Keep each n8n agent to one bounded step inside a fixed workflow, and require human approval on every tool that changes data. The other controls documented by n8n are scoped tools and the Guardrails node on text going in and out. Run evaluations before any model or prompt change.
When you need this
- An agent built in n8n will send messages, change records, or call production systems.
- An agent connects to an MCP server that exposes many tools.
- A team plans to switch the model behind an agent.
Evaluation criteria
Bounded role
Is the agent one step in a fixed workflow, or the whole process?
Look forUse fixed steps for the process and the agent for one decision, such as classifying or drafting. One builder uses n8n's AI nodes daily for bounded jobs such as PDF extraction and ticket routing, and another scores news with a model and leaves posting to a person.
Tool scope
Which tools can the agent call, and with which parameters fixed?
Look forUse built-in tools with pinned parameters where you know the action. Use an MCP server only where the agent needs a range of actions, with Tools to include limited. Documentation from n8n notes that an MCP server gives the agent more room at the cost of control.
Human approval
Which tools need a person to approve each call?
Look forRequire human review on tools that send external messages, modify records, or delete data. Route approvals to Slack, Teams, email, or chat, and tell the system prompt how to handle a denial.
Input and output checks
What stops PII, secret keys, or a jailbreak from passing through?
Look forPut the Guardrails node on text going into and coming out of the model. It checks PII, secret keys, URLs, jailbreak attempts, topical alignment, and custom rules, and sends violations to a fail branch.
Evaluations
How will you know a model or prompt change made the agent worse?
Look forRun known test cases through n8n evaluations before every change. Metric-based evaluations cover one workflow on Starter and every workflow on Pro and above.
Cost and loops
What does one agent run cost, and what stops it from looping?
Look forMeasure cost per run on real traffic and watch retries. One builder's agent cost US$3 and 3 minutes per simple question, and a mis-set MCP Client transport sent 95 million failed requests over 8 days. The standalone Agents builder is marked Preview, with behavior that may change, and is on by default on all n8n plans. Admins who want agents only inside workflows switch it off in Settings.
Questions to ask vendors
- Which agent tools can change data, and does each one require approval?
- Which MCP servers are connected, and which of their tools are exposed?
- What is our evaluation set for each agent, and who runs it before a model change?
- Who is alerted when an agent's run count or cost spikes?
Red flags
- An agent with write access to a production system and no human review step.
- Every tool of an MCP server exposed to an agent by default.
- A model switched because a newer one shipped, with no evaluation run.
- Chat memory relied on to record what tools an agent actually called.
Products in this piece
Sources
- Official documentation
- 7
- Public source
- 5
- n8n docs: AI Agent node
- n8n docs: Build and manage agents
- n8n docs: MCP servers
- n8n docs: Human-in-the-loop for tools
- n8n docs: Guardrails node
- n8n docs: Test and improve AI workflows
- n8n pricing
- Muhi: How I Automated News Discovery with n8n (Dec 16, 2025)
- Hacker News comment on the cost of an n8n agent per question (Jun 18, 2025)
- GitHub issue: MCP Client transport selection ignored, causing a 95M failed request retry storm (Jan 28, 2026)
- GitHub issue: AI Agent doesn't store tool usages in memory (Apr 2, 2025)
- Reddit r/n8n: Most AI agent workflows are just glorified if-else chains (Feb 13, 2026)