┌─────────────────────────────────────────────────────────────────┐
│                    MCP ARCHITECTURE                             │
├─────────────────────────────────────────────────────────────────┤
│                                                                   │
│   ┌─────────────┐         ┌─────────────┐         ┌───────────┐  │
│   │   MCP       │         │   MCP       │         │   Tools   │  │
│   │   Client    │◄───────►│   Server    │◄───────►│   (n8n)   │  │
│   │             │         │             │         │           │  │
│   │  OpenClaw   │         │  Protocol   │         │ Workflows │  │
│   │  Claude     │         │  Bridge     │         │ APIs      │  │
│   │  Cursor     │         │             │         │ Services  │  │
│   └─────────────┘         └─────────────┘         └───────────┘  │
│                                                                   │
│   Standardized tool discovery, invocation, and context sharing   │
│                                                                   │
└─────────────────────────────────────────────────────────────────┘

┌──────────────────────────────────────────────────────────────────┐
│                     MCP REQUEST FLOW                            │
├──────────────────────────────────────────────────────────────────┤
│                                                                    │
│  1. DISCOVERY                                                      │
│     ┌─────────┐  List Tools/Resources   ┌─────────┐               │
│     │ Client  │ ──────────────────────► │ Server  │               │
│     │         │ ◄────────────────────── │         │               │
│     └─────────┘   Tool Definitions      └─────────┘               │
│                                                                    │
│  2. INVOCATION                                                     │
│     ┌─────────┐  Call Tool (params)     ┌─────────┐               │
│     │ Client  │ ──────────────────────► │ Server  │               │
│     │         │ ◄────────────────────── │         │               │
│     └─────────┘   Result/Error         └─────────┘               │
│                                                                    │
│  3. CONTEXT SHARING                                                │
│     • Schema definitions                                           │
│     • Error information                                            │
│     • Progress updates                                             │
│     • Resource subscriptions                                       │
│                                                                    │
└──────────────────────────────────────────────────────────────────┘

# OpenClaw MCP Configuration (mcp.yml)
servers:
  # n8n MCP Server
  n8n-automation:
    command: node
    args: ["/path/to/n8n-mcp-server/dist/index.js"]
    env:
      N8N_HOST: "https://n8n.company.internal"
      N8N_API_KEY: "${N8N_API_KEY}"
      
  # External Composio MCP
  composio-tools:
    url: "https://connect.composio.dev/mcp"
    headers:
      Authorization: "Bearer ${COMPOSIO_API_KEY}"
      
  # Custom Enterprise MCP
  enterprise-integrations:
    command: python
    args: ["-m", "enterprise_mcp_server"]
    env:
      DATABASE_URL: "${ENTERPRISE_DB_URL}"

┌─────────────────────────────────────────────────────────────────┐
│              OPENCLAW MCP INTEGRATION FLOW                        │
├─────────────────────────────────────────────────────────────────┤
│                                                                   │
│  User Message                                                     │
│       │                                                           │
│       ▼                                                           │
│  ┌─────────────────┐                                              │
│  │  OpenClaw       │  1. Parse intent, identify goal               │
│  │  Gateway        │  2. Load conversation context              │
│  │                 │  3. Determine required capabilities          │
│  └────────┬────────┘                                              │
│           │                                                       │
│           ▼                                                       │
│  ┌─────────────────┐                                              │
│  │  Tool Selection │  Analyze available MCP tools                │
│  │  (LLM Reasoning)│  Select optimal tool sequence               │
│  └────────┬────────┘                                              │
│           │                                                       │
│           ▼                                                       │
│  ┌─────────────────┐                                              │
│  │  MCP Client     │  Format MCP request                         │
│  │  Layer          │  Invoke tool                                │
│  └────────┬────────┘                                              │
│           │                                                       │
│           ▼                                                       │
│  ┌─────────────────┐                                              │
│  │  MCP Server     │  Process request                            │
│  │  (n8n/Make/etc)│  Execute workflow/API call                   │
│  └────────┬────────┘                                              │
│           │                                                       │
│           ▼                                                       │
│  ┌─────────────────┐                                              │
│  │  Result         │  Parse response                             │
│  │  Processing     │  Update context                             │
│  │                 │  Generate user response                     │
│  └─────────────────┘                                              │
│                                                                   │
└─────────────────────────────────────────────────────────────────┘

// Tool capabilities define what operations are allowed
interface ToolCapabilities {
  read: boolean;      // Can read data
  write: boolean;     // Can modify data
  execute: boolean;   // Can trigger actions
  admin: boolean;     // Administrative functions
}

// Each MCP server registers with specific capabilities
const n8nServer = {
  name: "n8n-automation",
  capabilities: ["read", "write", "execute"],
  restrictedWorkflows: ["production-deployments"] // Exclude sensitive workflows
};

# OpenClaw approval configuration
approvals:
  high-risk-actions:
    - pattern: "delete.*"
      requires_approval: true
    - pattern: "deploy.*production.*"
      requires_approval: true
    - pattern: "transfer.*funds.*"
      requires_approval: true
      approvers: ["finance-team"]

┌─────────────────────────────────────────────────────────────────┐
│                    N8N MCP SERVER                               │
├─────────────────────────────────────────────────────────────────┤
│                                                                   │
│   ┌─────────────────────────────────────────────────────────┐   │
│   │                    MCP Server Core                      │   │
│   │  ┌─────────────┐  ┌─────────────┐  ┌─────────────────┐ │   │
│   │  │   Tools     │  │ Resources   │  │   Prompts       │ │   │
│   │  │  Registry   │  │  Registry   │  │   Registry      │ │   │
│   │  └──────┬──────┘  └──────┬──────┘  └────────┬────────┘ │   │
│   │         │                │                  │          │   │
│   │  ┌──────▼────────────────▼──────────────────▼────────┐ │   │
│   │  │           n8n API Integration Layer                 │ │   │
│   │  │  • Workflow Discovery                               │ │   │
│   │  │  • Execution Management                             │ │   │
│   │  │  • Credential Handling                              │ │   │
│   │  │  • Webhook Management                               │ │   │
│   │  └───────────────────────┬─────────────────────────────┘ │   │
│   │                          │                               │   │
│   │  ┌───────────────────────▼─────────────────────────────┐ │   │
│   │  │              Authentication Layer                   │ │   │
│   │  │  • API Key Validation                             │ │   │
│   │  │  • OAuth 2.0 Support                              │ │   │
│   │  │  • JWT Token Verification                         │ │   │
│   │  └───────────────────────────────────────────────────┘ │   │
│   └─────────────────────────────────────────────────────────┘   │
│                                                                   │
│   Transport: stdio | SSE | WebSocket                               │
│                                                                   │
└─────────────────────────────────────────────────────────────────┘

