoint remains unsafe-gated but is annotated non-destructive because it does not change instance resources or configuration; category support still depends on n8n.
-- **Inputs:** optional `categories`, an array of at most five selections
-  from `credentials`, `database`, `nodes`, `filesystem`, and `instance`;
-  optional `daysAbandonedWorkflow` integer from 1 through 3,650. Options are
-  sent under the official `additionalOptions` request property.
+- **Community Edition:** Verified on Community 2.30.5 and 2.30.7. Each call makes exactly one request and reads current state without changing instance resources or configuration. The ineffective upstream `daysAbandonedWorkflow` override is intentionally not exposed because n8n 2.30.x writes a legacy setting while its reporter reads typed configuration ([official 2.30.7 source](https://github.com/n8n-io/n8n/blob/n8n%402.30.7/packages/cli/src/security-audit/security-audit.service.ts)); category support still depends on n8n.
+- **Inputs:** optional `categories`, an array of 1–5 unique selections from
+  `credentials`, `database`, `nodes`, `filesystem`, and `instance`. Omit it for
+  n8n's complete default; an explicit empty or duplicate selection is rejected.
+  Selected categories are sent under the official `additionalOptions` request property.
 - **Returns:** a bounded map of n8n-defined report titles. Every report has an
   official `risk` category and typed `sections`; sections contain a title,
   description, recommendation, and either typed credential/node/package/file
   locations or bounded instance settings and version details.
+  A valid audit with no risks returns an empty map.
 - **Failures and privacy:** instance-wide audit output can reveal sensitive
   security posture and remains untrusted. Unsupported categories, permissions,
-  versions, or malformed reports return sanitized errors.
-- **Example:** `{ "categories": ["credentials"], "daysAbandonedWorkflow": 30 }` →
+  versions, or malformed reports return sanitized errors. If the report exceeds
+  safe output limits, retry with fewer categories when more than one was selected;
+  otherwise review the full report in n8n.
+- **Example:** `{ "categories": ["credentials"] }` →
   `{ "data": { "Credentials Risk Report": { "risk": "credentials", "sections": [{ "title": "Unused credentials", "description": "Credentials not used by any workflow.", "recommendation": "Delete credentials that are no longer required.", "location": [{ "kind": "credential", "id": "cred_1", "name": "n8n API" }] }] } }, "redacted": false, "untrusted": true }`.
 
 ## n8n_search_workflows

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "n8n-mcp-community",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "A security-focused MCP server for self-hosted n8n Community Edition.",
   "private": false,
   "releaseState": "candidate",
@@ -125,7 +125,7 @@
     "ajv-formats": "3.0.1",
     "eslint": "10.8.0",
     "fflate": "0.8.3",
-    "globals": "17.8.0",
+    "globals": "17.9.0",
     "prettier": "3.9.6",
     "typescript": "5.9.3",
     "typescript-eslint": "8.65.0",

package/server.json

@@ -8,13 +8,13 @@
     "url": "https://github.com/drzamarian/n8n-mcp-community",
     "source": "github"
   },
-  "version": "0.2.1",
+  "version": "0.3.0",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "n8n-mcp-community",
-      "version": "0.2.1",
+      "version": "0.3.0",
       "transport": {
         "type": "stdio"
       },