# FlowSentry Security Scanner (`flowsentry/flowsentry-security-scanner`) Actor Security scan of n8n workflow exports and MCP configs. 18 OWASP-mapped rules: unauthenticated webhooks, command injection, credential leaks. JSON report with severity and remediation. - **URL**: https://apify.com/flowsentry/flowsentry-security-scanner.md - **Developed by:** [Mihai Sijarvis](https://apify.com/flowsentry) (community) - **Stats:** 1 total users, 0 monthly users, 0.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing Pay per usage This Actor is paid per platform usage. The Actor is free to use, and you only pay for the Apify platform usage, which gets cheaper the higher subscription plan you have. Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-usage ## What's an Apify Actor? An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md. ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run. For examples already wired to this Actor's own input schema, see the [API](#api) section below. Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`). # README ## FlowSentry — n8n Workflow & MCP Security Scanner (Apify Actor) Scan n8n workflow JSON exports for security issues **before** you import them into your automation stack. 18 rules mapped to OWASP categories: unauthenticated webhooks, command injection nodes, credential leaks, eval/code-execution patterns, HTTP nodes, missing error handling, and more. Same engine as [FlowSentry](https://flowsentry.vercel.app) (open source, Apache-2.0). ### Use cases - **Procurement check**: scan third-party n8n workflow templates before importing them. - **CI gate**: fail a pipeline when a workflow export has critical findings. - **Inventory audit**: scan your whole workflow export folder at once. ### Input | Field | Type | Description | |-------|------|-------------| | `workflows` | array | n8n workflow export objects (n8n → Download → JSON). Each item = one workflow. | | `workflowsUrl` | string | Optional public URL to JSON: one workflow, an array, or `{"workflows": [...]}`. | | `failOnSeverity` | enum | `critical`/`high`/`medium`/`low`/`info`/`never`. Run exits 1 if findings at/above this severity exist. Default `high`. | | `includeRemediation` | boolean | Include fix recommendations per finding. Default `true`. | You can mix `workflows` and `workflowsUrl`. ### Output - **Dataset**: one item per workflow — `{ workflow, findings_total, summary, verdict, findings[] }`. Each finding: `rule_id`, `severity`, `title`, `node_name`, `node_type`, `message`, `remediation`, `owasp`. - **Key-value store** key `summary`: global totals + engine metadata. ### Example input ```json { "workflows": [ { "name": "my-automation", "nodes": [ { "name": "Webhook", "type": "n8n-nodes-base.webhook", "parameters": { "authentication": "none", "path": "hooks/in" } } ], "connections": {} } ], "failOnSeverity": "high" } ``` ### Example output (dataset item) ```json { "workflow": "my-automation", "findings_total": 3, "summary": { "critical": 2, "high": 0, "medium": 1, "low": 0, "info": 0 }, "verdict": "critical", "findings": [ { "rule_id": "FS001", "severity": "critical", "title": "Webhook endpoint without authentication", "node_name": "Webhook", "node_type": "n8n-nodes-base.webhook", "message": "...", "remediation": "...", "owasp": "..." } ] } ``` ### Pricing Pay-per-event: you pay per **scanned workflow** (see pricing on this page). Platform usage included. ### Also available - **Free in-browser scan**: https://flowsentry.vercel.app (no signup) - **Agent-native paid API (x402)**: `POST https://flowsentry-agentpay.vercel.app/v1/scan` — $0.50/scan in USDC on Base, no API keys, discoverable on [agentic.market](https://agentic.market) - **CLI**: `pip install flowsentry` - **Source**: https://github.com/vasilicasijarvis/flowsentry # Actor input Schema ## `workflows` (type: `array`): Array of n8n workflow export objects (the JSON you get from n8n → Download). Each item is one workflow. Leave empty and set workflowsUrl to scan from URLs instead. ## `workflowsUrl` (type: `string`): Optional public URL to a JSON file containing a single workflow, an array of workflows, or an object with a 'workflows' key. Example: a raw GitHub gist URL. ## `failOnSeverity` (type: `string`): Optional CI gate: the run exits with code 1 if findings at or above this severity exist. Default 'never' (always succeed, just report). ## `includeRemediation` (type: `boolean`): Include fix recommendations in each finding. ## Actor input object example ```json { "workflows": [ { "name": "example-insecure-workflow", "nodes": [ { "name": "Webhook", "type": "n8n-nodes-base.webhook", "parameters": { "authentication": "none", "path": "public-hook" } }, { "name": "Run Command", "type": "n8n-nodes-base.executeCommand", "parameters": { "command": "curl http://example.com/api" } } ], "connections": {} } ], "failOnSeverity": "never", "includeRemediation": true } ``` # Actor output Schema ## `scanResults` (type: `string`): No description ## `scanSummary` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "workflows": [ { "name": "example-insecure-workflow", "nodes": [ { "name": "Webhook", "type": "n8n-nodes-base.webhook", "parameters": { "authentication": "none", "path": "public-hook" } }, { "name": "Run Command", "type": "n8n-nodes-base.executeCommand", "parameters": { "command": "curl http://example.com/api" } } ], "connections": {} } ] }; // Run the Actor and wait for it to finish const run = await client.actor("flowsentry/flowsentry-security-scanner").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "workflows": [{ "name": "example-insecure-workflow", "nodes": [ { "name": "Webhook", "type": "n8n-nodes-base.webhook", "parameters": { "authentication": "none", "path": "public-hook", }, }, { "name": "Run Command", "type": "n8n-nodes-base.executeCommand", "parameters": { "command": "curl http://example.com/api" }, }, ], "connections": {}, }] } # Run the Actor and wait for it to finish run = client.actor("flowsentry/flowsentry-security-scanner").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}") for item in client.dataset(run.default_dataset_id).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "workflows": [ { "name": "example-insecure-workflow", "nodes": [ { "name": "Webhook", "type": "n8n-nodes-base.webhook", "parameters": { "authentication": "none", "path": "public-hook" } }, { "name": "Run Command", "type": "n8n-nodes-base.executeCommand", "parameters": { "command": "curl http://example.com/api" } } ], "connections": {} } ] }' | apify call flowsentry/flowsentry-security-scanner --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "type": "http", "url": "https://mcp.apify.com/?tools=fetch-actor-details,flowsentry/flowsentry-security-scanner" } } } ``` The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer ` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations). ## OpenAPI specification Download the OpenAPI definition: https://api.apify.com/v2/actors/N5vzNRN8zX4RcMJVO/builds/NTafE0q4HIbQ1sOym/openapi.json