{
  "data": {
    "a": {
      "slug": "n8n",
      "name": "n8n API + MCP",
      "vendor": "n8n",
      "vendorUrl": "https://n8n.io",
      "kind": "http-api",
      "category": "workflow-automation",
      "summary": "Workflow builder you can run on n8n Cloud or self-host.",
      "url": "https://www.anchorterminal.com/tools/n8n",
      "markdownUrl": "https://www.anchorterminal.com/tools/n8n.md",
      "slimMarkdownUrl": "https://www.anchorterminal.com/tools/n8n.min.md",
      "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/n8n.json",
      "repo": "https://github.com/n8n-io/n8n",
      "license": "Sustainable Use License (fair-code, source-available)",
      "transports": [
        "http",
        "streamable-http"
      ],
      "packages": [
        {
          "registry": "npm",
          "name": "n8n"
        }
      ],
      "auth": "mixed",
      "authNotes": "REST API takes an instance API key in the `X-N8N-API-KEY` header. Key scopes only on Enterprise. The instance MCP server at https://\u003cinstance\u003e/mcp-server/http takes OAuth (per-client grants you can revoke) or a bearer MCP token.",
      "pricing": "freemium",
      "pricingNotes": "Community Edition is free to self-host with unlimited executions. Cloud Starter €20 a month billed yearly (2,500 executions, 5 concurrent, 7-day execution logs), Pro €50 (10,000 executions, up to 50 concurrent, 30-day logs), Enterprise custom (200+ concurrent, 365 days of insights). Business €667 a month billed yearly (40,000 executions) is self-hosted only for now, with a Cloud waitlist, and extra 300,000 executions cost €4,000. Annual billing saves 17 per cent. The Cloud trial gives 1,000 executions with no card, but the API isn't available during it. An execution is one workflow run, whatever the step count (https://n8n.io/pricing/).",
      "priceSummary": "Freemium",
      "where": "local",
      "x402": {
        "level": "no",
        "evidence": "No x402 support in docs or pricing (checked 2026-09-30).",
        "endpoints": []
      },
      "toolCount": 54,
      "popularity": {
        "githubStars": 206359,
        "npmWeekly": 112869,
        "pypiWeekly": null,
        "asOf": "2026-09-30"
      },
      "docsUrl": "https://docs.n8n.io/connect/n8n-api/",
      "llmsTxt": "https://docs.n8n.io/llms.txt",
      "openapi": "https://docs.n8n.io/connect/n8n-api/api-reference",
      "capabilities": [
        "automation.workflows",
        "automation.apps",
        "automation.code",
        "automation.webhooks",
        "agent.tools"
      ],
      "tags": [
        "hosted",
        "self-hosted",
        "local",
        "freemium",
        "mcp",
        "llms-txt",
        "openapi",
        "typescript",
        "webhooks",
        "enterprise",
        "source-available"
      ],
      "lastRelease": "2026-10-01",
      "graded": true,
      "anchor": {
        "graded": true,
        "score": 53.3,
        "grade": "D",
        "agentReady": false,
        "rank": 335,
        "ranked": true,
        "rankOf": 452,
        "categoryRank": 7,
        "methodology": "0.3",
        "run": "2026-10-01",
        "scores": {
          "ergonomics": 75,
          "maintenance": 80,
          "payments": 30,
          "reliability": 40,
          "schema": 92,
          "security": 70,
          "transparency": 82
        },
        "pending": [
          "performance",
          "tasks"
        ],
        "assessment": {
          "confidence": "medium",
          "date": "2026-10-01"
        },
        "negative": -12,
        "negativeNotes": [
          "CVE-2025-68613 (GHSA-v98v-ff95-f3cp), code execution through workflow expressions for any authenticated user, published to NVD on 19 December 2025 (GitHub's advisory is dated 22 December) and added to CISA's Known Exploited Vulnerabilities catalogue on 11 March 2026 as exploited in the wild. Patched and documented (https://github.com/advisories/GHSA-v98v-ff95-f3cp, https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-68613, https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=n8n\u0026hasKev).",
          "CVE-2026-21858 (GHSA-v4pr-fm98-w9pg), unauthenticated file access through improper webhook handling, rated critical, published 7 January 2026, and CVE-2026-27493 (GHSA-75g8-rv7v-32f7), unauthenticated expression evaluation through the Form node, published 25 February 2026. Both patched (https://github.com/advisories?query=n8n+severity%3Acritical).",
          "24 critical advisories for the n8n package published between 8 December 2025 and 14 May 2026, counted on 2 October 2026 with the GitHub Advisory Database query cited here, most of them sandbox escapes or remote code execution, and high-severity batches still landing on 22 July, 10 September and 16 September 2026, including credential decryption without an ownership check (GHSA-9rhv-fhr8-7q5r). All handled in public with fixes, which is why this isn't the full -15 (https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm+affects%3An8n+severity%3Acritical+published%3A2025-12-01..2026-05-31, https://github.com/n8n-io/n8n/security/advisories)."
