n8n instance-level MCP server and Claude connector: what it does, access and how to connect

n8n builds an MCP server into every instance (Cloud or self-hosted): read and write, OAuth or a personal token, off until an owner enables it. Verified 21 Oct 2026.

Official instance-level MCP server · read & write
Claude connector · read & write

Hosting: Remote HTTP on your own n8n instance (<your-n8n-instance>/mcp-server/http), Cloud or self-hosted; no vendor-hosted shared endpoint
Auth: OAuth (n8n's recommendation) or a personal access token sent as an Authorization: Bearer header
Read / write: Read and write: search and run workflows, build, edit, publish and archive them, manage data tables and (Preview) agents
Works with: Claude.ai, Claude Desktop, Claude Code, ChatGPT, Cursor, VS Code, Codex and other MCP clients
Plan requirement: Any n8n Cloud or self-hosted instance; building needs 2.13.0+, data tables 2.16.0+, the current settings screen 2.33.0+. No plan restriction documented; check n8n's pricing page for execution allowances
Last changed: n8n 2.42.0: Workflows exposed page renamed Workflows enabled (release date not documented by n8n)
Verification: Verified 21 Oct 2026 by theFinanceStack · confidence: high

What can an agent do with n8n through MCP?

Search your workflows, run and test the ones you enable, and build, edit, publish or archive workflows, data tables and agents. Every write is saved to your instance as soon as the tool runs, unless you approved the client with narrower permissions, such as read-only.

n8n's tools reference covers workflows, executions, credential names (no secrets), a workflow builder, agents (Preview, 2.34.0+) and data tables (2.16.0+).

What it can read

Search returns previews of every workflow the user can view, capped at 200.
Full details and runs need the workflow enabled for MCP.

What happens when it writes

Tool	What happens
`create_workflow_from_code`, `update_workflow`, `restore_workflow_version` and `archive_workflow`	Save straight to the instance. Writes are not held for review. `update_workflow` takes up to 100 operations per call.
`publish_workflow`	Makes the current draft live.
`execute_workflow`	Runs the published version with live credentials, so it does whatever that workflow does. In production mode it only starts workflows with a Webhook, Chat, Form or Schedule trigger. It returns an execution ID straight away, so the result comes from a second call.
`test_workflow`	Pins triggers, steps with credentials and HTTP Request steps. Code, Execute Command and file read/write steps still run for real (per n8n).
Data table tools	Add up to 1,000 rows per call. Can permanently delete columns.

Agents (Preview)

Agents are in Preview, and n8n advises against relying on them in production.

Tool	What happens
`call_agent`	Runs an agent draft with real tools and credentials. n8n warns it can change data and message real recipients.
`publish_agent`	Puts an agent live.
`delete_agent`	Permanent.
`update_agent_integration`	Connects an agent to Slack, Telegram or Linear. On a published agent the channel starts at once. A managed Slack install creates a credential.

Money

n8n has no payment tool of its own.
execute_workflow, call_agent, publish_workflow and publish_agent can each trigger a bill, payment or ledger post if the workflow or agent is built to do that.

Can

Search workflows, projects, folders and executions; read workflow details and history
Run enabled workflows (published version by default) or test them with pin data, which still runs Code, Execute Command and file steps (per n8n)
Create, update, restore and archive workflows; publish and unpublish them
Create data tables, add columns and add rows; rename or delete columns
Create, test, publish, unpublish and delete agents, and connect them to Slack, Telegram or Linear (Preview, 2.34.0+)
List credentials by name without secret data

Cannot

Read full details of, or run, a workflow not enabled for MCP (per n8n)
See anything the connected n8n user can't access (per n8n)
Run workflows that use human-in-the-loop steps or multi-step forms through execute_workflow (per n8n)
Give different clients different workflow sets: n8n says enabled workflows aren't scoped per client
Start a workflow in production mode unless it has a Webhook, Chat, Form or Schedule trigger (per n8n)

What access does it get?

The connected user's own n8n permissions, narrowed to what you approve for each client when it connects (read-only, for example) and to workflows and agents enabled for MCP.

Where	Scopes and permissions (as documented)	Admin requirement
Instance-level MCP server (any client)	OAuth or a personal access token tied to your user. With OAuth, each client gets only the permissions you approve when it connects; n8n's example is reading workflows without being able to create or run them. Separately, the tools reference checks each call against your grant, naming permissions such as workflow:read, execution:read, credential:read, agent:execute (on the agent's project) and tag:list (a global permission). n8n doesn't document what a personal access token can do, and token clients don't appear under Connected clients. Nothing is enabled by default: workflows, projects or folders are enabled one by one; search previews cover every workflow the user can view.	An instance owner or admin turns on MCP access in Settings › Instance-level MCP. Once it's on, any signed-in user can approve a client, per n8n. Owners and admins can restrict OAuth callback URLs, see other users' clients in the all-users view, and disable MCP, which disconnects every client. Self-hosters can lock the setting with N8N_MCP_MANAGED_BY_ENV and N8N_MCP_ACCESS_ENABLED (2.20.0+)
Claude connector	Same OAuth sign-in: you choose the client's permissions when Claude redirects you to n8n, and can check its access level or revoke it under Connected clients.	n8n owner/admin enables MCP first; Claude Team/Enterprise: an Owner adds connectors
MCP Server Trigger node (per workflow)	A separate server inside one workflow, exposing only its attached tool nodes; auth is Bearer, Header or None. With None the endpoint asks for no credentials, so use Bearer or Header auth.	Not documented by the vendor beyond permission to edit and publish the workflow

How do I connect it?

