Description

Detects when an AI agent in the published version of an n8n workflow has tools attached that make HTTP requests, run code, call other workflows, run shell commands on the n8n host or reach MCP servers, and no step asks a person to approve each call. The model decides when to call those tools and with what input, so whoever can steer what the agent reads, such as a chat message, an email or a web page it fetches, can make it send data to other services, change records or run commands with the permissions those tools hold.

Detection Strategy

• Lists every workflow the API key's user can see through the n8n public API, all of them for an owner or admin key, and reads only the version of each one that is published, skipping disabled nodes

• Keeps the nodes that let a model call tools, the AI Agent node and tool and the OpenAI, Anthropic, Google Gemini, Ollama and other model nodes with a Tools input, and the tools connected to that input

• Counts the HTTP Request tools, the tools that run code or call another workflow, the Execute Command tool and the MCP clients, from the MCP Client Tool or the MCP registry; a tool connected only through a human review tool, which asks a person to approve each call, does not count for the agent

• Reports a vulnerability when an agent has one of those tools, and records in the evidence each such agent with the name and type of those tools; a workflow whose listing omits the published version field, or whose published version has no node list or no connections, is recorded as unreadable rather than reported as clean