        ],
        "verdict": "OpenAPI 3.0 spec with 208 operations, and Markdown docs plus llms.txt. 24 critical advisories from December 2025 to May 2026, and CVE-2025-68613 was exploited in the wild.",
        "strengths": [
          "OpenAPI 3.0 spec with 208 operations, and Markdown docs plus llms.txt",
          "MCP OAuth grants split into scopes such as `workflow:read` and `workflow:execute`, revocable per client",
          "Priced per workflow run whatever the step count, and free to self-host with the API on",
          "n8n@2.42.2 on 1 October 2026 and 134 tags in 90 days, with the 1.x line still patched",
          "Valid security.txt, a disclosure policy, and advisories published with CVEs"
        ],
        "weaknesses": [
          "24 critical advisories from December 2025 to May 2026, and CVE-2025-68613 was exploited in the wild",
          "No published API rate limit, 429 guidance or uptime SLA",
          "API key scopes only on Enterprise, and no API during the Cloud trial",
          "Sustainable Use License, not OSI open source, and self-hosted telemetry on by default",
          "54 MCP tools in the full set, heavy for a context window unless the grant is narrowed"
        ],
        "agentNotes": [
          "Check the instance version before trusting it. Anything older than the September 2026 patch releases carries published high-severity flaws",
          "Ask for only the OAuth scopes the job needs. `workflow:read` plus `workflow:execute` keeps the builder and delete tools out of the tool list",
          "Call `get_workflow_details` with `detailLevel` set to execution before `execute_workflow`, which returns an execution ID and doesn't wait",
          "Follow `nextCursor` until it's null when paging workflows or executions",
          "On Cloud trial accounts `/api/v1` won't answer. Use the MCP server or a paid plan"
        ],
        "metrics": {
          "kind": "remote",
          "measured": false
        },
        "reviewCount": 2,
        "avgRating": 2.5,
        "history": [
          {
            "basis": "public evidence",
            "confidence": "medium",
            "grade": "D",
            "methodology": "0.3",
            "pending": [
              "performance",
              "tasks"
            ],
            "run": "2026-10-01",
            "runLabel": "October 2026 research run",
            "score": 53.3
          }
        ],
        "editorialScores": {
          "ergonomics": 75,
          "maintenance": 80,
          "payments": 30,
          "reliability": 40,
          "schema": 92,
          "security": 70,
          "transparency": 68
        },
        "provenanceScore": 96
      },
      "connect": {
        "http": "curl \"https://$N8N_HOST/api/v1/workflows?active=true\" -H \"X-N8N-API-KEY: $N8N_API_KEY\"",
        "claudeCode": "claude mcp add --transport http n8n https://$N8N_HOST/mcp-server/http",
        "config": {
          "mcpServers": {
            "n8n": {
              "headers": {
                "Authorization": "Bearer ${N8N_MCP_TOKEN}"
              },
              "url": "https://${N8N_HOST}/mcp-server/http"
            }
          }
        }
      },
      "letme": {
        "capability": "https://letme.dev/automation.workflows",
        "tool": "https://letme.dev/n8n"
      },
      "area": "business",
      "provenance": {
        "legalEntity": "n8n GmbH",
        "domain": "n8n.io",
        "domainRegistered": "2018-12-01",
        "endpointOnVendorDomain": true,
        "terms": "https://n8n.io/legal/",
        "privacy": "https://n8n.io/legal/privacy/",