# Create project directory
mkdir n8n-mcp-server
cd n8n-mcp-server
npm init -y

# Install dependencies
npm install @modelcontextprotocol/sdk zod dotenv winston
npm install -D @types/node typescript

# Initialize TypeScript
npx tsc --init

// src/index.ts
import { Server } from "@modelcontextprotocol/sdk/server/index.js";
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
import {
  CallToolRequestSchema,
  ListToolsRequestSchema,
  ListResourcesRequestSchema,
  ReadResourceRequestSchema,
} from "@modelcontextprotocol/sdk/types.js";
import { N8nClient } from "./n8n-client.js";
import { ToolRegistry } from "./tool-registry.js";
import { logger } from "./logger.js";

class N8nMcpServer {
  private server: Server;
  private n8nClient: N8nClient;
  private toolRegistry: ToolRegistry;

  constructor() {
    this.n8nClient = new N8nClient({
      baseUrl: process.env.N8N_HOST!,
      apiKey: process.env.N8N_API_KEY!,
    });

    this.toolRegistry = new ToolRegistry(this.n8nClient);

    this.server = new Server(
      {
        name: "n8n-mcp-server",
        version: "1.0.0",
      },
      {
        capabilities: {
          tools: {},
          resources: {},
        },
      }
    );

    this.setupHandlers();
  }

  private setupHandlers() {
    // List available tools
    this.server.setRequestHandler(ListToolsRequestSchema, async () => {
      const tools = await this.toolRegistry.getTools();
      return { tools };
    });

    // Execute tool
    this.server.setRequestHandler(CallToolRequestSchema, async (request) => {
      const { name, arguments: args } = request.params;
      
      logger.info(`Executing tool: ${name}`, { args });

      try {
        const result = await this.toolRegistry.executeTool(name, args);
        return {
          content: [
            {
              type: "text",
              text: JSON.stringify(result, null, 2),
            },
          ],
        };
      } catch (error) {
        logger.error(`Tool execution failed: ${name}`, { error });
        throw error;
      }
    });

    // List available resources
    this.server.setRequestHandler(ListResourcesRequestSchema, async () => {
      const resources = await this.toolRegistry.getResources();
      return { resources };
    });

    // Read resource
    this.server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
      const { uri } = request.params;
      const content = await this.toolRegistry.readResource(uri);
      return {
        contents: [
          {
            uri,
            mimeType: "application/json",
            text: JSON.stringify(content, null, 2),
          },
        ],
      };
    });
  }

  async run() {
    const transport = new StdioServerTransport();
    await this.server.connect(transport);
    logger.info("n8n MCP Server running on stdio");
  }
}

// Start server
const server = new N8nMcpServer();
server.run().catch(console.error);

// src/n8n-client.ts
import { logger } from "./logger.js";

interface N8nConfig {
  baseUrl: string;
  apiKey: string;
}

interface Workflow {
  id: string;
  name: string;
  active: boolean;
  tags?: { name: string }[];
  nodes?: any[];
}

interface ExecutionResult {
  executionId: string;
  status: "success" | "error" | "running";
  data?: any;
  error?: string;
}

export class N8nClient {
  private config: N8nConfig;

  constructor(config: N8nConfig) {
    this.config = config;
  }

  private async request<T>(
    endpoint: string,
    options: RequestInit = {}
  ): Promise<T> {
    const url = `${this.config.baseUrl}/api/v1${endpoint}`;
    const response = await fetch(url, {
      ...options,
      headers: {
        "X-N8N-API-KEY": this.config.apiKey,
        "Content-Type": "application/json",
        ...options.headers,
      },
    });

    if (!response.ok) {
      throw new Error(`n8n API error: ${response.status} ${response.statusText}`);
    }

    return response.json();
  }

  async getWorkflows(): Promise<Workflow[]> {
    const response = await this.request<{ data: Workflow[] }>("/workflows");
    return response.data;
  }

  async getWorkflow(id: string): Promise<Workflow> {
    return this.request<Workflow>(`/workflows/${id}`);
  }

  async executeWorkflow(
    workflowId: string,
    data: Record<string, any>
  ): Promise<ExecutionResult> {
    logger.info(`Triggering workflow execution: ${workflowId}`);

    // Use webhook if available, otherwise use direct execution
    try {
      const response = await this.request<ExecutionResult>(
        `/workflows/${workflowId}/execute`,
        {
          method: "POST",
          body: JSON.stringify(data),
        }
      );
      return response;
    } catch (error) {
      // Fallback to webhook execution
      return this.executeViaWebhook(workflowId, data);
    }
  }

  private async executeViaWebhook(
    workflowId: string,
    data: Record<string, any>
  ): Promise<ExecutionResult> {
    const webhookUrl = `${this.config.baseUrl}/webhook/${workflowId}`;
    
    const response = await fetch(webhookUrl, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify(data),
    });

    if (!response.ok) {
      throw new Error(`Webhook execution failed: ${response.statusText}`);
    }

    const result = await response.json();
    return {
      executionId: result.executionId || "webhook",
      status: result.status || "success",
      data: result,
    };
  }

  async getExecution(executionId: string): Promise<ExecutionResult> {
    return this.request<ExecutionResult>(`/executions/${executionId}`);
  }

  async getWorkflowExecutions(workflowId: string, limit = 10): Promise<ExecutionResult[]> {
    const response = await this.request<{ data: ExecutionResult[] }>(
      `/executions?filter[workflowId]=${workflowId}&limit=${limit}`
    );
    return response.data;
  }
}

// src/tool-registry.ts
import { z } from "zod";
import { N8nClient } from "./n8n-client.js";
import { logger } from "./logger.js";

interface Tool {
  name: string;
  description: string;
  inputSchema: z.ZodType<any>;
  workflowId?: string;
  tags: string[];
}

interface Resource {
  uri: string;
  name: string;
  mimeType: string;
  description?: string;
}

export class ToolRegistry {
  private n8nClient: N8nClient;
  private tools: Map<string, Tool> = new Map();
  private resources: Map<string, Resource> = new Map();

  constructor(n8nClient: N8nClient) {
    this.n8nClient = n8nClient;
  }

  async initialize() {
    await this.discoverWorkflows();
    await this.registerStaticTools();
  }

  private async discoverWorkflows() {
    logger.info("Discovering n8n workflows...");
    
    try {
      const workflows = await this.n8nClient.getWorkflows();
      
      for (const workflow of workflows) {
        // Only expose active workflows with MCP tag
        if (!workflow.active) continue;
        if (!workflow.tags?.some((t) => t.name === "mcp")) continue;

        const toolName = this.sanitizeWorkflowName(workflow.name);
        
        this.tools.set(toolName, {
          name: toolName,
          description: `Execute n8n workflow: ${workflow.name}`,
          inputSchema: z.object({
            data: z.record(z.any()).optional().describe("Workflow input data"),
            waitForCompletion: z
              .boolean()
              .optional()
              .default(true)
              .describe("Wait for workflow completion"),
          }),
          workflowId: workflow.id,
          tags: ["n8n", "workflow", ...(workflow.tags?.map((t) => t.name) || [])],
        });

