┌─────────────────────────────────────────────────────────────────┐
│                    MCP-Architektur                             │
├─────────────────────────────────────────────────────────────────┤
│                                                                  │
│  ┌──────────────┐          ┌──────────────────┐               │
│  │  KI-Agent    │◄────────►│   MCP-Client     │               │
│  │  (n8n,       │          │   (Transport     │               │
│  │   OpenClaw,  │          │    Ebene)        │               │
│  │   Claude)    │          │                  │               │
│  └──────────────┘          └────────┬─────────┘               │
│                                     │                          │
│                                     │ Stdio / HTTP / SSE       │
│                                     │                          │
│                            ┌────────▼─────────┐               │
│                            │   MCP-Server     │               │
│                            │   (Tool-Host)    │               │
│                            │                  │               │
│                            │  ┌────────────┐  │               │
│                            │  │  Tools     │  │               │
│                            │  │  Ressourcen│  │               │
│                            │  │  Prompts   │  │               │
│                            │  └────────────┘  │               │
│                            └──────────────────┘               │
│                                                                  │
└─────────────────────────────────────────────────────────────────┘

# Für die n8n-benutzerdefinierte Knotenentwicklung
npm install @modelcontextprotocol/sdk

# Für die Verwendung in Funktionsknoten (über npm in n8n-Einstellungen)
npm install @modelcontextprotocol/sdk axios

// MCP-Client-Konfigurationsknoten
const { Client } = require('@modelcontextprotocol/sdk/client/index.js');
const { StdioClientTransport } = require('@modelcontextprotocol/sdk/client/stdio.js');
const { HttpClientTransport } = require('@modelcontextprotocol/sdk/client/http.js');

class N8nMCPClient {
  constructor(config) {
    this.config = config;
    this.clients = new Map();
  }

  async connectToServer(serverConfig) {
    const { name, transport, connection } = serverConfig;
    
    let transportInstance;
    
    if (transport === 'stdio') {
      transportInstance = new StdioClientTransport({
        command: connection.command,
        args: connection.args,
        env: connection.env || {}
      });
    } else if (transport === 'http') {
      transportInstance = new HttpClientTransport({
        url: connection.url,
        headers: connection.headers || {}
      });
    }

    const client = new Client({
      name: `n8n-client-${name}`,
      version: '1.0.0'
    });

    await client.connect(transportInstance);
    
    // Verfügbare Tools entdecken
    const tools = await client.listTools();
    const resources = await client.listResources();
    
    this.clients.set(name, {
      client,
      transport: transportInstance,
      tools: tools.tools,
      resources: resources.resources
    });

    return {
      connected: true,
      server: name,
      toolCount: tools.tools.length,
      resourceCount: resources.resources.length,
      tools: tools.tools.map(t => ({ name: t.name, description: t.description }))
    };
  }

  async callTool(serverName, toolName, args) {
    const server = this.clients.get(serverName);
    if (!server) {
      throw new Error(`Server ${serverName} nicht verbunden`);
    }

    const result = await server.client.callTool({
      name: toolName,
      arguments: args
    });

    return result;
  }

  async disconnect(serverName) {
    const server = this.clients.get(serverName);
    if (server) {
      await server.client.close();
      this.clients.delete(serverName);
    }
  }
}

// Verwendung im n8n-Funktionsknoten
const mcpClient = new N8nMCPClient();

const serverConfigs = [
  {
    name: 'postgresql',
    transport: 'stdio',
    connection: {
      command: 'npx',
      args: ['-y', '@modelcontextprotocol/server-postgres', 
             process.env.DATABASE_URL]
    }
  },
  {
    name: 'github',
    transport: 'stdio',
    connection: {
      command: 'npx',
      args: ['-y', '@modelcontextprotocol/server-github'],
      env: {
        GITHUB_PERSONAL_ACCESS_TOKEN: process.env.GITHUB_TOKEN
      }
    }
  }
];

const results = [];
for (const config of serverConfigs) {
  try {
    const result = await mcpClient.connectToServer(config);
    results.push(result);
  } catch (error) {
    results.push({
      connected: false,
      server: config.name,
      error: error.message
    });
  }
}

return [{ json: { connections: results } }];

// MCP-Tool-Executor-Knoten
{
  "name": "MCP-Tool-Executor",
  "type": "n8n-nodes-base.function",
  "parameters": {
    "functionCode": `
      const { Client } = require('@modelcontextprotocol/sdk/client/index.js');
      const { StdioClientTransport } = require('@modelcontextprotocol/sdk/client/stdio.js');
      
      const serverName = $input.first().json.server_name;
      const toolName = $input.first().json.tool_name;
      const parameters = $input.first().json.parameters || {};
      
