n8n as an MCP server: prove each exposed workflow is one narrow tool behind its own token

The Stack

Steps

1. 1

   Audit the trigger configs: one narrow workflow, own token, no loaded gun

   Model your MCP Server Triggers as {token, workflows, nodes}. CI asserts every agent-callable trigger holds exactly one workflow, no two triggers share a bearer token, and no wired node is a wildcard HTTP Request or a delete/drop/truncate database node. It reports the worst-case blast radius (the number of tools reachable if a single token leaks) and proves the whole-toolbox anti-pattern is caught. A clean config bounds a leaked token to one narrow workflow's tools; the anti-pattern exposes everything.

   python3 - <<'EOF'
   import re
   good = [
       {"id": "order-lookup", "token": "tok_orders", "workflows": ["order-lookup"], "nodes": ["postgres_select_readonly", "http_get_status_fixedhost"]},
       {"id": "post-status", "token": "tok_status", "workflows": ["status-post"], "nodes": ["slack_post_to_ops_channel"]},
   ]
   bad = [
       {"id": "toolbox", "token": "tok_shared", "workflows": ["orders", "billing", "admin"], "nodes": ["http_request_wildcard", "postgres_delete", "slack_post_any"]},
       {"id": "reports", "token": "tok_shared", "workflows": ["reports"], "nodes": ["postgres_select_readonly"]},
   ]
   danger = [r"wildcard", r"_any$", r"\bany\b", r"delete", r"drop", r"truncate", r"exec", r"_write$"]
   def loaded_gun(node):
       return any(re.search(p, node, re.I) for p in danger)
   def audit(triggers):
       findings = []
       tokens = [t["token"] for t in triggers]
       for t in triggers:
           if tokens.count(t["token"]) > 1:
               findings.append(t["id"] + ": bearer token shared across triggers (one leaked token exposes all of them)")
           if len(t["workflows"]) != 1:
               findings.append(t["id"] + ": exposes " + str(len(t["workflows"])) + " workflows on one endpoint (expose one narrow workflow)")
           guns = [n for n in t["nodes"] if loaded_gun(n)]
           if guns:
               findings.append(t["id"] + ": loaded-gun node(s) agent-callable: " + ", ".join(guns))
       blast = max(sum(len(t["nodes"]) for t in triggers if t["token"] == tok) for tok in set(tokens))
       return findings, blast
   
   good_findings, good_blast = audit(good)
   bad_findings, bad_blast = audit(bad)
   assert not good_findings, good_findings
   assert bad_findings, "the whole-toolbox anti-pattern must be caught"
   print("n8n MCP exposure OK: each agent-callable Server Trigger exposes ONE narrow workflow behind its OWN bearer token with no loaded-gun node, so a leaked token is bounded to " + str(good_blast) + " tool(s); the anti-pattern (whole toolbox on one shared token, delete-capable node attached) is caught with " + str(len(bad_findings)) + " finding(s). The confused-deputy runtime, per-node auth, and the real deploy are fenced")
   EOF

2. 2

   Do it in real n8n (the parts CI cannot do for you)

   Drop one MCP Server Trigger per narrow workflow, set a distinct Bearer/header token on each, and wire in only the nodes that workflow needs (prefer read-only). Point your agent at the URL, and if it is Claude Desktop bridge stdio to HTTP with mcp-remote. Then watch the execution log while the agent uses it, you will learn your real exposure in ten minutes of watching what it calls. Behind nginx disable proxy buffering on the MCP endpoint, and in queue mode route all /mcp traffic to one dedicated replica. The runtime behaviour and what the agent actually decides to call are the fenced parts.