        // Register as resource for execution history
        this.resources.set(`execution-history://${workflow.id}`, {
          uri: `execution-history://${workflow.id}`,
          name: `${toolName}-history`,
          mimeType: "application/json",
          description: `Execution history for workflow: ${workflow.name}`,
        });
      }

      logger.info(`Discovered ${this.tools.size} MCP-enabled workflows`);
    } catch (error) {
      logger.error("Failed to discover workflows", { error });
    }
  }

  private registerStaticTools() {
    // Tool: List all workflows
    this.tools.set("list_workflows", {
      name: "list_workflows",
      description: "List all available n8n workflows with MCP tag",
      inputSchema: z.object({
        includeInactive: z.boolean().optional().default(false),
      }),
      tags: ["discovery", "metadata"],
    });

    // Tool: Get workflow status
    this.tools.set("get_workflow_status", {
      name: "get_workflow_status",
      description: "Get the current status and recent executions of a workflow",
      inputSchema: z.object({
        workflowId: z.string().describe("ID of the workflow to check"),
      }),
      tags: ["monitoring", "status"],
    });

    // Tool: Search executions
    this.tools.set("search_executions", {
      name: "search_executions",
      description: "Search workflow execution history with filters",
      inputSchema: z.object({
        workflowId: z.string().optional().describe("Filter by workflow ID"),
        status: z.enum(["success", "error", "running"]).optional(),
        since: z.string().optional().describe("ISO date string"),
        limit: z.number().optional().default(10),
      }),
      tags: ["search", "history"],
    });
  }

  private sanitizeWorkflowName(name: string): string {
    return name
      .toLowerCase()
      .replace(/[^a-z0-9]+/g, "_")
      .replace(/^_+|_+$/g, "");
  }

  async getTools(): Promise<any[]> {
    if (this.tools.size === 0) {
      await this.initialize();
    }

    return Array.from(this.tools.values()).map((tool) => ({
      name: tool.name,
      description: tool.description,
      inputSchema: zodToJsonSchema(tool.inputSchema),
    }));
  }

  async executeTool(name: string, args: any): Promise<any> {
    const tool = this.tools.get(name);
    if (!tool) {
      throw new Error(`Tool not found: ${name}`);
    }

    // Validate input
    const validated = tool.inputSchema.parse(args);

    switch (name) {
      case "list_workflows":
        return this.handleListWorkflows(validated);
      case "get_workflow_status":
        return this.handleGetWorkflowStatus(validated);
      case "search_executions":
        return this.handleSearchExecutions(validated);
      default:
        if (tool.workflowId) {
          return this.handleWorkflowExecution(tool, validated);
        }
        throw new Error(`Unknown tool: ${name}`);
    }
  }

  private async handleListWorkflows(args: any) {
    const workflows = await this.n8nClient.getWorkflows();
    return workflows
      .filter((w) => args.includeInactive || w.active)
      .map((w) => ({
        id: w.id,
        name: w.name,
        active: w.active,
        tags: w.tags?.map((t) => t.name) || [],
      }));
  }

  private async handleGetWorkflowStatus(args: any) {
    const workflow = await this.n8nClient.getWorkflow(args.workflowId);
    const executions = await this.n8nClient.getWorkflowExecutions(
      args.workflowId,
      5
    );

    return {
      workflow: {
        id: workflow.id,
        name: workflow.name,
        active: workflow.active,
      },
      recentExecutions: executions,
    };
  }

  private async handleSearchExecutions(args: any) {
    if (args.workflowId) {
      return this.n8nClient.getWorkflowExecutions(args.workflowId, args.limit);
    }
    // Implement broader search if needed
    return [];
  }

  private async handleWorkflowExecution(tool: Tool, args: any) {
    if (!tool.workflowId) {
      throw new Error(`Workflow ID not configured for tool: ${tool.name}`);
    }

    const result = await this.n8nClient.executeWorkflow(
      tool.workflowId,
      args.data || {}
    );

    if (args.waitForCompletion && result.executionId) {
      // Poll for completion
      return this.waitForExecution(result.executionId);
    }

    return result;
  }

  private async waitForExecution(
    executionId: string,
    maxAttempts = 30,
    intervalMs = 1000
  ): Promise<any> {
    for (let attempt = 0; attempt < maxAttempts; attempt++) {
      const execution = await this.n8nClient.getExecution(executionId);
      
      if (execution.status !== "running") {
        return execution;
      }

      await new Promise((resolve) => setTimeout(resolve, intervalMs));
    }

    throw new Error(`Execution timeout: ${executionId}`);
  }

  async getResources(): Promise<Resource[]> {
    return Array.from(this.resources.values());
  }

  async readResource(uri: string): Promise<any> {
    const resource = this.resources.get(uri);
    if (!resource) {
      throw new Error(`Resource not found: ${uri}`);
    }

    const workflowId = uri.replace("execution-history://", "");
    return this.n8nClient.getWorkflowExecutions(workflowId, 50);
  }
}

// Helper: Convert Zod schema to JSON Schema
function zodToJsonSchema(schema: z.ZodType<any>): any {
  return {
    type: "object",
    properties: {},
    // Simplified - use zod-to-json-schema library for full conversion
  };
}

// src/logger.ts
import winston from "winston";

export const logger = winston.createLogger({
  level: process.env.LOG_LEVEL || "info",
  format: winston.format.combine(
    winston.format.timestamp(),
    winston.format.errors({ stack: true }),
    winston.format.json()
  ),
  transports: [
    new winston.transports.Console(),
    new winston.transports.File({ filename: "logs/error.log", level: "error" }),
    new winston.transports.File({ filename: "logs/combined.log" }),
  ],
});

// package.json
{
  "name": "n8n-mcp-server",
  "version": "1.0.0",
  "description": "MCP server for n8n workflow automation",
  "type": "module",
  "main": "dist/index.js",
  "scripts": {
    "build": "tsc",
    "start": "node dist/index.js",
    "dev": "tsc --watch & nodemon dist/index.js",
    "lint": "eslint src/**/*.ts",
    "test": "vitest"
  },
  "dependencies": {
    "@modelcontextprotocol/sdk": "^0.5.0",
    "dotenv": "^16.3.1",
    "winston": "^3.11.0",
    "zod": "^3.22.4"
  },
  "devDependencies": {
    "@types/node": "^20.10.0",
    "nodemon": "^3.0.2",
    "typescript": "^5.3.3",
    "vitest": "^1.1.0"
  }
}