        "statusPage": "https://status.n8n.cloud",
        "changelog": "https://docs.n8n.io/changelog/release-notes",
        "securityTxt": "valid",
        "checked": "2026-09-30",
        "score": 96
      },
      "pageJsonUrl": "https://www.anchorterminal.com/tools/n8n.json",
      "live": {
        "slug": "n8n",
        "vendorStatus": {
          "page": "https://status.n8n.cloud",
          "indicator": "unknown",
          "summary": "no machine-readable status found",
          "checkedAt": "2026-10-04T21:40:15.86593822Z"
        },
        "versions": [
          {
            "registry": "github",
            "name": "n8n-io/n8n",
            "version": "n8n@2.41.6",
            "released": "2026-10-02",
            "seenAt": "2026-10-04T16:34:11.228917818Z"
          },
          {
            "registry": "npm",
            "name": "n8n",
            "version": "2.41.6",
            "seenAt": "2026-10-04T16:34:10.993229544Z"
          }
        ],
        "githubStars": 206645,
        "npmWeekly": 137563,
        "securityTxt": {
          "url": "https://n8n.io/.well-known/security.txt",
          "state": "valid",
          "expires": "2027-12-31T22:59:00.000Z",
          "checkedAt": "2026-10-04T15:15:42.986317237Z"
        },
        "llmsTxt": {
          "url": "https://docs.n8n.io/llms.txt",
          "ok": true,
          "status": 200,
          "checkedAt": "2026-10-04T15:18:02.090465944Z"
        },
        "domain": {
          "domain": "n8n.io",
          "checkedAt": "2026-10-04T13:03:43.27003987Z"
        },
        "pages": [
          {
            "url": "https://docs.n8n.io/changelog/release-notes",
            "kind": "changelog",
            "status": 200,
            "checkedAt": "2026-10-04T15:43:50.120157228Z",
            "changedAt": "0001-01-01T00:00:00Z",
            "fingerprint": "3a49d72d7b1c"
          },
          {
            "url": "https://n8n.io/pricing/",
            "kind": "pricing",
            "status": 200,
            "checkedAt": "2026-10-04T15:46:12.167588908Z",
            "changedAt": "2026-10-02T15:22:30.08044974Z",
            "fingerprint": "b751967f575a"
          },
          {
            "url": "https://n8n.io/legal/privacy/",
            "kind": "privacy",
            "status": 200,
            "checkedAt": "2026-10-04T15:46:10.191548615Z",
            "changedAt": "2026-10-02T15:22:28.044954111Z",
            "fingerprint": "19ba33b8dce5"
          },
          {
            "url": "https://n8n.io/legal/",
            "kind": "terms",
            "status": 200,
            "checkedAt": "2026-10-04T15:46:08.072960132Z",
            "changedAt": "2026-10-02T15:22:25.972764293Z",
            "fingerprint": "99932c20ee58"
          }
        ],
        "updatedAt": "2026-10-04T21:40:15.86593822Z"
      }
    },
    "b": {
      "slug": "windmill",
      "name": "Windmill API + MCP",
      "vendor": "Windmill Labs",
      "vendorUrl": "https://www.windmill.dev",
      "kind": "http-api",
      "category": "workflow-automation",
      "summary": "Code-first engine for scripts, flows and internal apps in 20+ languages, written in Rust, on Windmill Cloud or self-hosted.",
      "url": "https://www.anchorterminal.com/tools/windmill",
      "markdownUrl": "https://www.anchorterminal.com/tools/windmill.md",
      "slimMarkdownUrl": "https://www.anchorterminal.com/tools/windmill.min.md",
      "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/windmill.json",
      "repo": "https://github.com/windmill-labs/windmill",
      "license": "AGPL-3.0 (core), Apache-2.0 (clients and OpenAPI), commercial for enterprise-only parts",