      // Server-Konfiguration aus Anmeldeinformationen oder statischer Konfiguration laden
      const serverConfig = loadServerConfig(serverName);
      
      const transport = new StdioClientTransport({
        command: serverConfig.command,
        args: serverConfig.args,
        env: serverConfig.env
      });
      
      const client = new Client({
        name: 'n8n-mcp-executor',
        version: '1.0.0'
      });
      
      try {
        await client.connect(transport);
        
        // Überprüfen, ob Tool existiert
        const tools = await client.listTools();
        const tool = tools.tools.find(t => t.name === toolName);
        
        if (!tool) {
          throw new Error(\`Tool '\${toolName}' nicht im Server '\${serverName}' gefunden\`);
        }
        
        // Parameter gegen Schema validieren
        validateParameters(parameters, tool.inputSchema);
        
        // Tool ausführen
        const result = await client.callTool({
          name: toolName,
          arguments: parameters
        });
        
        await client.close();
        
        return [{
          json: {
            success: true,
            server: serverName,
            tool: toolName,
            result: result.content
          }
        }];
        
      } catch (error) {
        await client.close();
        return [{
          json: {
            success: false,
            server: serverName,
            tool: toolName,
            error: error.message
          }
        }];
      }
    `
  }
}

// n8n-als-mcp-server.js
const { Server } = require('@modelcontextprotocol/sdk/server/index.js');
const { StdioServerTransport } = require('@modelcontextprotocol/sdk/server/stdio.js');
const {
  CallToolRequestSchema,
  ListToolsRequestSchema,
  ListResourcesRequestSchema,
  ReadResourceRequestSchema
} = require('@modelcontextprotocol/sdk/types.js');

class N8nMCPServer {
  constructor(n8nConfig) {
    this.n8nConfig = n8nConfig;
    this.server = new Server(
      {
        name: 'n8n-mcp-server',
        version: '1.0.0'
      },
      {
        capabilities: {
          tools: {},
          resources: {}
        }
      }
    );
    
    this.setupHandlers();
  }

  setupHandlers() {
    // Verfügbare Tools auflisten (exponierte n8n-Workflows)
    this.server.setRequestHandler(ListToolsRequestSchema, async () => {
      return {
        tools: [
          {
            name: 'execute_n8n_workflow',
            description: 'Führen Sie einen n8n-Workflow mit bereitgestellten Parametern aus',
            inputSchema: {
              type: 'object',
              properties: {
                workflow_id: {
                  type: 'string',
                  description: 'ID des auszuführenden n8n-Workflows'
                },
                parameters: {
                  type: 'object',
                  description: 'An den Workflow zu übergebende Parameter'
                }
              },
              required: ['workflow_id', 'parameters']
            }
          },
          {
            name: 'query_workflow_executions',
            description: 'Historische Workflow-Ausführungen abfragen',
            inputSchema: {
              type: 'object',
              properties: {
                workflow_id: {
                  type: 'string',
                  description: 'Nach Workflow-ID filtern'
                },
                status: {
                  type: 'string',
                  enum: ['success', 'error', 'waiting'],
                  description: 'Nach Ausführungsstatus filtern'
                },
                limit: {
                  type: 'number',
                  default: 10,
                  description: 'Maximale Anzahl an Ergebnissen'
                }
              }
            }
          }
        ]
      };
    });

    // Tool-Ausführung behandeln
    this.server.setRequestHandler(CallToolRequestSchema, async (request) => {
      const { name, arguments: args } = request.params;
      
      if (name === 'execute_n8n_workflow') {
        return await this.executeWorkflow(args.workflow_id, args.parameters);
      } else if (name === 'query_workflow_executions') {
        return await this.queryExecutions(args);
      }
      
      throw new Error(`Unbekanntes Tool: ${name}`);
    });

    // Ressourcen auflisten (exponierte Datenquellen)
    this.server.setRequestHandler(ListResourcesRequestSchema, async () => {
      return {
        resources: [
          {
            uri: 'n8n://workflows',
            name: 'Verfügbare Workflows',
            description: 'Liste aller verfügbaren n8n-Workflows',
            mimeType: 'application/json'
          },
          {
            uri: 'n8n://executions/recent',
            name: 'Letzte Ausführungen',
            description: 'Letzte Workflow-Ausführungen',
            mimeType: 'application/json'
          }
        ]
      };
    });