# ~/.config/openclaw/mcp.yml
servers:
  # Primary n8n MCP Server
  n8n-enterprise:
    command: node
    args: 
      - "/opt/n8n-mcp-server/dist/index.js"
    env:
      N8N_HOST: "https://n8n.company.internal"
      N8N_API_KEY: "${N8N_API_KEY}"
      LOG_LEVEL: "info"
    disabled: false
    autoApprove: []  # Require approval for all actions
    
  # Development n8n Instance
  n8n-dev:
    command: node
    args:
      - "/opt/n8n-mcp-server/dist/index.js"
    env:
      N8N_HOST: "https://n8n-dev.company.internal"
      N8N_API_KEY: "${N8N_DEV_API_KEY}"
      LOG_LEVEL: "debug"
    disabled: false
    autoApprove:
      - "list_workflows"  # Safe to auto-approve
      - "get_workflow_status"

  # External Composio (for additional tools)
  composio:
    url: "https://connect.composio.dev/mcp"
    headers:
      Authorization: "Bearer ${COMPOSIO_API_KEY}"
    disabled: false

# ~/.config/openclaw/.env
# Production n8n
N8N_HOST=https://n8n.company.internal
N8N_API_KEY=n8n_api_xxxxx

# Development n8n
N8N_DEV_API_KEY=n8n_api_yyyyy

# Composio
COMPOSIO_API_KEY=composio_zzzzz

# Logging
LOG_LEVEL=info

# Verify MCP servers are loaded
openclaw mcp status

# Expected output:
# ┌─────────────────┬─────────┬────────────┬─────────────────────────┐
# │ Server          │ Status  │ Tools      │ Last Health Check       │
# ├─────────────────┼─────────┼────────────┼─────────────────────────┤
# │ n8n-enterprise  │ ● ready │ 12 tools   │ 2026-05-27 09:30:15 UTC │
# │ n8n-dev         │ ● ready │ 8 tools    │ 2026-05-27 09:30:15 UTC │
# │ composio        │ ● ready │ 156 tools  │ 2026-05-27 09:30:14 UTC │
# └─────────────────┴─────────┴────────────┴─────────────────────────┘

# Test tool invocation
openclaw mcp test n8n-enterprise list_workflows

┌─────────────────────────────────────────────────────────────────┐
│              CUSTOMER SUPPORT AUTOMATION                        │
├─────────────────────────────────────────────────────────────────┤
│                                                                   │
│  1. Customer Message (WhatsApp)                                   │
│     "Hi, I was charged twice for order #12345"                    │
│                          │                                        │
│                          ▼                                        │
│  2. OpenClaw Analysis                                             │
│     • Intent: billing_issue                                       │
│     • Entities: order_id=12345, issue=duplicate_charge            │
│     • Sentiment: concerned                                        │
│     • Priority: high (billing)                                    │
│                          │                                        │
│                          ▼                                        │
│  3. MCP Tool Invocation                                           │
│     ┌─────────────────────────────────────────────────────────┐   │
│     │ Tool: lookup_order                                    │   │
│     │ Params: { order_id: "12345" }                         │   │
│     └─────────────────────────────────────────────────────────┘   │
│                          │                                        │
│                          ▼                                        │
│  4. n8n Workflow Execution                                        │
│     ┌─────────────────────────────────────────────────────────┐   │
│     │ • Query Shopify for order details                       │   │
│     │ • Check Stripe for payment records                      │   │
│     │ • Verify duplicate charge                               │   │
│     │ • Create Zendesk ticket                                 │   │
│     │ • Calculate refund amount                               │   │
│     └─────────────────────────────────────────────────────────┘   │
│                          │                                        │
│                          ▼                                        │
│  5. OpenClaw Response                                               │
│     "I found your order #12345. You were indeed charged twice    │
│      ($89.99 x 2). I've created ticket #Z-4567 and initiated     │
│      a refund for the duplicate charge. You should see the       │
│      refund in 3-5 business days. Is there anything else I      │
│      can help you with?"                                          │
│                                                                   │
└─────────────────────────────────────────────────────────────────┘

{
  "name": "Customer Support - Billing Issues",
  "nodes": [
    {
      "type": "n8n-nodes-base.webhook",
      "name": "MCP Trigger",
      "webhookId": "billing-support"
    },
    {
      "type": "n8n-nodes-base.shopify",
      "name": "Get Order",
      "operation": "get"
    },
    {
      "type": "n8n-nodes-base.stripe",
      "name": "Check Payments",
      "operation": "getAllCharges"
    },
    {
      "type": "n8n-nodes-base.zendesk",
      "name": "Create Ticket",
      "operation": "create"
    },
    {
      "type": "n8n-nodes-base.if",
      "name": "Duplicate Found?"
    },
    {
      "type": "n8n-nodes-base.stripe",
      "name": "Process Refund",
      "operation": "refund"
    }
  ],
  "tags": ["mcp", "customer-support", "billing"]
}

