AI-written code logged sensitive MCP tool-call arguments on authenticated HTTP requests, exposing secrets to anyone with log access.

       properties: {@@ -73,7 +73,7 @@ export const n8nDocumentationToolsFinal: ToolDefinition[] = [   },   {     name: 'search_nodes',-    description: `Search nodes by keywords. Modes: OR (any word), AND (all words), FUZZY (typos OK). Primary nodes ranked first. Examples: "webhook"→Webhook, "http call"→HTTP Request.`,+    description: `Search n8n nodes by keyword. Pass query as string. Example: query="webhook" or query="database". Returns max 20 results.`,     inputSchema: {       type: 'object',       properties: {@@ -128,7 +128,7 @@ export const n8nDocumentationToolsFinal: ToolDefinition[] = [   },   {     name: 'get_node_essentials',-    description: `Get 10-20 key properties only (<5KB vs 100KB+). USE THIS FIRST! Includes examples. Format: "nodes-base.httpRequest"`,+    description: `Get node essential info. Pass nodeType as string with prefix. Example: nodeType="nodes-base.slack"`,     inputSchema: {       type: 'object',       properties: {@@ -192,44 +192,103 @@ export const n8nDocumentationToolsFinal: ToolDefinition[] = [   },   {     name: 'validate_node_operation',-    description: `Validate node config. Checks required fields, types, operation rules. Returns errors with fixes. Essential for Slack/Sheets/DB nodes.`,+    description: `Validate n8n node configuration. Pass nodeType as string and config as object. Example: nodeType="nodes-base.slack", config={resource:"channel",operation:"create"}`,     inputSchema: {       type: 'object',       properties: {         nodeType: {           type: 'string',-          description: 'The node type to validate (e.g., "nodes-base.slack")',+          description: 'Node type as string. Example: "nodes-base.slack"',         },         config: {           type: 'object',-          description: 'Your node configuration. Must include operation fields (resource/operation/action) if the node has multiple operations.',+          description: 'Configuration as object. For simple nodes use {}. For complex nodes include fields like {resource:"channel",operation:"create"}',         },         profile: {           type: 'string',           enum: ['strict', 'runtime', 'ai-friendly', 'minimal'],-          description: 'Validation profile: minimal (only required fields), runtime (critical errors only), ai-friendly (balanced - default), strict (all checks including best practices)',+          description: 'Profile string: "minimal", "runtime", "ai-friendly", or "strict". Default is "ai-friendly"',           default: 'ai-friendly',         },       },       required: ['nodeType', 'config'],+      additionalProperties: false,+    },+    outputSchema: {+      type: 'object',+      properties: {+        nodeType: { type: 'string' },+        workflowNodeType: { type: 'string' },+        displayName: { type: 'string' },+        valid: { type: 'boolean' },+        errors: {+          type: 'array',+          items: {+            type: 'object',+            properties: {+              type: { type: 'string' },+              property: { type: 'string' },+              message: { type: 'string' },+              fix: { type: 'string' }+            }+          }+        },+        warnings: {+          type: 'array',+          items: {+            type: 'object',+            properties: {+              type: { type: 'string' },+              property: { type: 'string' },+              message: { type: 'string' },+              suggestion: { type: 'string' }+            }+          }+        },+        suggestions: { type: 'array', items: { type: 'string' } },+        summary: {

+ * Key principles:+ * 1. Use exact JSON examples in descriptions+ * 2. Be explicit about data types+ * 3. Keep descriptions short and directive+ * 4. Avoid ambiguity+ */++export const n8nFriendlyDescriptions: Record<string, {+  description: string;+  params: Record<string, string>;+}> = {+  // Validation tools - most prone to errors+  validate_node_operation: {+    description: 'Validate n8n node. ALWAYS pass two parameters: nodeType (string) and config (object). Example call: {"nodeType": "nodes-base.slack", "config": {"resource": "channel", "operation": "create"}}',+    params: {+      nodeType: 'String value like "nodes-base.slack"',+      config: 'Object value like {"resource": "channel", "operation": "create"} or empty object {}',+      profile: 'Optional string: "minimal" or "runtime" or "ai-friendly" or "strict"'+    }+  },+  +  validate_node_minimal: {+    description: 'Check required fields. MUST pass: nodeType (string) and config (object). Example: {"nodeType": "nodes-base.webhook", "config": {}}',+    params: {+      nodeType: 'String like "nodes-base.webhook"',+      config: 'Object, use {} for empty'+    }+  },+  +  // Search and info tools+  search_nodes: {+    description: 'Search nodes. Pass query (string). Example: {"query": "webhook"}',+    params: {+      query: 'String keyword like "webhook" or "database"',+      limit: 'Optional number, default 20'+    }+  },+  +  get_node_info: {+    description: 'Get node details. Pass nodeType (string). Example: {"nodeType": "nodes-base.httpRequest"}',+    params: {+      nodeType: 'String with prefix like "nodes-base.httpRequest"'+    }+  },+  +  get_node_essentials: {+    description: 'Get node basics. Pass nodeType (string). Example: {"nodeType": "nodes-base.slack"}',+    params: {+      nodeType: 'String with prefix like "nodes-base.slack"'+    }+  },+  +  // Task tools+  get_node_for_task: {+    description: 'Find node for task. Pass task (string). Example: {"task": "send_http_request"}',+    params: {+      task: 'String task name like "send_http_request"'+    }+  },+  +  list_tasks: {+    description: 'List tasks by category. Pass category (string). Example: {"category": "HTTP/API"}',+    params: {+      category: 'String: "HTTP/API" or "Webhooks" or "Database" or "AI/LangChain" or "Data Processing" or "Communication"'+    }+  },+  +  // Workflow validation+  validate_workflow: {+    description: 'Validate workflow. Pass workflow object. MUST have: {"workflow": {"nodes": [array of node objects], "connections": {object with node connections}}}. Each node needs: name, type, typeVersion, position.',+    params: {+      workflow: 'Object with two required fields: nodes (array) and connections (object). Example: {"nodes": [{"name": "Webhook", "type": "n8n-nodes-base.webhook", "typeVersion": 2, "position": [250, 300], "parameters": {}}], "connections": {}}',+      options: 'Optional object. Example: {"validateNodes": true, "profile": "runtime"}'+    }+  },+  +  validate_workflow_connections: {+    description: 'Validate workflow connections only. Pass workflow object. Example: {"workflow": {"nodes": [...], "connections": {}}}',+    params: {+      workflow: 'Object with nodes array and connections object. Minimal example: {"nodes": [{"name": "Webhook"}], "connections": {}}'+    }+  },+  +  validate_workflow_expressions: {+    description: 'Validate n8n expressions in workflow. Pass workflow object. Example: {"workflow": {"nodes": [...], "connections": {}}}',

