Skip to content
ThinkWork ThinkWork

n8n

n8n is a ThinkWork-managed workflow automation runtime. Operators install it from Settings -> Plugins, deploy the self-hosted runtime through the normal managed-application flow, and expose selected workflows to agents through the native n8n MCP server.

Surface: Settings -> Plugins -> n8n
Installed app: /apps/n8n/workflows
Primary files: plugins/n8n, packages/api/src/graphql/resolvers/plugins/n8n-settings.ts

What ThinkWork Owns

Section titled “What ThinkWork Owns”

The n8n plugin owns the managed runtime wrapper, Terraform module, app adapter, operator settings, package image contract, smoke scripts, and the installed n8n-workflow-operator skill.

Operators configure:

  • runtime image, database, queue/cache, storage, TLS, and public URL inputs;
  • the shared native n8n operator account secret;
  • the native n8n MCP service credential used by ThinkWork agents;
  • the separate inbound agent-step bridge credential used by n8n workflows;
  • pinned public npm packages for Code nodes.

Saving custom package settings creates a reviewable managed-app UPGRADE plan. It does not mutate infrastructure directly from the browser.

Installed n8n App

Section titled “Installed n8n App”

The installed n8n app lives in ThinkWork at /apps/n8n/workflows. It is a read-only operator surface for day-to-day workflow and execution inspection.

The app shows:

  • workflow name/id, triggers, readiness, ThinkWork binding state, and native n8n workflow links;
  • recent execution id, workflow association, status, mode, timing, failure summary, and native n8n execution links;
  • redacted ThinkWork bridge links when an n8n execution called ThinkWork through the agent-step bridge.

The app does not collect an n8n API key in the browser and does not call n8n directly. It uses the signed-in ThinkWork session and the server-mediated n8nAppData query, which reuses the tenant n8n-api credential.

Use Settings -> Plugins -> n8n for install, package/runtime settings, and operator updates. Refresh catalog on that page before installing updates if the shown latest version is stale. Use native n8n for production activation, publish, retry, stop, delete, credential, and shared-operator account tasks.

MCP Direction

Section titled “MCP Direction”

Native n8n MCP lets ThinkWork agents inspect and draft-safe edit n8n workflows. It uses a tenant service credential resolved server-side from the managed-app desired config.

Operators must still enable MCP inside n8n and enable MCP access on each workflow, project, or folder that agents may inspect. Production publish, unpublish, activation, deactivation, credential rotation, and shared-operator recovery remain native n8n UI tasks in v1.

Agent-Step Bridge Direction

Section titled “Agent-Step Bridge Direction”

The agent-step bridge is the opposite direction: n8n calls ThinkWork as a durable agent step inside a deterministic workflow.

Use the bridge when a workflow needs ThinkWork to enrich, classify, draft, recommend, or review something before the n8n execution continues. n8n owns the workflow graph. ThinkWork owns the visible Space thread, agent dispatch, human review, timeout, telemetry, and final structured result.

V1 uses stock n8n nodes:

  • an HTTP Request node starts the bridge;
  • a Wait node hibernates the n8n execution;
  • downstream nodes branch on the structured resume payload.

Do not build or require a custom ThinkWork n8n node for v1 workflows, and do not ask n8n to scrape a ThinkWork thread page for the result. The resume payload is the contract.

Live Example Target

Section titled “Live Example Target”

Use https://n8n.thinkwork.ai for deployed example work and smoke evidence. The MCP endpoint is:

https://n8n.thinkwork.ai/mcp-server/http

The MCP bearer token is a runtime secret. Keep it in local environment, Secrets Manager, or CI secrets; never commit it to workflow JSON, docs, or evidence files.

In some local environments, normal system DNS resolution for n8n.thinkwork.ai can fail even when direct DNS lookup returns the load balancer. For temporary local testing only, resolve the host first and use a tool-level host override such as curl’s --resolve. Do not bake an IP address into scripts or docs.

Verification

Section titled “Verification”

Use dry-run checks in CI:

Terminal window
node plugins/n8n/scripts/sync-thinkwork-app.mjs
node plugins/n8n/smoke/n8n-integrated-app-smoke.mjs

After installing and deploying n8n through ThinkWork, run the live integrated app smoke with explicit operator credentials:

Terminal window
SMOKE_ENABLE_N8N_INTEGRATED_APP=1 \
SMOKE_THINKWORK_URL=<thinkwork-url> \
SMOKE_N8N_INSTALL_ID=<plugin-install-id> \
SMOKE_COGNITO_ID_TOKEN=<operator-id-token> \
SMOKE_EVIDENCE_FILE=deploy-artifacts/n8n-integrated-app-smoke.json \
node plugins/n8n/smoke/n8n-integrated-app-smoke.mjs

The full installed-app verification runbook is docs/runbooks/n8n-thinkwork-native-app-install.md.

Section titled “Related”