┌─────────────────────────────────────────────────────────────────┐
│              SALES INTELLIGENCE WORKFLOW                        │
├─────────────────────────────────────────────────────────────────┤
│                                                                   │
│  Slack Message:                                                   │
│  "Talking to Acme Corp next week, anyone know them?"             │
│                                                                   │
│  OpenClaw Actions:                                                │
│  1. Parse: prospect="Acme Corp"                                   │
│  2. Invoke MCP tools:                                             │
│     • enrich_company_data                                         │
│     • find_similar_customers                                      │
│     • get_competitive_intel                                       │
│     • check_existing_opportunity                                  │
│                                                                   │
│  n8n Parallel Execution:                                          │
│  ┌─────────────────┐ ┌─────────────────┐ ┌──────────────────┐     │
│  │ Clearbit API    │ │ LinkedIn        │ │ Salesforce       │     │
│  │ • Company size  │ │ • Key contacts  │ │ • Opp history    │     │
│  │ • Industry      │ │ • Mutual conns  │ │ • Similar wins   │     │
│  │ • Technologies  │ │ • Recent posts  │ │ • Win rate     │     │
│  └─────────────────┘ └─────────────────┘ └──────────────────┘     │
│                                                                   │
│  OpenClaw Response (Slack):                                       │
│  ┌─────────────────────────────────────────────────────────────┐│
│  │ 🎯 Acme Corp Intelligence Report                           ││
│  │                                                              ││
│  │ **Company**: 500 employees, Series C, SaaS/FinTech          ││
│  │ **Tech Stack**: AWS, Salesforce, Segment, Zendesk          ││
│  │ **Similar Wins**: TechCorp (closed $250K), InnovateLtd      ││
│  │                                                              ││
│  │ **Key Contacts**:                                             ││
│  │ • Sarah Chen (CTO) - Former colleague of ours!              ││
│  │ • Mike Ross (VP Sales) - Posted about automation needs     ││
│  │                                                              ││
│  │ **Opportunity**: $150K ARR potential, 85% win rate for      ││
│  │ similar profiles. No existing opp in Salesforce.            ││
│  │                                                              ││
│  │ [View Full Report] [Create Opportunity] [Schedule Meeting] ││
│  └─────────────────────────────────────────────────────────────┘│
│                                                                   │
└─────────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────────┐
│              DEVOPS AUTOMATION WITH APPROVAL                      │
├─────────────────────────────────────────────────────────────────┤
│                                                                   │
│  Developer (Discord):                                             │
│  "@Claw deploy hotfix for payment bug to production"             │
│                                                                   │
│  OpenClaw Processing:                                             │
│  1. Intent Analysis: deploy_hotfix                              │
│  2. Context Gathering:                                            │
│     • Current branch: hotfix/payment-gateway-fix                  │
│     • Last commit: 2 hours ago                                    │
│     • CI status: ✅ passed                                        │
│     • Tests: ✅ 247/247 passed                                    │
│                                                                   │
│  3. Risk Assessment: HIGH (production deployment)                │
│                                                                   │
│  4. Approval Request (Slack #deployments):                        │
│     ┌─────────────────────────────────────────────────────────┐   │
│     │ 🚀 Production Hotfix Deployment Request                 │   │
│     │                                                          │   │
│     │ Branch: hotfix/payment-gateway-fix                      │   │
│     │ Commit: abc1234 - Fix critical payment processing bug   │   │
│     │ Tests: ✅ All passing                                   │   │
│     │ Rollback: Ready (previous image: prod-v2.3.1)          │   │
│     │                                                          │   │
│     │ Requested by: @developer via OpenClaw                   │   │
│     │                                                          │   │
│     │ [Approve] [Reject] [Schedule for 2AM]                   │   │
│     └─────────────────────────────────────────────────────────┘   │
│                                                                   │
│  5. On Approval → n8n Workflow:                                   │
│     • Tag release: v2.3.2-hotfix                                  │
│     • Build Docker image                                          │
│     • Push to registry                                            │
│     • Update Kubernetes deployment                                  │
│     • Run smoke tests                                             │
│     • Notify #general channel                                     │
│     • Update status page                                          │
│                                                                   │
│  6. OpenClaw Confirmation:                                        │
│     "✅ Hotfix deployed successfully to production (v2.3.2).      │
│      Smoke tests passing. Deployment log: [link]"                 │
│                                                                   │
└─────────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────────┐
│              CONTENT DISTRIBUTION AUTOMATION                      │
├─────────────────────────────────────────────────────────────────┤
│                                                                   │
│  Content Manager (Telegram):                                      │
│  "Publish the blog post about MCP integration to all channels    │
│   and schedule social media for next week"                       │
│                                                                   │
│  OpenClaw Actions:                                                │
│  1. Identify content: "blog post about MCP integration"          │
│     → Found: draft-mcp-openclaw-guide.md                          │
│                                                                   │
│  2. Content Enhancement:                                          │
│     • Generate SEO metadata                                       │
│     • Create social media snippets                                │
│     • Design featured image (via DALL-E)                          │
│     • Extract key quotes for Twitter/X threads                    │
│                                                                   │
│  3. MCP Tool Invocations:                                         │
│     ┌──────────────────────────────────────────────────────────┐  │
│     │ publish_to_cms                                           │  │
│     │  ├── WordPress: blog.tropical-media.work               │  │
│     │  ├── Medium: @tropicalmedia                            │  │
│     │  └── Dev.to: @tropicalmedia                           │  │
│     ├──────────────────────────────────────────────────────────┤  │
│     │ schedule_social_posts                                    │  │
│     │  ├── Twitter: 5 posts over next week                     │  │
│     │  ├── LinkedIn: 2 posts (Monday, Thursday)               │  │
│     │  └── HackerNews: Submit Thursday 9AM EST               │  │
│     ├──────────────────────────────────────────────────────────┤  │
│     │ notify_team                                              │  │
│     │  ├── Slack #content: "Published: MCP Guide"            │  │
│     │  ├── Email newsletter: Schedule for tomorrow              │  │
│     │  └── Analytics: Track performance                       │  │
│     └──────────────────────────────────────────────────────────┘  │
│                                                                   │
│  4. Result Summary:                                               │
│     "✅ Published to 3 CMS platforms                                │
│      ✅ Scheduled 7 social media posts (May 28 - June 3)         │
│      ✅ Newsletter queued for tomorrow                             │
│      ✅ Analytics tracking enabled                                 │
│      📊 Dashboard: [link]"                                        │
│                                                                   │
└─────────────────────────────────────────────────────────────────┘

// Secure credential storage with rotation
interface CredentialManager {
  // Store encrypted credentials
  store(key: string, value: string, metadata: CredentialMetadata): Promise<void>;
  
  // Retrieve with audit logging
  retrieve(key: string, requestContext: RequestContext): Promise<string>;
  
  // Automatic rotation
  rotate(key: string): Promise<void>;
  
  // Revocation
  revoke(key: string): Promise<void>;
}

// Implementation using HashiCorp Vault
class VaultCredentialManager implements CredentialManager {
  async store(key: string, value: string, metadata: CredentialMetadata) {
    await vault.kv.v2.createOrUpdateSecret({
      path: `n8n-mcp/${key}`,
      secret: { value },
      metadata: {
        rotation_schedule: metadata.rotationSchedule,
        last_rotated: new Date().toISOString(),
        created_by: metadata.createdBy,
      },
    });
  }
}

# Permission matrix
permissions:
  # Read-only operations
  viewer:
    tools:
      - list_workflows
      - get_workflow_status
      - search_executions
    resources:
      - "execution-history://*"
      
  # Standard user operations
  operator:
    extends: viewer
    tools:
      - execute_workflow
    workflows:
      - "*"
    exclude_workflows:
      - "production-deployments"
      - "finance-reports"
      
  # Administrative operations
  admin:
    tools:
      - "*"
    workflows:
      - "*"
    resources:
      - "*"

// Input sanitization and validation
class RequestValidator {
  private maxPayloadSize = 10 * 1024 * 1024; // 10MB
  private allowedCharacters = /^[\w\s\-\.\@\+\=\{\}\[\]\:\"\'\,]+$/;

  validate(request: ToolRequest): ValidationResult {
    const errors: string[] = [];