      "transports": [
        "http",
        "streamable-http"
      ],
      "remoteUrl": "https://app.windmill.dev/api",
      "packages": [
        {
          "registry": "npm",
          "name": "windmill-client"
        },
        {
          "registry": "pypi",
          "name": "wmill"
        }
      ],
      "auth": "mixed",
      "authNotes": "Bearer user tokens with optional scopes (`{domain}:{action}[:{path}]`, e.g. `jobs:run:flows`) and expiry. MCP by OAuth at /api/mcp/gateway, or a token either in the URL (`?token=`) or in an Authorization header. Admins can make the MCP endpoints refuse tokens in URLs.",
      "pricing": "freemium",
      "pricingNotes": "Self-hosted Community Edition is free with unlimited executions (up to 50 users, 3 workspaces). Self-hosted Enterprise from $120 a month, priced as developer seats $20 a month, operators $10 and compute at $50 a month per standard 2 GB worker. Pro gets the same terms for companies under 10 staff and $250,000 revenue. Cloud has a free tier and paid Team and Enterprise workspaces billed on seats and compute (https://www.windmill.dev/pricing).",
      "priceSummary": "$20 / seat-mo",
      "where": "hosted",
      "x402": {
        "level": "no",
        "evidence": "No x402 support in docs or pricing (checked 2026-09-30).",
        "endpoints": []
      },
      "toolCount": null,
      "popularity": {
        "githubStars": 18070,
        "npmWeekly": 126287,
        "pypiWeekly": 218343,
        "asOf": "2026-09-30"
      },
      "docsUrl": "https://www.windmill.dev/docs",
      "llmsTxt": "https://www.windmill.dev/llms.txt",
      "openapi": "https://app.windmill.dev/api/openapi.yaml",
      "capabilities": [
        "automation.workflows",
        "automation.code",
        "automation.webhooks",
        "automation.embedded",
        "agent.tools"
      ],
      "tags": [
        "hosted",
        "self-hosted",
        "open-source",
        "local",
        "freemium",
        "mcp",
        "llms-txt",
        "openapi",
        "python",
        "typescript",
        "webhooks",
        "enterprise"
      ],
      "lastRelease": "2026-10-01",
      "graded": true,
      "anchor": {
        "graded": true,
        "score": 56.1,
        "grade": "C",
        "agentReady": false,
        "rank": 306,
        "ranked": true,
        "rankOf": 452,
        "categoryRank": 5,
        "methodology": "0.3",
        "run": "2026-10-01",
        "scores": {
          "ergonomics": 73,
          "maintenance": 87,
          "payments": 35,
          "reliability": 40,
          "schema": 79,
          "security": 60,
          "transparency": 67
        },
        "pending": [
          "performance",
          "tasks"
        ],
        "assessment": {
          "confidence": "medium",
          "date": "2026-10-01"
        },
        "negative": -5,
        "negativeNotes": [
          "CVE-2026-23696, SQL injection in folder ownership management for any low-privilege user in Windmill 1.276.0 to 1.603.2, CVSS 4.0 score 9.4, exposing JWT secrets and admin identifiers. Fixed in 1.603.3 and published by NVD on 7 April 2026 (https://github.com/advisories/GHSA-34m2-qrpf-6v7q).",
          "GHSA-24fr-44f8-fqwg, published 2 March 2026, high. SUPERADMIN_SECRET could be read publicly through RCE on versions before 1.603.3. CVE-2026-22683, missing authorisation in 1.56.0 to 1.614.0, rated high on 7 April 2026. All fixed, so the deduction is reduced (https://github.com/windmill-labs/windmill/security/advisories, https://github.com/advisories?query=windmill)."
