A few threads here keep coming back to the same fear: an AI agent or a webhook workflow that can quietly send an email, issue a refund or delete a row, with nothing in front of it. So I built a small n8n workflow that looks at an exported workflow and answers one question: what could go wrong if this runs unattended, and what stands in the way?
You paste the JSON of any workflow (Download → Copy to clipboard), and it returns:
a map of the workflow with every node that can spend money, send mail/messages, delete or write data, or run commands marked as “blast radius”, and the guards in front of it (approval/Wait, IF/Filter, limits) shown as shields
a grade from A to F with the findings sorted by severity, each with “why it matters” and “how to fix it”
for AI agents: tools the LLM can reach with no human approval and no maxIterations
What it checks today (deterministic rules in one Code node, no LLM needed for the analysis):
webhooks without authentication
secrets written into node parameters (shown only as “redacted”)
dangerous actions reachable from a trigger or an agent with no guard on the path
AI Agent with dangerous tools, no approval, no iteration limit
no error workflow / Error Trigger
HTTP Request without retry or error handling
webhook → payment/database write without any dedup
pinData in the export (it can contain real customer data)
loops without batching or wait, Code nodes using eval/child_process, orphan or disabled nodes
Two demo workflows are included: a “risky” support agent (Gmail + Stripe refund + DB delete as tools, no approval) that scores an F, and a “solid” version with human approval, auth, dedup and an error workflow that scores an A. One thing I found by running it on my own workflows: all of them got a C, because my webhooks had no auth of their own and I had never set an error workflow. That was a useful slap.
Try it (no login): n8n workflow security check: X-Ray blast radius map
Workflow JSON (import into your own n8n): https://daniele-michelin.com/assets/n8n/xray.json
How it works under the hood: Webhook → Code node (validation, rules, layered layout) → optional LLM call for “fix these 3 things first” (the workflow still works without it) → Respond to Webhook. The page draws the graph from the returned JSON.
Limits, honestly: it is a static analysis. It does not follow sub-workflows, does not read expressions, and a guard like an IF node is accepted even if the condition is weak. “No findings” does not mean “safe”, and it is not a security audit. The pasted workflow is not stored or logged; only the report is kept for 7 days and you can delete it.
I’d love your input: which checks would you add or change? I’m thinking about idempotency checks that look at the actual key, and about sub-workflows. And what do you currently do to stop an agent from sending something irreversible?