OpenClaw + n8n over MCP: Chat Brain, Workflow Hands

By the end you will have:

• OpenClaw Gateway healthy (or Claude as the MCP client)
• n8n Instance-level MCP enabled with OAuth or API key
• Only approved workflows marked Available in MCP (webhook/form/schedule/chat triggers)
• OpenClaw (or Claude) able to discover and execute those workflows — not your entire instance
• Write workflows still protected by HITL tool gates inside n8n
• A first outcome: Slack ask → OpenClaw → n8n “lookup deal” workflow → answer back in channel

Prereqs playbooks: OpenClaw business stand-up and n8n AI Ops Agent. HITL: n8n approval gates.

Official refs: Connect to n8n MCP server, OpenClaw MCP.

Teammate (Slack)
    → OpenClaw Gateway (chat brain, pairing, allowlists)
        → MCP client registry / Claude connector
            → n8n Instance MCP (https://n8n…/mcp-server/http)
                → Only workflows you enabled for MCP
                    → CRM/Slack/HTTP nodes (+ HITL on writes)

Two complementary MCP shapes in n8n:

OpenClaw side:

1. Working OpenClaw on a host (Slack/Telegram connected, Control UI behind Tailscale/CF Access).
2. Working n8n on HTTPS (WEBHOOK_URL / public URL correct) — Cloud or self-host.
3. n8n version recent enough for Instance-level MCP UI (docs describe richer UI from ~2.33+; older builds still have MCP but simpler screens — follow what your Settings page shows).
4. Owner/admin on n8n to enable MCP.
5. At least one published workflow with a Webhook, Form, Schedule, or Chat trigger (eligibility rule for MCP exposure).

1. 1

   Enable Instance MCP

   n8n → Settings → Instance-level MCP.
   Enable MCP access (owner/admin).
   Note Connection details → Connect a client.
   Prefer OAuth; API key works for automation but is easier to leak — rotate if copied.
   Copy the Server URL (ends with /mcp-server/http).
   Optional but recommended: Allowed callback URLs → Only trusted URLs (Claude / OpenClaw redirects you use).

2. 2

   Kill Switch

   Self-host kill switch if needed later: N8N_DISABLED_MODULES=mcp.

Create two workflows if you do not have them:

A) Read — mcp-crm-lookup (safe)

• Trigger: Webhook (POST) or Chat Trigger
• Nodes: HubSpot/Pipedrive search → respond with JSON { id, stage, owner }
• Publish
• Enable Available in MCP (workflow Settings or Workflows exposed page)
• Add a clear description: “Read-only CRM deal lookup by name or email.”

B) Write — mcp-crm-note (gated)

• Same pattern but creates a note
• Insert Human review (HITL) before the CRM write (Slack to #approvals)
• Publish + Available in MCP
• Description: “Adds a CRM note ONLY after Slack approval.”

Option A — OpenClaw saved MCP servers (brain uses n8n tools)

1. On the OpenClaw host, open Control UI → Settings → MCP (or /settings/mcp).
2. Add server: Streamable HTTP / URL = n8n Server URL from Step 1.
3. Complete OAuth (or paste API key config if that is your chosen method).
4. openclaw mcp probe / status until tools list shows n8n workflow tools.
5. Restart gateway if your version requires it after MCP changes.

CLI-oriented flow (same idea): openclaw mcp add / configure / login per OpenClaw MCP docs.

Option B — Claude Desktop/browser as the client (same n8n backend)

1. Settings → Instance-level MCP → Connect → pick Claude → follow one-click or paste URL.
2. Approve OAuth scopes carefully (prefer execute-only on staging first).
3. In Claude: “List my n8n MCP workflows” → confirm only the ones you enabled.

In the allowlisted Slack channel:

@OpenClaw What’s the stage and owner for deal MCP TEST? Use the n8n CRM lookup workflow — do not invent fields.

Expect:

1. OpenClaw calls n8n MCP execute/search tools
2. mcp-crm-lookup runs
3. Answer returns with real ids

Then:

Add a note to that deal: “Checked via OpenClaw+n8n MCP <date>.”

Expect Slack approval card from HITL → only then CRM note.

• [ ] Instance MCP enabled; Server URL HTTPS
• [ ] Only lookup (+ gated note) workflows Available in MCP
• [ ] OpenClaw (or Claude) connected; probe lists expected tools
• [ ] Slack mention returns real CRM fields
• [ ] Write path requires HITL approve; deny leaves CRM unchanged
• [ ] Unknown OAuth clients revoked
• [ ] Owners named for OpenClaw host + n8n MCP settings

• Enabling MCP on every workflow — chat agents will find sharp tools.
• Assuming client isolation — all connected clients share the exposed set (per user ACL).
• HTTP n8n URL — OAuth/clients break; fix HTTPS first.
• WAF stripping MCP headers — mysterious protocol fallbacks.
• Skipping HITL because “OpenClaw is trusted” — prompt injection still exists in group chats.
• Using openclaw mcp serve when you meant “call n8n” — that command exposes OpenClaw outward; you want OpenClaw as MCP client to n8n.

MCP Server Trigger vs Instance MCP?
Trigger = one curated tool server inside a workflow. Instance MCP = operate many workflows/agents from one connection. Start with Instance MCP for ops hands; use Trigger when packaging a productized tool API.

Where does Zapier MCP fit?
Laptop-time SaaS actions. This stack is for owned chat + owned workflows.

Deepen approvals: n8n HITL gates. Expand protocol coverage: Business MCP Starter Pack.