n8n MCP Server With Tool Annotations

An experimental n8n community node based on the behavior of n8n's built-in MCP Server Trigger. It adds configurable MCP tool annotations to selected tools exposed by the server, as described in the MCP standard schema, in the section "ToolAnnotations"

Also see the n8n forum entry at community.n8n.io/t/mcp-server-include-options-for-annotations/298669

The primary use case is adding:

{
  "readOnlyHint": true,
  "destructiveHint": false,
  "idempotentHint": true,
  "openWorldHint": false
}

to read-only tools so MCP clients can make better approval decisions.

Quick Start

Install the community package in n8n:

n8n-nodes-mcp-readonly-trigger

Then restart or reload n8n if your deployment does not load community nodes immediately.

In a workflow, add:

MCP Server (incl. Annotations)

This node behaves like n8n's built-in MCP Server Trigger, but it can add MCP tool annotations to selected tools in the tools/list response.

Connect AI Tool nodes in the same way as with n8n's built-in MCP Server Trigger:

1. Add MCP Server (incl. Annotations).
2. Add one or more AI Tool nodes, for example Postgres Tool nodes.
3. Connect each AI Tool node to the Tools input of the MCP server node.
4. Configure the MCP endpoint path and authentication.
5. Enter the exposed MCP tool names that should receive annotations.
6. Activate the workflow and use the production MCP URL in your MCP client.

Node Settings

Configure:

• Authentication: None, bearer authentication, or header authentication.
• Path: MCP endpoint path, for example proalpha-readonly-mcp.
• Read-Only Tool Names: Comma-separated or line-separated exposed MCP tool names that should receive the configured annotations.
• Read-Only Hint: Sets readOnlyHint.
• Destructive Hint: Sets destructiveHint.
• Idempotent Hint: Sets idempotentHint.
• Open World Hint: Sets openWorldHint.

Tool names must match the names returned by MCP tools/list, not necessarily the visible n8n node labels. For n8n AI Tool nodes, the tool name is often a sanitized version of the node name.

Example: Read-Only ERP Tools

Suppose your workflow exposes two read-only Postgres Tool nodes:

• read_only_artikel
• read_only_lagerbestand

Configure MCP Server (incl. Annotations) like this:

Authentication: Bearer Auth
Path: proalpha-readonly-mcp
Read-Only Tool Names:
read_only_artikel
read_only_lagerbestand

Read-Only Hint: true
Destructive Hint: false
Idempotent Hint: true
Open World Hint: false

When an MCP client calls tools/list, matching tools receive annotations like:

{
  "name": "read_only_lagerbestand",
  "annotations": {
    "readOnlyHint": true,
    "destructiveHint": false,
    "idempotentHint": true,
    "openWorldHint": false
  }
}

e.g.

where this is my full n8n workflow:

This lets MCP clients recognize that those tools are intended for read-only lookups. For example, a client may allow read-only tools with fewer approval prompts while continuing to ask before using tools that can modify data.

The production endpoint will look like:

https://YOUR_N8N_HOST/mcp/proalpha-readonly-mcp

Use the test URL shown in n8n only for manual testing while the editor is open.

Behavior

The node reuses the MCP server implementation exported by:

@n8n/n8n-nodes-langchain/mcp/core

It intercepts MCP responses and modifies only tool definitions returned by tools/list. Tool execution requests and results remain unchanged.

POST responses are buffered until completion so fragmented JSON can be safely rewritten. GET/SSE responses are transformed frame by frame without buffering the long-lived event stream.

This is metadata, not a security boundary. Continue using read-only database credentials and read-only node operations.

Compatibility

The package requires an n8n installation whose @n8n/n8n-nodes-langchain package exports ./mcp/core.

It also uses n8n's internal webhook authentication helpers. These are not a stable community-node API, so test the node whenever upgrading n8n.

The package has unit tests for:

• Tool-name parsing
• Selective annotation
• JSON/SSE response rewriting
• Fragmented POST response buffering
• Removal of stale Content-Length

It has also been tested in a live n8n workflow using the package name n8n-nodes-mcp-readonly-trigger.

Required n8n Settings

Community packages must be enabled:

N8N_COMMUNITY_PACKAGES_ENABLED=true

If your deployment explicitly disables unverified packages, also enable them:

N8N_UNVERIFIED_PACKAGES_ENABLED=true

Development

The package ships JavaScript directly and needs no build step:

npm test

The build script is intentionally a no-op.

Updating

If installed via the community node section in n8n, you can update it there if there has been a new version published via on npmjs.