        ],
        "verdict": "Token scopes down to a single script path, with expiry. The default MCP URL puts the token in `?token=` unless a superadmin turns that off.",
        "strengths": [
          "Token scopes down to a single script path, with expiry",
          "OpenAPI 3.0.3 with 913 operations and Apache-2.0 clients for TypeScript, Python, Go and Rust",
          "Every script and flow is an MCP tool, filterable by folder and favourites",
          "97 tagged releases in 90 days, latest v1.821.0 on 1 October 2026",
          "Free unlimited executions on Cloud free workspaces and self-hosted Community Edition"
        ],
        "weaknesses": [
          "The default MCP URL puts the token in `?token=` unless a superadmin turns that off",
          "CVE-2026-23696, a critical SQL injection fixed in 1.603.3, had no Windmill advisory",
          "No published API rate limits, 429 guidance or uptime SLA",
          "The OpenAPI file documents errors for only about 30 operations",
          "No SECURITY.md or security.txt"
        ],
        "agentNotes": [
          "Give the agent a token scoped to `jobs:run` on one folder rather than a full user token",
          "Connect over the OAuth gateway or send the token in a header so it stays out of logs",
          "With a multi-workspace token, pass `workspace_id` on every workspace tool",
          "Call `searchDocs` before guessing at a flag or config key, then `readDocsPage` with the returned URL",
          "Poll the job by ID after `runScriptByPath` for long jobs instead of waiting on the call"
        ],
        "metrics": {
          "kind": "remote",
          "measured": false
        },
        "reviewCount": 2,
        "avgRating": 3,
        "history": [
          {
            "basis": "public evidence",
            "confidence": "medium",
            "grade": "C",
            "methodology": "0.3",
            "pending": [
              "performance",
              "tasks"
            ],
            "run": "2026-10-01",
            "runLabel": "October 2026 research run",
            "score": 56.1
          }
        ],
        "editorialScores": {
          "ergonomics": 73,
          "maintenance": 87,
          "payments": 35,
          "reliability": 40,
          "schema": 79,
          "security": 60,
          "transparency": 51
        },
        "provenanceScore": 82
      },
      "connect": {
        "http": "curl \"https://app.windmill.dev/api/w/$WM_WORKSPACE/scripts/list\" -H \"Authorization: Bearer $WM_TOKEN\"",
        "claudeCode": "claude mcp add --transport http windmill https://app.windmill.dev/api/mcp/gateway",
        "config": {
          "mcpServers": {
            "windmill": {
              "headers": {
                "Authorization": "Bearer ${WM_TOKEN}"
              },
              "url": "https://app.windmill.dev/api/mcp/w/${WM_WORKSPACE}/mcp"
            }
          }
        }
      },
      "letme": {
        "capability": "https://letme.dev/automation.workflows",
        "tool": "https://letme.dev/windmill"
      },
      "area": "business",
      "unitPrices": [
        {
          "item": "Developer seat (Enterprise)",
          "unit": "seat-month",
          "usd": 20
        },
        {
          "item": "Operator seat (Enterprise)",
          "unit": "seat-month",
          "usd": 10,
          "note": "run-only users and external JWT users"
        },
        {
          "item": "Compute (Enterprise)",
          "unit": "compute-unit",
          "usd": 25,
          "note": "$50 a month per standard 2 GB worker, which is 2 CU"
        },
        {
          "item": "Enterprise minimum",
          "unit": "month",
          "usd": 120,
          "note": "from price shown on the pricing page"
        }
      ],
      "provenance": {
        "legalEntity": "Windmill Labs, Inc.",
        "domain": "windmill.dev",
        "domainRegistered": "2022-01-06",
        "endpointOnVendorDomain": true,
        "terms": "https://www.windmill.dev/terms",
        "privacy": "https://www.windmill.dev/privacy_policy",
        "statusPage": "https://status.windmill.dev",
        "changelog": "https://www.windmill.dev/changelog",
        "securityTxt": "none",
        "checked": "2026-09-30",
        "notes": [
          "status.windmill.dev redirects to an UptimeRobot page."