+import { makeToolsN8nFriendly } from './tools-n8n-friendly';+import { getWorkflowExampleString } from './workflow-examples'; import { logger } from '../utils/logger'; import { NodeRepository } from '../database/node-repository'; import { DatabaseAdapter, createDatabaseAdapter } from '../database/database-adapter';@@ -26,6 +28,11 @@ import { handleUpdatePartialWorkflow } from './handlers-workflow-diff'; import { getToolDocumentation, getToolsOverview } from './tools-documentation'; import { PROJECT_VERSION } from '../utils/version'; import { normalizeNodeType, getNodeTypeAlternatives, getWorkflowNodeType } from '../utils/node-utils';

   node_type: string;@@ -52,6 +59,7 @@ export class N8NDocumentationMCPServer {   private templateService: TemplateService | null = null;   private initialized: Promise<void>;   private cache = new SimpleCache();+  private clientInfo: any = null;    constructor() {     // Check for test environment first@@ -154,9 +162,39 @@ export class N8NDocumentationMCPServer {

+      +      logger.info('MCP Initialize request received', {+        clientVersion,+        clientCapabilities,+        clientInfo+      });+      +      // Store client info for later use+      this.clientInfo = clientInfo;+      +      // Negotiate protocol version based on client information+      const negotiationResult = negotiateProtocolVersion(+        clientVersion,+        clientInfo,+        undefined, // no user agent in MCP protocol

+        logger.warn(`Protocol version negotiated: client requested ${clientVersion}, server will use ${negotiationResult.version}`, {+          reasoning: negotiationResult.reasoning+        });+      }+             const response = {-        protocolVersion: '2024-11-05',+        protocolVersion: negotiationResult.version,         capabilities: {           tools: {},         },@@ -166,18 +204,14 @@ export class N8NDocumentationMCPServer {         },       };       -      // Debug logging-      if (process.env.DEBUG_MCP === 'true') {-        logger.debug('Initialize handler called', { response });-      }-      +      logger.info('MCP Initialize response', { response });       return response;     });      // Handle tool listing-    this.server.setRequestHandler(ListToolsRequestSchema, async () => {+    this.server.setRequestHandler(ListToolsRequestSchema, async (request) => {       // Combine documentation tools with management tools if API is configured-      const tools = [...n8nDocumentationToolsFinal];+      let tools = [...n8nDocumentationToolsFinal];

@@ -686,16 +687,12 @@ export class N8NDocumentationMCPServer {     this.server.setRequestHandler(CallToolRequestSchema, async (request) => {       const { name, arguments: args } = request.params;

-        argumentsType: typeof args,-        argumentsKeys: args ? Object.keys(args) : [],-        hasNodeType: args && 'nodeType' in args,

        // Check if tool is disabled via DISABLED_TOOLS environment variable@@ -738,19 +735,21 @@ export class N8NDocumentationMCPServer {

               // Validate the extracted arguments match expected tool schema               if (this.validateExtractedArgs(name, parsed)) {                 // Use the extracted data as args                 processedArgs = parsed;               } else {

@@ -776,7 +775,8 @@ export class N8NDocumentationMCPServer {       }

@@ -1152,8 +1152,8 @@ export class N8NDocumentationMCPServer {       if (!(requiredField in args)) {         logger.debug(`Extracted args missing required field: ${requiredField}`, {

       }@@ -1172,11 +1172,11 @@ export class N8NDocumentationMCPServer {

             actualType,-            fieldValue           });           return false;         }

++/**+ * Reduce MCP tool-call arguments to a safe metadata summary. Returns the type,

+  if (typeof args !== 'object' || Array.isArray(args)) {+    let size: number | undefined;+    if (typeof args === 'string') size = args.length;+    return {+      argsType: Array.isArray(args) ? 'array' : typeof args,+      ...(size !== undefined ? { size } : {}),+    };+  }+  const keys = Object.keys(args as Record<string, unknown>);+  let size: number | undefined;+  try {+    size = JSON.stringify(args).length;+  } catch {+    size = undefined;+  }+  return {+    argsType: 'object',+    argsKeys: keys,+    hasNestedOutput: keys.includes('output'),+    ...(size !== undefined ? { size } : {}),+  };+}