    // Ressourceninhalt lesen
    this.server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
      const { uri } = request.params;
      
      if (uri === 'n8n://workflows') {
        const workflows = await this.fetchWorkflows();
        return {
          contents: [{
            uri,
            mimeType: 'application/json',
            text: JSON.stringify(workflows, null, 2)
          }]
        };
      }
      
      throw new Error(`Unbekannte Ressource: ${uri}`);
    });
  }

  async executeWorkflow(workflowId, parameters) {
    const axios = require('axios');
    
    try {
      const response = await axios.post(
        `${this.n8nConfig.baseUrl}/api/v1/workflows/${workflowId}/execute`,
        { data: parameters },
        {
          headers: {
            'X-N8N-API-KEY': this.n8nConfig.apiKey
          }
        }
      );
      
      return {
        content: [
          {
            type: 'text',
            text: JSON.stringify(response.data, null, 2)
          }
        ]
      };
    } catch (error) {
      throw new Error(`Workflow-Ausführung fehlgeschlagen: ${error.message}`);
    }
  }

  async queryExecutions(filters) {
    const axios = require('axios');
    
    const params = new URLSearchParams();
    if (filters.workflow_id) params.append('workflowId', filters.workflow_id);
    if (filters.status) params.append('status', filters.status);
    if (filters.limit) params.append('limit', filters.limit.toString());
    
    const response = await axios.get(
      `${this.n8nConfig.baseUrl}/api/v1/executions?${params.toString()}`,
      {
        headers: {
          'X-N8N-API-KEY': this.n8nConfig.apiKey
        }
      }
    );
    
    return {
      content: [
        {
          type: 'text',
          text: JSON.stringify(response.data, null, 2)
        }
      ]
    };
  }

  async start() {
    const transport = new StdioServerTransport();
    await this.server.connect(transport);
    console.log('n8n MCP-Server läuft auf stdio');
  }
}

// Server starten
const server = new N8nMCPServer({
  baseUrl: process.env.N8N_URL || 'http://localhost:5678',
  apiKey: process.env.N8N_API_KEY
});

server.start().catch(console.error);

// n8n-Workflow: KI-Datenbank-Agent mit MCP
{
  "name": "MCP-Datenbank-KI-Agent",
  "nodes": [
    {
      "type": "n8n-nodes-base.webhook",
      "name": "Benutzerabfrage",
      "parameters": {
        "httpMethod": "POST",
        "path": "db-agent"
      }
    },
    {
      "type": "n8n-nodes-base.agent",
      "name": "Abfrage-Verständnis-Agent",
      "parameters": {
        "options": {
          "systemMessage": "Sie sind ein Datenbankabfrage-Spezialist. Analysieren Sie die natürlichsprachige Benutzerabfrage und bestimmen Sie, welche Datenbankoperationen benötigt werden.\\n\\nVerfügbare Tools über MCP:\\n- postgres_query: PostgreSQL-Abfragen ausführen\\n- postgres_explain: Abfrage-Ausführungspläne abrufen\\n- postgres_schema: Tabellenschemas anzeigen\\n\\nProzess:\\n1. Die Absicht des Benutzers verstehen\\n2. Relevante Tabellen bestimmen\\n3. Angemessenes SQL formulieren\\n4. Sicherheit beachten (kein DROP, DELETE ohne WHERE)\\n\\nJSON ausgeben mit: intent, tables_involved, suggested_query, needs_human_approval"
        }
      }
    },
    {
      "type": "n8n-nodes-base.function",
      "name": "Sicherheits-Validator",
      "parameters": {
        "functionCode": `
          const query = $input.first().json.suggested_query;
          
          // Sicherheitsprüfungen
          const forbiddenPatterns = [
            /DROP\\s+TABLE/i,
            /DELETE\\s+FROM\\s+\\w+\\s*;?$/i,  // DELETE ohne WHERE
            /TRUNCATE/i,
            /ALTER\\s+TABLE.*DROP/i,
            /--/  // SQL-Injektionsversuch
          ];
          
          const violations = forbiddenPatterns.filter(p => p.test(query));
          
          if (violations.length > 0) {
            return [{
              json: {
                approved: false,
                reason: 'Sicherheitsverletzung erkannt',
                violations: violations.map(p => p.toString())
              }
            }];
          }
          
