n8n-nodes-claude-cli

Run Claude in n8n through your local, subscription-authenticated Claude CLI — no Anthropic API key. One node, two operations (Chat and Agentic), local execution, no Docker socket and no SSH to set up.

⚠️ Community node. It shells out to the claude CLI, which runs inside the n8n process's environment. Read Security and the ToS caveat before using it in production.

Why this node

The first-party n8n Anthropic node is API-key only. Existing CLI-bridge community nodes are oriented toward agentic coding and often need a mounted Docker socket or an SSH backend. This node fills the gaps:

• Chat — plain prompt → answer, with an optional JSON response mode (parsed for you, with one auto-retry on invalid JSON).
• Agentic — let Claude use tools (Read, Grep, Bash, …) with an explicit allow-list, permission mode, max turns and working directory.
• Local exec only — spawn('claude', …). No socket, no SSH, no API key.

Install

n8n → Settings → Community nodes → Install → n8n-nodes-claude-cli.

The claude CLI must be available and logged in in the same environment as n8n. See deploy/ for a ready-made n8n image with the CLI baked in and your subscription mounted read-only.

Credential — "Claude Subscription (Local CLI)"

Holds no secret (auth lives in ~/.claude). Fields:

| Field | Default | Purpose | |-------|---------|---------| | Claude Binary Path | claude | Path to the executable (leave as-is if on PATH) | | Default Model | (blank) | e.g. sonnet, opus, haiku, or a full id | | Timeout (seconds) | 120 | Kill a hung invocation |

Operations

Chat

| Param | Notes | |-------|-------| | Prompt | required | | Model | overrides the credential default | | System Prompt (Appended) | appended to Claude's system prompt | | Response Format | Text (default) or JSON |

JSON mode returns the parsed value under data (plus the raw text), retrying once if the first answer isn't valid JSON.

Agentic

Adds Allowed Tools (comma-separated; empty = none, the safe default), Permission Mode (default / plan / acceptEdits / bypassPermissions), Max Turns, and Working Directory.

Output

{
  "text": "…the model's answer…",
  "data": { "…": "…" },          // only in Chat + JSON mode
  "model": "sonnet",
  "costUsd": 0.0031,
  "numTurns": 1,
  "sessionId": "sess_…"
}

Security

• No shell — arguments are passed as an argv array, so prompt content can never be interpreted as a shell command (there's a test for the "; rm -rf / case).
• Default-deny tools — Chat grants no tools; Agentic starts with an empty allow-list. Enable Bash/Write/Edit only for workflows you trust.
• Read-only auth mount, unprivileged node user (see deploy/).

Terms of service

Driving a Claude Pro/Max subscription through automation may conflict with Anthropic's subscription terms — subscriptions are intended for interactive use; the API is the sanctioned path for programmatic/high-volume use. Confirm this fits your plan before relying on it.

Development

npm install --ignore-scripts   # n8n-workflow pulls a native dep only needed at n8n runtime
npm test                       # vitest — pure exec/parse logic
npm run typecheck
npm run build                  # tsc -> dist/ + icon copy

Architecture and invariants: docs/DESIGN.md. Contributing (incl. notes for AI agents): AGENTS.md.

License

MIT