    // Size check
    const payloadSize = JSON.stringify(request.arguments).length;
    if (payloadSize > this.maxPayloadSize) {
      errors.push(`Payload exceeds maximum size (${this.maxPayloadSize} bytes)`);
    }

    // Character validation
    for (const [key, value] of Object.entries(request.arguments)) {
      if (typeof value === "string" && !this.allowedCharacters.test(value)) {
        errors.push(`Invalid characters in parameter: ${key}`);
      }
    }

    // SQL injection prevention
    if (this.containsSQLInjection(request.arguments)) {
      errors.push("Potential SQL injection detected");
    }

    // Command injection prevention
    if (this.containsCommandInjection(request.arguments)) {
      errors.push("Potential command injection detected");
    }

    return {
      valid: errors.length === 0,
      errors,
    };
  }

  private containsSQLInjection(args: any): boolean {
    const sqlPatterns = [
      /(\b(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER)\b)/i,
      /(\b(UNION|JOIN|WHERE|HAVING|ORDER|GROUP)\b)/i,
      /(--|#|\/\*|\*\/)/,
    ];
    
    const stringified = JSON.stringify(args);
    return sqlPatterns.some((pattern) => pattern.test(stringified));
  }

  private containsCommandInjection(args: any): boolean {
    const cmdPatterns = [
      /[;&|`$()]/,
      /(\b(rm|chmod|sudo|curl|wget|nc|python|bash|sh)\b)/i,
    ];
    
    const stringified = JSON.stringify(args);
    return cmdPatterns.some((pattern) => pattern.test(stringified));
  }
}

interface AuditEvent {
  timestamp: string;
  eventType: "tool_invocation" | "tool_result" | "error" | "approval";
  serverName: string;
  toolName: string;
  userId: string;
  sessionId: string;
  requestId: string;
  arguments: any;
  result?: any;
  error?: string;
  durationMs: number;
  clientInfo: {
    ip: string;
    userAgent: string;
  };
}

class AuditLogger {
  async log(event: AuditEvent) {
    // Write to immutable log store
    await this.writeToLogStore(event);
    
    // Real-time alerting for anomalies
    if (this.isAnomalous(event)) {
      await this.sendSecurityAlert(event);
    }
    
    // SIEM integration
    await this.forwardToSIEM(event);
    
    // Compliance export
    await this.updateComplianceIndex(event);
  }

  private isAnomalous(event: AuditEvent): boolean {
    // Detect unusual patterns
    const rules = [
      // High-frequency invocations
      () => this.checkRateAnomaly(event),
      // Sensitive workflow access
      () => this.checkSensitiveAccess(event),
      // Off-hours activity
      () => this.checkTimeAnomaly(event),
      // Failed authentication patterns
      () => this.checkAuthFailures(event),
    ];
    
    return rules.some((rule) => rule());
  }
}

# mcp.yml with TLS configuration
servers:
  n8n-enterprise:
    command: node
    args: ["/opt/n8n-mcp-server/dist/index.js"]
    env:
      N8N_HOST: "https://n8n.company.internal"
      N8N_API_KEY: "${N8N_API_KEY}"
      # TLS Configuration
      NODE_TLS_REJECT_UNAUTHORIZED: "1"
      CA_CERT_PATH: "/etc/ssl/certs/ca.crt"
      
    # Network restrictions
    network:
      allowedHosts:
        - "n8n.company.internal"
        - "n8n-dev.company.internal"
      deniedHosts:
        - "*.external-service.com"
      maxConnections: 100
      connectionTimeout: 30000

┌─────────────────────────────────────────────────────────────────┐
│                    PRODUCTION DEPLOYMENT                        │
├─────────────────────────────────────────────────────────────────┤
│                                                                   │
│   ┌─────────────────────────────────────────────────────────┐   │
│   │                   Load Balancer                          │   │
│   │              (nginx / HAProxy / Traefik)                 │   │
│   └─────────────────────────┬───────────────────────────────┘   │
│                             │                                     │
│           ┌─────────────────┼─────────────────┐                   │
│           │                 │                 │                   │
│   ┌───────▼──────┐  ┌──────▼──────┐  ┌───────▼──────┐           │
│   │  OpenClaw    │  │  OpenClaw   │  │  OpenClaw    │           │
│   │  Gateway #1  │  │  Gateway #2 │  │  Gateway #3  │           │
│   │              │  │             │  │              │           │
│   │  Container   │  │  Container  │  │  Container   │           │
│   └───────┬──────┘  └──────┬──────┘  └───────┬──────┘           │
│           │                │                 │                   │
│           └────────────────┼─────────────────┘                   │
│                            │                                      │
│   ┌────────────────────────▼──────────────────────────┐           │
│   │              Redis Cluster                        │           │
│   │         (Session State / Message Queue)         │           │
│   └────────────────────────┬──────────────────────────┘           │
│                          │                                       │
│   ┌──────────────────────▼────────────────────────────┐          │
│   │           MCP Server Pool                         │          │
│   │  ┌──────────────┐  ┌──────────────┐             │          │
│   │  │ MCP Server   │  │ MCP Server   │             │          │
│   │  │ Instance #1  │  │ Instance #2  │  ...        │          │
│   │  └──────────────┘  └──────────────┘             │          │
│   └──────────────────────┬────────────────────────────┘          │
│                          │                                       │
│   ┌──────────────────────▼────────────────────────────┐          │
│   │              n8n Cluster                          │          │
│   │  ┌──────────────┐  ┌──────────────┐              │          │
│   │  │ n8n Worker   │  │ n8n Worker   │              │          │
│   │  │ Instance #1  │  │ Instance #2  │  ...         │          │
│   │  └──────────────┘  └──────────────┘              │          │
│   └───────────────────────────────────────────────────┘          │
│                                                                   │
│   Supporting Infrastructure:                                      │
│   • PostgreSQL (n8n persistence)                                 │
│   • Prometheus + Grafana (monitoring)                            │
│   • Vault (secrets management)                                   │
│   • ELK Stack (log aggregation)                                  │
│                                                                   │
└─────────────────────────────────────────────────────────────────┘

# docker-compose.yml
version: "3.8"

services:
  # OpenClaw Gateway
  openclaw:
    image: openclaw/openclaw:latest
    container_name: openclaw-gateway
    restart: unless-stopped
    environment:
      - OPENCLAW_CONFIG_PATH=/config
      - N8N_API_KEY=${N8N_API_KEY}
      - REDIS_URL=redis://redis:6379
    volumes:
      - ./config:/config:ro
      - openclaw-data:/data
    depends_on:
      - redis
    networks:
      - openclaw-network
    deploy:
      replicas: 3
      resources:
        limits:
          cpus: "2"
          memory: 4G