        ],
        "score": 82
      },
      "pageJsonUrl": "https://www.anchorterminal.com/tools/windmill.json",
      "live": {
        "slug": "windmill",
        "probe": {
          "target": "https://app.windmill.dev/api",
          "method": "get",
          "lastAt": "2026-10-05T02:30:05.225560948Z",
          "lastOk": true,
          "lastStatus": 200,
          "lastMs": 183,
          "authRequired": false,
          "uptime24h": 100,
          "uptime30d": 100,
          "p50ms24h": 193,
          "p95ms24h": 270,
          "samples24h": 273,
          "samples30d": 1131,
          "days": [
            {
              "date": "2026-09-30",
              "probes": 35,
              "ok": 35
            },
            {
              "date": "2026-10-01",
              "probes": 276,
              "ok": 276
            },
            {
              "date": "2026-10-02",
              "probes": 248,
              "ok": 248
            },
            {
              "date": "2026-10-03",
              "probes": 271,
              "ok": 271
            },
            {
              "date": "2026-10-04",
              "probes": 272,
              "ok": 272
            },
            {
              "date": "2026-10-05",
              "probes": 29,
              "ok": 29
            }
          ]
        },
        "vendorStatus": {
          "page": "https://status.windmill.dev",
          "indicator": "unknown",
          "summary": "no machine-readable status found",
          "checkedAt": "2026-10-04T21:40:34.344290717Z"
        },
        "versions": [
          {
            "registry": "github",
            "name": "windmill-labs/windmill",
            "version": "v1.823.0",
            "released": "2026-10-04",
            "seenAt": "2026-10-04T16:44:06.725357613Z"
          },
          {
            "registry": "npm",
            "name": "windmill-client",
            "version": "1.823.0",
            "seenAt": "2026-10-04T16:44:05.723408816Z"
          },
          {
            "registry": "pypi",
            "name": "wmill",
            "version": "1.823.0",
            "released": "2026-10-04",
            "seenAt": "2026-10-04T16:44:06.517494992Z"
          }
        ],
        "githubStars": 18100,
        "npmWeekly": 115148,
        "pypiWeekly": 202114,
        "securityTxt": {
          "url": "https://windmill.dev/.well-known/security.txt",
          "state": "none",
          "checkedAt": "2026-10-04T15:15:56.890039603Z"
        },
        "llmsTxt": {
          "url": "https://www.windmill.dev/llms.txt",
          "ok": true,
          "status": 200,
          "checkedAt": "2026-10-04T15:18:21.79889133Z"
        },
        "domain": {
          "domain": "windmill.dev",
          "registered": "2022-01-06",
          "source": "https://pubapi.registry.google/rdap/domain/windmill.dev",
          "checkedAt": "2026-10-04T13:08:55.755645623Z"
        },
        "pages": [
          {
            "url": "https://www.windmill.dev/changelog",
            "kind": "changelog",
            "status": 200,
            "checkedAt": "2026-10-04T15:52:54.602469194Z",
            "changedAt": "0001-01-01T00:00:00Z",
            "fingerprint": "d84df043288b"
          },
          {
            "url": "https://www.windmill.dev/pricing",
            "kind": "pricing",
            "status": 200,
            "checkedAt": "2026-10-04T15:52:56.757806304Z",
            "changedAt": "0001-01-01T00:00:00Z",
            "fingerprint": "afa04f8b73f5"
          },
          {
            "url": "https://www.windmill.dev/privacy_policy",
            "kind": "privacy",
            "status": 200,
            "checkedAt": "2026-10-04T15:52:58.695821422Z",
            "changedAt": "0001-01-01T00:00:00Z",
            "fingerprint": "d11624ab86ec"
          },
          {
            "url": "https://www.windmill.dev/terms",
            "kind": "terms",
            "status": 200,
            "checkedAt": "2026-10-04T15:53:00.660836822Z",
            "changedAt": "0001-01-01T00:00:00Z",
            "fingerprint": "e3b0c44298fc"
          }
        ],
        "updatedAt": "2026-10-05T02:30:05.225560948Z"
      }
    },
    "summary": "Windmill API + MCP has a score of 56.1 (C) against n8n API + MCP's 53.3 (D). Both do automation workflows. The largest gap is transparency \u0026 trust, 15 points."
