FlowSentry — n8n Workflow & MCP Security Scanner (Apify Actor)

Scan n8n workflow JSON exports for security issues before you import them into your automation stack. 18 rules mapped to OWASP categories: unauthenticated webhooks, command injection nodes, credential leaks, eval/code-execution patterns, HTTP nodes, missing error handling, and more.

Same engine as FlowSentry (open source, Apache-2.0).

Use cases

• Procurement check: scan third-party n8n workflow templates before importing them.
• CI gate: fail a pipeline when a workflow export has critical findings.
• Inventory audit: scan your whole workflow export folder at once.

Input

Field	Type	Description
workflows	array	n8n workflow export objects (n8n → Download → JSON). Each item = one workflow.
workflowsUrl	string	Optional public URL to JSON: one workflow, an array, or {"workflows": [...]}.
failOnSeverity	enum	critical/high/medium/low/info/never. Run exits 1 if findings at/above this severity exist. Default high.
includeRemediation	boolean	Include fix recommendations per finding. Default true.

You can mix workflows and workflowsUrl.

Output

• Dataset: one item per workflow — { workflow, findings_total, summary, verdict, findings[] }. Each finding: rule_id, severity, title, node_name, node_type, message, remediation, owasp.
• Key-value store key summary: global totals + engine metadata.

Example input

{
  "workflows": [
    {
      "name": "my-automation",
      "nodes": [
        { "name": "Webhook", "type": "n8n-nodes-base.webhook",
          "parameters": { "authentication": "none", "path": "hooks/in" } }
      ],
      "connections": {}
    }
  ],
  "failOnSeverity": "high"
}

Example output (dataset item)

{
  "workflow": "my-automation",
  "findings_total": 3,
  "summary": { "critical": 2, "high": 0, "medium": 1, "low": 0, "info": 0 },
  "verdict": "critical",
  "findings": [
    { "rule_id": "FS001", "severity": "critical",
      "title": "Webhook endpoint without authentication",
      "node_name": "Webhook", "node_type": "n8n-nodes-base.webhook",
      "message": "...", "remediation": "...", "owasp": "..." }
  ]
}

Pricing

Pay-per-event: you pay per scanned workflow (see pricing on this page). Platform usage included.

Also available

• Free in-browser scan: https://flowsentry.vercel.app (no signup)
• Agent-native paid API (x402): POST https://flowsentry-agentpay.vercel.app/v1/scan — $0.50/scan in USDC on Base, no API keys, discoverable on agentic.market
• CLI: pip install flowsentry
• Source: https://github.com/vasilicasijarvis/flowsentry