  # MCP Server
  n8n-mcp-server:
    image: company/n8n-mcp-server:latest
    container_name: n8n-mcp
    restart: unless-stopped
    environment:
      - N8N_HOST=${N8N_HOST}
      - N8N_API_KEY=${N8N_API_KEY}
      - LOG_LEVEL=info
    networks:
      - openclaw-network
      - n8n-network
    deploy:
      replicas: 2
      resources:
        limits:
          cpus: "1"
          memory: 2G

  # Redis for session state
  redis:
    image: redis:7-alpine
    container_name: openclaw-redis
    restart: unless-stopped
    volumes:
      - redis-data:/data
    networks:
      - openclaw-network
    command: redis-server --appendonly yes --maxmemory 2gb --maxmemory-policy allkeys-lru

  # n8n (simplified - assumes external cluster or compose)
  n8n:
    image: n8nio/n8n:latest
    container_name: n8n
    restart: unless-stopped
    environment:
      - N8N_BASIC_AUTH_ACTIVE=true
      - N8N_BASIC_AUTH_USER=${N8N_USER}
      - N8N_BASIC_AUTH_PASSWORD=${N8N_PASSWORD}
      - DB_TYPE=postgresdb
      - DB_POSTGRESDB_HOST=postgres
      - DB_POSTGRESDB_DATABASE=n8n
      - DB_POSTGRESDB_USER=n8n
      - DB_POSTGRESDB_PASSWORD=${POSTGRES_PASSWORD}
      - WEBHOOK_URL=${WEBHOOK_URL}
    volumes:
      - n8n-data:/home/node/.n8n
    depends_on:
      - postgres
    networks:
      - n8n-network

  # PostgreSQL for n8n
  postgres:
    image: postgres:15-alpine
    container_name: n8n-postgres
    restart: unless-stopped
    environment:
      - POSTGRES_USER=n8n
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=n8n
    volumes:
      - postgres-data:/var/lib/postgresql/data
    networks:
      - n8n-network

  # Monitoring
  prometheus:
    image: prom/prometheus:latest
    container_name: openclaw-prometheus
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus-data:/prometheus
    networks:
      - openclaw-network

  grafana:
    image: grafana/grafana:latest
    container_name: openclaw-grafana
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_PASSWORD}
    volumes:
      - grafana-data:/var/lib/grafana
      - ./grafana/dashboards:/etc/grafana/provisioning/dashboards:ro
    networks:
      - openclaw-network

networks:
  openclaw-network:
    driver: bridge
  n8n-network:
    driver: bridge

volumes:
  openclaw-data:
  redis-data:
  n8n-data:
  postgres-data:
  prometheus-data:
  grafana-data:

# k8s/openclaw-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: openclaw-gateway
  namespace: automation
spec:
  replicas: 3
  selector:
    matchLabels:
      app: openclaw
  template:
    metadata:
      labels:
        app: openclaw
    spec:
      containers:
        - name: openclaw
          image: openclaw/openclaw:latest
          resources:
            requests:
              memory: "2Gi"
              cpu: "1000m"
            limits:
              memory: "4Gi"
              cpu: "2000m"
          env:
            - name: N8N_API_KEY
              valueFrom:
                secretKeyRef:
                  name: openclaw-secrets
                  key: n8n-api-key
            - name: REDIS_URL
              value: "redis://redis:6379"
          volumeMounts:
            - name: config
              mountPath: /config
              readOnly: true
            - name: data
              mountPath: /data
      volumes:
        - name: config
          configMap:
            name: openclaw-config
        - name: data
          persistentVolumeClaim:
            claimName: openclaw-data
---
apiVersion: v1
kind: Service
metadata:
  name: openclaw
  namespace: automation
spec:
  selector:
    app: openclaw
  ports:
    - port: 3000
      targetPort: 3000
  type: ClusterIP
---
# Horizontal Pod Autoscaler
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: openclaw-hpa
  namespace: automation
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: openclaw-gateway
  minReplicas: 3
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
    - type: Resource
      resource:
        name: memory
        target:
          type: Utilization
          averageUtilization: 80

# k8s/n8n-mcp-server.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: n8n-mcp-server
  namespace: automation
spec:
  replicas: 2
  selector:
    matchLabels:
      app: n8n-mcp
  template:
    metadata:
      labels:
        app: n8n-mcp
    spec:
      containers:
        - name: mcp-server
          image: company/n8n-mcp-server:latest
          resources:
            requests:
              memory: "1Gi"
              cpu: "500m"
            limits:
              memory: "2Gi"
              cpu: "1000m"
          env:
            - name: N8N_HOST
              value: "https://n8n.internal"
            - name: N8N_API_KEY
              valueFrom:
                secretKeyRef:
                  name: n8n-mcp-secrets
                  key: api-key
          livenessProbe:
            exec:
              command:
                - node
                - -e
                - "require('http').get('http://localhost:3000/health', (r) => r.statusCode === 200 ? process.exit(0) : process.exit(1))"
            initialDelaySeconds: 30
            periodSeconds: 10
          readinessProbe:
            exec:
              command:
                - node
                - -e
                - "require('http').get('http://localhost:3000/ready', (r) => r.statusCode === 200 ? process.exit(0) : process.exit(1))"
            initialDelaySeconds: 5
            periodSeconds: 5

// Prometheus metrics
import { Counter, Histogram, Gauge } from "prom-client";

const mcpMetrics = {
  // Tool invocation metrics
  toolInvocations: new Counter({
    name: "mcp_tool_invocations_total",
    help: "Total number of tool invocations",
    labelNames: ["server", "tool", "status"],
  }),

  // Execution duration
  executionDuration: new Histogram({
    name: "mcp_execution_duration_seconds",
    help: "Duration of tool executions",
    labelNames: ["server", "tool"],
    buckets: [0.1, 0.5, 1, 2, 5, 10, 30, 60],
  }),

  // Active connections
  activeConnections: new Gauge({
    name: "mcp_active_connections",
    help: "Number of active MCP connections",
    labelNames: ["server"],
  }),

  // Tool discovery metrics
  toolDiscoveryTime: new Histogram({
    name: "mcp_tool_discovery_duration_seconds",
    help: "Time to discover available tools",
    labelNames: ["server"],
  }),

  // Error rates
  errorRate: new Counter({
    name: "mcp_errors_total",
    help: "Total number of MCP errors",
    labelNames: ["server", "error_type"],
  }),
};

const n8nMetrics = {
  // Workflow execution
  workflowExecutions: new Counter({
    name: "n8n_workflow_executions_total",
    help: "Total n8n workflow executions",
    labelNames: ["workflow", "status", "trigger"],
  }),

  // Execution duration
  workflowDuration: new Histogram({
    name: "n8n_workflow_duration_seconds",
    help: "Duration of workflow executions",
    labelNames: ["workflow"],
  }),