          // Prüfen, ob menschliche Genehmigung erforderlich ist
          const needsApproval = $input.first().json.needs_human_approval;
          
          if (needsApproval) {
            // Genehmigungs-Workflow auslösen
            await $httpRequest({
              method: 'POST',
              url: process.env.APPROVAL_WEBHOOK_URL,
              body: {
                query: query,
                requester: $input.first().json.user_id,
                reason: $input.first().json.intent
              }
            });
            
            return [{
              json: {
                approved: false,
                status: 'pending_approval',
                message: 'Abfrage erfordert menschliche Genehmigung'
              }
            }];
          }
          
          return [{
            json: {
              approved: true,
              query: query,
              tables: $input.first().json.tables_involved
            }
          }];
        `
      }
    },
    {
      "type": "n8n-nodes-base.function",
      "name": "MCP-Abfrage ausführen",
      "parameters": {
        "functionCode": `
          const { Client } = require('@modelcontextprotocol/sdk/client/index.js');
          const { StdioClientTransport } = require('@modelcontextprotocol/sdk/client/stdio.js');
          
          const transport = new StdioClientTransport({
            command: 'npx',
            args: ['-y', '@modelcontextprotocol/server-postgres', 
                   process.env.DATABASE_URL]
          });
          
          const client = new Client({
            name: 'n8n-db-agent',
            version: '1.0.0'
          });
          
          try {
            await client.connect(transport);
            
            const result = await client.callTool({
              name: 'query',
              arguments: {
                sql: $input.first().json.query
              }
            });
            
            await client.close();
            
            return [{
              json: {
                success: true,
                data: result.content,
                rowCount: result.content[0]?.text ? 
                  JSON.parse(result.content[0].text).length : 0
              }
            }];
            
          } catch (error) {
            await client.close();
            return [{
              json: {
                success: false,
                error: error.message
              }
            }];
          }
        `
      }
    },
    {
      "type": "n8n-nodes-base.agent",
      "name": "Ergebnis-Interpreter",
      "parameters": {
        "options": {
          "systemMessage": "Konvertieren Sie Datenbankabfrageergebnisse in natürlichsprachige Antworten.\\n\\nRichtlinien:\\n1. Wichtige Ergebnisse zusammenfassen\\n2. Wichtige Metriken hervorheben\\n3. Verwandte Abfragen vorschlagen\\n4. Zahlen angemessen formatieren\\n5. Kontext für die Daten bereitstellen\\n\\nTon: Professionell, klar, hilfreich"
        }
      }
    }
  ]
}

# n8n-Workflow-Konfiguration: Multi-System-MCP-Integration
workflow:
  name: Enterprise MCP-Integrations-Hub
  description: Zentraler Hub für MCP-basierte Systemintegrationen
  
  mcp_servers:
    - name: salesforce
      command: npx
      args: [-y, '@modelcontextprotocol/server-salesforce']
      env:
        SF_USERNAME: ${SF_USERNAME}
        SF_TOKEN: ${SF_TOKEN}
        
    - name: hubspot
      command: npx
      args: [-y, '@modelcontextprotocol/server-hubspot']
      env:
        HUBSPOT_API_KEY: ${HUBSPOT_API_KEY}
        
    - name: stripe
      command: npx
      args: [-y, '@modelcontextprotocol/server-stripe']
      env:
        STRIPE_API_KEY: ${STRIPE_SECRET_KEY}
        
    - name: slack
      command: npx
      args: [-y, '@modelcontextprotocol/server-slack']
      env:
        SLACK_BOT_TOKEN: ${SLACK_BOT_TOKEN}
        
    - name: notion
      command: npx
      args: [-y, '@modelcontextprotocol/server-notion']
      env:
        NOTION_API_KEY: ${NOTION_API_KEY}

  integrations:
    - name: customer_360_sync
      trigger: webhook
      description: Kundendaten über alle Systeme synchronisieren
      steps:
        - action: mcp.call_tool
          server: salesforce
          tool: get_contact
          params:
            email: "{{ $input.email }}"
            
        - action: mcp.call_tool
          server: hubspot
          tool: get_contact
          params:
            email: "{{ $input.email }}"
            
        - action: n8n.transform
          description: Daten aus mehreren Quellen zusammenführen
          code: |
            const merged = mergeCustomerData([
              $steps[0].result,
              $steps[1].result
            ]);
            return merged;
            
        - action: mcp.call_tool
          server: notion
          tool: update_page
          params:
            database_id: "customer-360"
            properties: "{{ $steps[2].result }}"
            
        - action: mcp.call_tool
          server: slack
          tool: send_message
          params:
            channel: "#customer-updates"
            text: "360° Kundenprofil für {{ $input.email }} aktualisiert"

