Disable the unauthenticated MCP server route by default; enforce auth on every MCP route

Feature Requests
1

The idea is:

Introduce a self-hosted env flag, e.g. N8N_MCP_REQUIRE_AUTH=true, that:

  • Removes the "None" choice from the MCP Server Trigger node's Authentication dropdown when set.
  • Rejects workflow save if any MCP Server Trigger is configured with authentication: none, with a validation error naming the workflow.
  • Returns 403 Forbidden at runtime for any pre-existing workflow that still has authentication: none, instead of executing.
  • On startup, logs a warning listing workflows that would be affected so admins can migrate them before enabling the flag.

Default false — no change to OSS behavior. When enabled, applies to every existing and future /mcp/* route on the instance (including the SSE / HTTP-stream transports).

My use case:

We deploy n8n as a shared platform across >30 tenant instances. MCP tools become part of an LLM agent's action surface, and any tenant author can attach a workflow that publishes an unauthenticated MCP endpoint. Our security team requires an instance-level guardrail before we can broadly enable MCP.

Right now the only way to prevent a "None"-auth workflow is by manually auditing every workflow after the fact, which doesn't scale across 30+ tenants.

The recently-shipped n8n OAuth2 option on the MCP Server Trigger (n8n#32326) and OAuth 2.1 protected-resource resolution (n8n#32235) are exactly the mechanisms we need — but individual workflow authors can still pick "None" and bypass them. We need a switch that removes that footgun instance-wide.

I think it would be beneficial to add this because:

  • Enterprise deployments cannot rely on per-workflow discipline. One misconfigured workflow authored by any tenant creates a globally reachable unauthenticated tool endpoint. Instance-level enforcement is the only pattern that survives review.
  • The auth mechanism already exists (#32326, #32235). All that's missing is a deployment-time policy that says "don't let anyone opt out." Small addition, high leverage.
  • Composes with existing instance-MCP envs — N8N_MCP_ACCESS_ENABLED, N8N_MCP_MANAGED_BY_ENV. This is the natural next knob for admins who've already opted into instance-level MCP management.
  • Doesn't affect OSS defaults. Flag is off by default; only self-hosters who need it turn it on.

Any resources to support this?

Are you willing to work on this?