n8n MCP server: every client you connect sees every workflow you enable
If you turn on n8n's instance-level MCP server, the workflows you enable aren't scoped per client. Claude Code, ChatGPT and anything else you connect all see the same list.
That's in n8n's MCP server docs:
https://docs.n8n.io/connect/connect-to-n8n-mcp-server
You enable MCP once, then opt in each workflow. One exception: search_workflows previews every workflow your user can view, without the full data.
I use n8n and I write my code in Claude Code. Here's how I'd connect the two without handing over the whole instance:
1. Expose small, single-purpose workflows, like "create draft invoice", never a generic HTTP runner.
2. Leave Auto-expose new workflows off. It's off by default.
3. Use OAuth, grant the narrowest access, and revoke clients you stopped using.
4. Put a human approval step inside any workflow that sends, pays or deletes.
The MCP (Model Context Protocol) tools spec says a human SHOULD always be able to deny tool calls:
https://modelcontextprotocol.io/specification/2026-07-28/server/tools
The tradeoff: one connection serves every client, which is handy until one is a chat app you half trust. For tighter limits, an MCP Server Trigger node exposes tools from just one workflow.
Do you give each AI client its own scoped MCP server, or share one?