Prefer an allow-list of tools to integrate with and domains for HTTP Request — not every n8n node. Enforced across UI, API, and MCP. Block opens an impact review before the change applies.
Describe your tech stack — we’ll suggest tools and HTTP domains to allow in bulk.
| Tool | Category | Status |
|---|
Core workflow primitives (Webhook, IF, Code, Schedule) stay available — they are not on this allowlist. Shell / FTP-style tools stay blocked by default.
| Domain pattern | Note | Status |
|---|
HTTP Request nodes can only call allowlisted hosts. Same rail for builders, API, and MCP agents.