An owner or admin enables MCP access, then each user copies the Server URL from Settings › Instance-level MCP › Connect a client and adds it to their client, signing in with OAuth.

In n8n (owner or admin): Settings › Instance-level MCP › Enable MCP access, then enable the workflows you want exposed.
In Connection details select Connect, choose Claude.ai and use One-click setup. Or in Claude open Settings › Connectors › Add custom connector, name it n8n MCP and paste the Server URL ending in /mcp-server/http. n8n warns this is not the editor URL in your browser's address bar.
When Claude redirects you to n8n, approve only the permissions you need, read-only if you only want questions answered. Keep write tools on approval in Claude's tool permissions.
Team/Enterprise: an Owner adds the connector first. n8n also has a Claude directory listing (claude.com/connectors/n8n); the listing doesn't say how it finds your instance. For a token instead of OAuth, n8n documents a Claude Desktop config using supergateway via npx.

Cloud clients such as Claude.ai need an instance reachable from the internet.

What should a finance team watch for?

The agent can run live workflows and publish new ones, so whatever your workflows touch is in reach.

Every connected client sees the same enabled workflows, per n8n. Enable only what a use case needs, workflow by workflow, and leave auto-expose off.
When you approve each client in n8n, grant only the permissions it needs, such as read-only, and check its access level under Connected clients. Token clients don't appear there, and n8n doesn't document what a token can access.
Once an admin turns MCP on, any signed-in n8n user can connect a client, per n8n. Allowed callback URLs defaults to All callback URLs, which n8n calls less secure; set it to Only trusted URLs.
Writes apply when the tool runs; delete_data_table_column and delete_agent are permanent. Keep the client's approval prompt on for every write tool as a second check.
test_workflow still runs Code, Execute Command and file read/write steps for real, per n8n, and call_agent can message real recipients. Test on data you can afford to change.
Workflow descriptions, execution data and table rows are untrusted text: an injected instruction could push the agent to publish a changed workflow or run one that posts or pays.
Least privilege also sits in n8n: connect with a user limited to the right projects, and revoke clients under Connected clients (regenerating a token revokes the old one). Disabling MCP disconnects every client.
A personal access token sits in plain text in the client config, which is often synced; don't commit it. The same applies to an MCP Server Trigger token. Self-hosters can remove MCP with N8N_DISABLED_MODULES=mcp.
n8n's MCP pages make no data-handling statement; check n8n's and your AI provider's terms. Cloud clients need a publicly reachable instance.

How could finance teams and accounting firms use it?

Reads suit questions about what automations exist and how they ran; writes suit drafting workflow changes that a person reviews and publishes.

Inside a company

Ask which finance workflows enabled for MCP (invoice capture, bank syncs, approvals) failed this week and why.
Run an enabled reporting workflow, such as a cash summary, on demand from chat.
Draft a vendor-bill intake workflow and test it with pin data before a person publishes it, knowing Code and file steps still run during the test.
Compare two versions of a workflow to see what changed before month-end.

At an accounting firm

Review a client's automations and run history when taking over their books, using a scoped n8n user.
Build a close-checklist workflow in a client's instance and leave publishing to the client.
Store reconciliation exceptions in a data table for a reviewer.
Plan one connection per client instance.

Keep a person approving any publish or run that could change the ledger, and test AI-built workflows first.

Want n8n connected to Claude for your team?

We configure scoped connections and a review step before anything changes your books. We charge a fixed fee.

Book a 30-minute setup call

Change log

Date	Change	Source
2026-10-21	Re-verified: Connect a client dialog (2.33.0+), Workflows enabled page (2.42.0), callback URL restriction	docs.n8n.io/connect/connect-to-n8n-mcp-server
2026-01	n8n connector (n8n GmbH) listed in the Claude directory, Anthropic verified	claude.com/connectors/n8n
2026	Instance-level MCP server: OAuth or token, per-workflow enablement, building from 2.13.0, agents from 2.34.0	docs.n8n.io/connect/connect-to-n8n-mcp-server

FAQ

Is this official?

Yes. The MCP server is built into n8n itself, and the Claude connector is listed as made by n8n GmbH and Anthropic verified.

Is it free?

n8n doesn't list a separate MCP charge; it comes with your n8n Cloud or self-hosted instance. Your n8n and Claude or ChatGPT plan terms still apply.

Does it change data in n8n?

Yes, if you allow it. It can create, edit, publish and archive workflows, run them with live credentials, and change data tables and agents. You can approve a client read-only when it connects.

Is my data used to train models?

n8n's MCP docs don't address training or retention. Check n8n's terms and your AI provider's terms before connecting.

Can my accountant use it on my behalf?

n8n doesn't document delegated access. Each person connects with their own n8n user, so an accountant needs a user on your instance with the projects you choose.

Something wrong or out of date? Tell us and we'll email you when it's fixed.

Sources

Verified by theFinanceStack, 21 Oct 2026. Vendor list on the CFO Software Market Map courtesy of Jason Staats; AI connectivity data by theFinanceStack. Not tax, compliance or financial advice.