n8n

Why it's ranked here

It ranks high because the codebase backs up the pitch: a queue-based scaling mode for horizontal workers, a content security policy layer, and a guard against server-side request forgery are all wired into the server, not just claimed in marketing copy. The catalogue calls it open source, but the code ships under the Sustainable Use License plus a separate Enterprise License, a source-available model with usage restrictions rather than a permissive one. That gap between marketing and license terms is worth knowing before adopting it at scale.

What's good

Operational maturity shows in the details: a queue-based execution mode for scaling workers, auto-generated database schema documentation that CI checks against the actual migrations, and a content security policy layer applied per request. It ships both an MCP client and an MCP server configuration, so it can call other agent tools or expose its own workflows as tools to a calling agent. A separate, dependency-free CLI client offers JSON and table output for scripting, distinct from the main server.

Tradeoffs

The Sustainable Use License blocks reselling n8n as a competing hosted service, so teams building a product on top of it need the separate Enterprise License and a support contract. A source comment says the content security policy that applies to most pages is deliberately skipped for webhook and form pages a workflow author creates, and that an environment variable exists to turn that page's sandbox off entirely, which is a real risk if left on for exposed forms. Running it needs a recent Node.js release and pnpm, not a plain npm install.

How to use it well

It fits teams that want a self-hosted automation layer they can inspect and extend, especially ones building agent workflows that need a human checkpoint before a risky action runs. Start with the one-line Docker installer to try it, then move to the queue-based scaling mode before pointing it at real production load. Use the separate lightweight command-line client, not the main server, for scripting and CI pipelines. Skip it if you need a permissive license to embed inside a commercial product you resell.

Observed

License

Distributed under the Sustainable Use License plus a separate Enterprise License: a source-available (fair-code) model, not a standard OSI open-source license.

Language

Primary language is TypeScript, organized as a pnpm-workspace monorepo built with Turbo.

Packaging

Ships primarily as a Docker image; the root package manifest blocks a plain npm install via a preinstall script, requiring pnpm.

Architecture

Backend is Express with a dependency-injection container and a controller-service pattern; frontend is Vue 3 with Pinia and a node-graph canvas library.

Interfaces

Interfaces include a REST public API, a websocket push channel, and both an MCP client and an MCP server configuration for agent-tool interop.

Persistence

Persistence uses TypeORM with the schema managed entirely by migrations (entity synchronize disabled), supporting both SQLite and PostgreSQL.

Secondary CLI

Ships a second, dependency-free command-line client separate from the main server, built on native fetch with JSON, table, and ID-only output formats.