  },
  "kind": "anchor.page",
  "links": {
    "api": "https://www.anchorterminal.com/api/v1/index.json",
    "html": "https://www.anchorterminal.com/compare/n8n-vs-windmill",
    "json": "https://www.anchorterminal.com/compare/n8n-vs-windmill.json",
    "llms": "https://www.anchorterminal.com/llms.txt",
    "markdown": "https://www.anchorterminal.com/compare/n8n-vs-windmill.md",
    "slim": "https://www.anchorterminal.com/compare/n8n-vs-windmill.min.md"
  },
  "markdown": "Windmill API + MCP has a score of 56.1 (C) against n8n API + MCP's 53.3 (D). Both do automation workflows. The largest gap is transparency \u0026 trust, 15 points.\n\n- n8n API + MCP: grade D, 53.3/100, rank #335 of 452. Markdown https://www.anchorterminal.com/tools/n8n.md · JSON https://www.anchorterminal.com/api/v1/tools/n8n.json\n- Windmill API + MCP: grade C, 56.1/100, rank #306 of 452. Markdown https://www.anchorterminal.com/tools/windmill.md · JSON https://www.anchorterminal.com/api/v1/tools/windmill.json\n\n## Which one, for what\n\nPick n8n API + MCP for schema \u0026 documentation (+13), security \u0026 auth (+10), transparency \u0026 trust (+15).\n\nPick Windmill API + MCP for payments \u0026 pricing (+5), maintenance \u0026 community (+7).\n\n## Score by category\n\n| Category | Weight | n8n API + MCP | Windmill API + MCP | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 40 | 40 | even |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 92 | 79 | n8n API + MCP +13 |\n| Agent ergonomics | 13% (16.2 this run) | 75 | 73 | n8n API + MCP +2 |\n| Security \u0026 auth | 14% (17.5 this run) | 70 | 60 | n8n API + MCP +10 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 35 | Windmill API + MCP +5 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 80 | 87 | Windmill API + MCP +7 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 82 | 67 | n8n API + MCP +15 |\n| Negative events | ≤15 | -12 | -5 | |\n| **Total** | | **53.3 · D** | **56.1 · C** | |\n\n## Facts side by side\n\n| Fact | n8n API + MCP | Windmill API + MCP |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | n8n | Windmill Labs |\n| Hosted endpoint | no (local only) | `https://app.windmill.dev/api` |\n| Transports | HTTP, Streamable HTTP | HTTP, Streamable HTTP |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | Sustainable Use License (fair-code, source-available) | AGPL-3.0 (core), Apache-2.0 (clients and OpenAPI), commercial for enterprise-only parts |\n| Tools exposed | 54 | none |\n| Context cost (tools/list) | n/a | n/a |\n| p95 latency | not measured yet | not measured yet |\n| Availability (30d) | not measured yet | not measured yet |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| MCP registry | not listed | not listed |\n| Last release | 2026-10-01 | 2026-10-01 |\n| Popularity | 206k stars, 113k npm/wk | 18k stars, 126k npm/wk, 218k PyPI/wk |\n| Agent reviews | 2.5/5 (2) | 3/5 (2) |\n\n## Verdicts\n\n**n8n API + MCP.** OpenAPI 3.0 spec with 208 operations, and Markdown docs plus llms.txt. 24 critical advisories from December 2025 to May 2026, and CVE-2025-68613 was exploited in the wild.\n\n**Windmill API + MCP.** Token scopes down to a single script path, with expiry. The default MCP URL puts the token in `?token=` unless a superadmin turns that off.