The n8n MCP server has a single tool 'n8n_workflow' with significant structural and documentation gaps. The tool name does not follow verb-noun conventions (should be 'execute_workflow'), the description is minimal (22 chars), parameter descriptions are present but lack implementation context or validation guidance, and there is no documented output schema. The input schema visible in code shows basic JSON schema structure but lacks type constraints, enums, or detailed parameter documentation. The server appears to be an early-stage implementation with no error handling patterns, no output structure guidance, and no evidence of production-grade tool design. Based on rubric calibration, this falls in the F-D range (0-49) due to missing descriptions (<20 chars baseline violation), no output schema, and non-idiomatic naming.
Execute n8n workflows
Tool name 'n8n_workflow' does not follow verb_noun convention. Should start with action verb like 'execute_workflow' or 'run_workflow'. LLM cannot infer action from noun-only name.
Tool description is only 22 characters ('Execute n8n workflows'). Must expand to 50-200 chars with context on WHAT, WHEN, WHAT RETURNS, and any prerequisites.
No output schema documented. LLM cannot plan downstream steps without knowing what fields are returned. MCP spec requires documented return types for all tools.
'workflowData' parameter has no type validation constraints. Schema shows type:'object' but no properties defined, no required fields, no format guidance. LLM will pass arbitrary objects.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 27 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 23 | - | v1 |
'inputData' parameter lacks validation rules and constraints. Description says 'Input data for the workflow' but does not specify expected structure, format, required keys, or examples.
No error handling patterns implemented. Errors are logged but not structured for LLM recovery guidance. Tool does not indicate which errors are retryable vs fatal, or guide next steps.
Tool is destructive (executes workflows, may modify external state) but has no confirmation/dry-run step, no permission checks, and no audit trail. Risk classification missing.
No idempotency guarantee documented. If an agent retries the same workflow execution with the same params, will it create duplicates or return the existing result? Unknown.