  // Queue depth
  queueDepth: new Gauge({
    name: "n8n_queue_depth",
    help: "Number of pending executions",
  }),

  // API latency
  apiLatency: new Histogram({
    name: "n8n_api_latency_seconds",
    help: "n8n API response latency",
    labelNames: ["endpoint", "method"],
  }),
};

// Health check endpoint
interface HealthStatus {
  status: "healthy" | "degraded" | "unhealthy";
  checks: {
    mcpConnection: ComponentHealth;
    n8nApi: ComponentHealth;
    database: ComponentHealth;
    memory: ComponentHealth;
  };
  timestamp: string;
}

class HealthChecker {
  async check(): Promise<HealthStatus> {
    const checks = await Promise.all([
      this.checkMcpConnection(),
      this.checkN8nApi(),
      this.checkDatabase(),
      this.checkMemory(),
    ]);

    const overallStatus = this.determineOverallStatus(checks);

    return {
      status: overallStatus,
      checks: {
        mcpConnection: checks[0],
        n8nApi: checks[1],
        database: checks[2],
        memory: checks[3],
      },
      timestamp: new Date().toISOString(),
    };
  }

  private async checkMcpConnection(): Promise<ComponentHealth> {
    try {
      const start = Date.now();
      await this.mcpClient.ping();
      const latency = Date.now() - start;

      return {
        status: latency < 1000 ? "healthy" : "degraded",
        latency: `${latency}ms`,
        message: "MCP connection active",
      };
    } catch (error) {
      return {
        status: "unhealthy",
        message: `MCP connection failed: ${error.message}`,
      };
    }
  }

  private determineOverallStatus(checks: ComponentHealth[]): HealthStatus["status"] {
    if (checks.every((c) => c.status === "healthy")) return "healthy";
    if (checks.some((c) => c.status === "unhealthy")) return "unhealthy";
    return "degraded";
  }
}

# prometheus/alerts.yml
groups:
  - name: mcp_alerts
    rules:
      - alert: MCPHighErrorRate
        expr: rate(mcp_errors_total[5m]) > 0.1
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "High MCP error rate"
          description: "Error rate is {{ $value }} errors/sec for {{ $labels.server }}"

      - alert: MCPHighLatency
        expr: histogram_quantile(0.95, rate(mcp_execution_duration_seconds_bucket[5m])) > 30
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "High MCP execution latency"
          description: "95th percentile latency is {{ $value }}s"

      - alert: N8NQueueBacklog
        expr: n8n_queue_depth > 100
        for: 10m
        labels:
          severity: warning
        annotations:
          summary: "n8n execution queue backlog"
          description: "Queue depth is {{ $value }} executions"

      - alert: MCPConnectionLoss
        expr: mcp_active_connections == 0
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "MCP connection lost"
          description: "No active MCP connections"

// Multi-layer caching
interface CacheStrategy {
  // In-memory cache for hot data
  l1: LRUCache<string, any>;
  
  // Redis for distributed cache
  l2: Redis;
  
  // Persistent cache for tool definitions
  l3: DatabaseCache;
}

class ToolCache {
  private l1: LRUCache<string, ToolDefinition>;
  private l2: Redis;

  constructor() {
    this.l1 = new LRUCache({
      max: 1000,
      ttl: 1000 * 60 * 5, // 5 minutes
    });
    this.l2 = new Redis(process.env.REDIS_URL);
  }

  async getToolDefinition(server: string, tool: string): Promise<ToolDefinition | null> {
    const key = `tool:${server}:${tool}`;
    
    // L1: Memory cache
    const l1Value = this.l1.get(key);
    if (l1Value) return l1Value;

    // L2: Redis cache
    const l2Value = await this.l2.get(key);
    if (l2Value) {
      const parsed = JSON.parse(l2Value);
      this.l1.set(key, parsed);
      return parsed;
    }

    return null;
  }

  async setToolDefinition(
    server: string,
    tool: string,
    definition: ToolDefinition
  ): Promise<void> {
    const key = `tool:${server}:${tool}`;
    const value = JSON.stringify(definition);

    // Update both caches
    this.l1.set(key, definition);
    await this.l2.setex(key, 3600, value); // 1 hour TTL
  }
}

// HTTP connection pool for n8n API
class N8nConnectionPool {
  private agent: Agent;
  private maxSockets: number;
  private maxFreeSockets: number;
  private timeout: number;

  constructor(config: PoolConfig) {
    this.maxSockets = config.maxSockets || 50;
    this.maxFreeSockets = config.maxFreeSockets || 10;
    this.timeout = config.timeout || 30000;

    this.agent = new Agent({
      keepAlive: true,
      maxSockets: this.maxSockets,
      maxFreeSockets: this.maxFreeSockets,
      timeout: this.timeout,
      freeSocketTimeout: 30000,
    });
  }

  async request(url: string, options: RequestInit): Promise<Response> {
    return fetch(url, {
      ...options,
      agent: this.agent,
    });
  }

  getStats(): PoolStats {
    return {
      activeConnections: this.agent.activeConnections,
      idleConnections: this.agent.idleConnections,
      pendingRequests: this.agent.pendingRequests,
    };
  }
}

// Batch multiple tool calls
class BatchProcessor {
  private queue: QueuedRequest[] = [];
  private batchSize: number;
  private flushInterval: number;
  private timer: NodeJS.Timeout | null = null;

  constructor(config: BatchConfig) {
    this.batchSize = config.batchSize || 10;
    this.flushInterval = config.flushInterval || 100;
  }

  async enqueue(request: ToolRequest): Promise<ToolResult> {
    return new Promise((resolve, reject) => {
      this.queue.push({ request, resolve, reject });

      if (this.queue.length >= this.batchSize) {
        this.flush();
      } else if (!this.timer) {
        this.timer = setTimeout(() => this.flush(), this.flushInterval);
      }
    });
  }

  private async flush(): Promise<void> {
    if (this.queue.length === 0) return;

    const batch = this.queue.splice(0, this.batchSize);
    
    if (this.timer) {
      clearTimeout(this.timer);
      this.timer = null;
    }

    try {
      // Execute batch
      const results = await this.executeBatch(batch.map((b) => b.request));

      // Resolve individual promises
      batch.forEach((item, index) => {
        item.resolve(results[index]);
      });
    } catch (error) {
      // Reject all on batch failure
      batch.forEach((item) => item.reject(error));
    }
  }

  private async executeBatch(requests: ToolRequest[]): Promise<ToolResult[]> {
    // Parallel execution with concurrency limit
    const limit = pLimit(5);
    return Promise.all(
      requests.map((req) => limit(() => this.executeTool(req)))
    );
  }
}