// Dokumentenverarbeitungs-KI-Workflow
{
  "name": "MCP-Dokumenten-Intelligenz-Pipeline",
  "nodes": [
    {
      "type": "n8n-nodes-base.webhook",
      "name": "Dokument-Upload",
      "parameters": {
        "httpMethod": "POST",
        "path": "process-document"
      }
    },
    {
      "type": "n8n-nodes-base.function",
      "name": "MCP-Verbindungen initialisieren",
      "parameters": {
        "functionCode": `
          // Mit mehreren MCP-Servern verbinden
          const connections = await Promise.all([
            connectMcpServer('pdf-processor', {
              command: 'npx',
              args: ['-y', '@modelcontextprotocol/server-pdf']
            }),
            connectMcpServer('ocr-service', {
              command: 'npx',
              args: ['-y', '@modelcontextprotocol/server-ocr']
            }),
            connectMcpServer('vector-store', {
              command: 'npx',
              args: ['-y', '@modelcontextprotocol/server-pinecone'],
              env: { PINECONE_API_KEY: process.env.PINECONE_API_KEY }
            })
          ]);
          
          return [{
            json: {
              connections: connections.map(c => ({
                name: c.name,
                connected: c.success,
                tools: c.tools?.length || 0
              })),
              document: $input.first().json
            }
          }];
        `
      }
    }
  ]
}

// MCP-Sicherheits-Middleware
class MCPSecurityGovernor {
  constructor(config) {
    this.config = {
      allowedServers: config.allowedServers || [],
      blockedTools: config.blockedTools || [],
      requireApproval: config.requireApproval || [],
      rateLimits: config.rateLimits || {},
      ...config
    };
    this.auditLog = [];
  }

  async validateServer(serverUrl) {
    // Gegen Whitelist prüfen
    const allowed = this.config.allowedServers.some(allowed => 
      serverUrl.startsWith(allowed)
    );
    
    if (!allowed) {
      throw new Error(`MCP-Server nicht autorisiert: ${serverUrl}`);
    }
    
    return { authorized: true };
  }

  async validateToolCall(serverName, toolName, parameters) {
    // Prüfen, ob Tool blockiert ist
    if (this.config.blockedTools.includes(toolName)) {
      await this.logSecurityEvent('BLOCKED_TOOL_ATTEMPT', {
        server: serverName,
        tool: toolName
      });
      throw new Error(`Tool '${toolName}' ist blockiert`);
    }
    
    // Prüfen, ob Genehmigung erforderlich
    if (this.config.requireApproval.includes(toolName)) {
      const approval = await this.requestHumanApproval({
        server: serverName,
        tool: toolName,
        parameters
      });
      
      if (!approval.granted) {
        throw new Error('Tool-Ausführung erfordert Genehmigung');
      }
    }
    
    return { approved: true };
  }
}

# MCP-Datenschutz-Konfiguration
datenschutz:
  pii_erkennung:
    aktiviert: true
    muster:
      - typ: email
        regex: \\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Z|a-z]{2,}\\b
        aktion: maskieren
      - typ: telefon
        regex: \\b\\+?[\\d\\s-]{10,20}\\b
        aktion: maskieren
        
  gdpr:
    recht_auf_vergessenwerden: true
    datenportabilitaet: true
    einwilligung_verfolgung: true
    
  audit:
    alle_aufrufe_loggen: true
    aufbewahrung_tage: 90

// MCP-Beobachtbarkeits-Integration
class MCPBeobachtbarkeit {
  constructor(langfuseConfig) {
    this.langfuse = new Langfuse(langfuseConfig);
  }

  async traceMCPSession(sessionConfig) {
    const trace = this.langfuse.trace({
      name: `mcp-session-${sessionConfig.server}`,
      userId: sessionConfig.userId,
      metadata: {
        server: sessionConfig.server,
        tools: sessionConfig.tools,
        startTime: new Date().toISOString()
      }
    });

    return {
      trace,
      
      async logToolCall(toolName, parameters, result, duration) {
        const generation = trace.generation({
          name: `mcp-tool-${toolName}`,
          model: `mcp-server:${sessionConfig.server}`,
          input: this.sanitize(parameters),
          output: this.sanitize(result),
          usage: {
            duration_ms: duration
          }
        });

        await this.sendMetrics({
          server: sessionConfig.server,
          tool: toolName,
          duration,
          success: !result.error,
          timestamp: new Date().toISOString()
        });
      }
    };
  }
}