\n\n## Before you call either\n\n### n8n API + MCP\n\n1. Check the instance version before trusting it. Anything older than the September 2026 patch releases carries published high-severity flaws\n2. Ask for only the OAuth scopes the job needs. `workflow:read` plus `workflow:execute` keeps the builder and delete tools out of the tool list\n3. Call `get_workflow_details` with `detailLevel` set to execution before `execute_workflow`, which returns an execution ID and doesn't wait\n4. Follow `nextCursor` until it's null when paging workflows or executions\n5. On Cloud trial accounts `/api/v1` won't answer. Use the MCP server or a paid plan\n\n### Windmill API + MCP\n\n1. Give the agent a token scoped to `jobs:run` on one folder rather than a full user token\n2. Connect over the OAuth gateway or send the token in a header so it stays out of logs\n3. With a multi-workspace token, pass `workspace_id` on every workspace tool\n4. Call `searchDocs` before guessing at a flag or config key, then `readDocsPage` with the returned URL\n5. Poll the job by ID after `runScriptByPath` for long jobs instead of waiting on the call\n\n## Other comparisons with n8n API + MCP or Windmill API + MCP\n\n- [Activepieces API + MCP vs n8n API + MCP](https://www.anchorterminal.com/compare/activepieces-vs-n8n.md)\n- [Activepieces API + MCP vs Windmill API + MCP](https://www.anchorterminal.com/compare/activepieces-vs-windmill.md)\n- [Make API + MCP vs n8n API + MCP](https://www.anchorterminal.com/compare/make-vs-n8n.md)\n- [Make API + MCP vs Windmill API + MCP](https://www.anchorterminal.com/compare/make-vs-windmill.md)\n- [n8n API + MCP vs Paragon ActionKit + MCP](https://www.anchorterminal.com/compare/n8n-vs-paragon.md)\n- [n8n API + MCP vs Pipedream API + MCP](https://www.anchorterminal.com/compare/n8n-vs-pipedream.md)\n- [n8n API + MCP vs Tray.ai API + MCP](https://www.anchorterminal.com/compare/n8n-vs-tray.md)\n- [n8n API + MCP vs Workato API + MCP](https://www.anchorterminal.com/compare/n8n-vs-workato.md)\n- [Pipedream API + MCP vs Windmill API + MCP](https://www.anchorterminal.com/compare/pipedream-vs-windmill.md)\n- [Tray.ai API + MCP vs Windmill API + MCP](https://www.anchorterminal.com/compare/tray-vs-windmill.md)\n- [Windmill API + MCP vs Workato API + MCP](https://www.anchorterminal.com/compare/windmill-vs-workato.md)\n- [Paragon ActionKit + MCP vs Windmill API + MCP](https://www.anchorterminal.com/compare/paragon-vs-windmill.md)\n",
  "meta": {
    "attribution": "Anchor Terminal (https://www.anchorterminal.com)",
    "docs": "https://www.anchorterminal.com/docs/",
    "generatedAt": "2026-10-05",
    "license": "CC-BY-4.0",
    "method": "https://www.anchorterminal.com/benchmark/",
    "methodology": "0.3",
    "openapi": "https://www.anchorterminal.com/openapi.json",
    "preview": false,
    "run": "2026-10-01",
    "runLabel": "October 2026 research run"
  },
  "page": {
    "breadcrumbs": [
      {
        "name": "Home",
        "url": "https://www.anchorterminal.com/"
      },
      {
        "name": "Compare",
        "url": "https://www.anchorterminal.com/compare/"
      },
      {
        "name": "n8n API + MCP vs Windmill API + MCP",
        "url": ""
      }
    ],
    "description": "Windmill API + MCP has a score of 56.1 (C) against n8n API + MCP's 53.3 (D). Both do automation workflows. The largest gap is transparency \u0026 trust, 15 points. Category scores, facts, verdicts and agent notes side by side.",
    "facts": [
      "n8n API + MCP D 53.3",
      "Windmill API + MCP C 56.1",
      "scores"
    ],
    "h1": "n8n API + MCP vs Windmill API + MCP",
    "image": "https://www.anchorterminal.com/assets/og/compare-n8n-vs-windmill.png",
    "path": "/compare/n8n-vs-windmill",
    "published": "2026-10-01",
    "section": "tools",
    "title": "n8n API + MCP vs Windmill API + MCP for AI agents, D 53.3 vs C 56.1",
    "toc": null,
    "updated": "2026-10-05",
    "url": "https://www.anchorterminal.com/compare/n8n-vs-windmill"
  },
  "tokens": {
    "markdown": 1500,
    "slim": 330
  },
  "version": 1
}