n8nac Cheat-Sheet

Source-of-truth for "what command do I run for X?" If your task matches a row, run the exact command shown — do not paraphrase, do not invent flags, do not run --help. If no row matches, fall back to n8nac-reference for the full help tree.

All commands below assume npx n8nac … and a workspace bound to an n8n instance (workspace status: bound). Replace <id>, <name>, <path> with concrete values.

Workspace & Setup

Multi-Environment (multiple n8n instances per repo)

Workflows — Local & Remote Lifecycle

Testing & Execution

Credentials (direct CRUD)

For project-aware credential lookup, use /n8n-autopilot:find-credential (default = active project, no cross-project leak). Use credential list directly only when you need raw shape.

Recipe: oAuth2Api with the client-credentials grant (machine-to-machine, no login)

The oAuth2Api schema is a nest of if/then branches and the validator demands fields from branches that do not apply to your grant — guessing costs ~6 round trips. Working body (Microsoft Graph app-only shown; same shape for any client-credentials provider):

{
  "grantType": "clientCredentials",
  "serverUrl": "",
  "accessTokenUrl": "https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token",
  "clientId": "<app-id>",
  "clientSecret": "<secret>",
  "scope": "https://graph.microsoft.com/.default",
  "authentication": "body",
  "sendAdditionalBodyProperties": false,
  "additionalBodyProperties": {},
  "jweEnabled": false
}

Run npx n8nac credential schema oAuth2Api first and use ONLY the keys it lists — the field set moves between n8n versions. Two traps:

• allowedHttpRequestDomains exists only on some n8n versions. On n8n ≥ 2.20 the schema rejects it as an additional property (HTTP 400, #89); on versions that have it, it is an enum (all / domains / none), not a boolean, and "none" passes validation and then fails at RUNTIME with "This credential is configured to prevent use within an HTTP Request node". Add it only when credential schema lists it, and then as "all" (or "domains" + a list). Since there is no update, a wrong value means delete + recreate.
• additionalBodyProperties is type json — pass {}, not "".

Client-credentials needs no Connect button and no browser: the token is fetched server-side. If a credential seems to require a login, you picked the delegated authorizationCode flow by mistake — and a delegated Graph credential only sees what its user sees (the usual cause of a 403 on tenant-wide reads).

Credentials (recipes / readiness)

Schemas, Node Info, Authoring Help

Native n8n MCP assist (ab n8nac 2.4 — read-only Broker gegen den Instanz-MCP)

Wrapper sind read-only (Discovery, Execution-Inspektion, Server-side Validation). Authoring bleibt .workflow.ts + push; Live-Tests bleiben n8nac test; Binär-Payloads NIE via MCP. Details + Test-Pfad-Evaluation: docs/MCP.md.

Telemetry

Common gotchas (always check these first)

1. Singular vs. plural credential / credentials — different parent groups. credential for raw CRUD on the active instance; credentials for recipes, inventory, starter-kits, and ensure/test against a recipe ID.
2. workspace status --json returns two shapes: bound (has activeEnvironment block) or pending (has status: "dry-run"|"migration-required"). Probe j.activeEnvironment first.
3. Multi-project visibility: credential list --json returns every credential the API key can see across ALL projects. Each cred carries shared[] with project ownership; use /n8n-autopilot:find-credential for project-scoped lookup instead of grep-piping.
4. push blocked when status is CONFLICT / MODIFIED_BOTH / DIVERGED / REMOTE_ONLY — see CLAUDE.md "Push-Gate" section. Bypass: N8N_AUTOPILOT_ALLOW_LOCAL_WINS=1.
5. resolve --mode keep-current is unconditionally blocked by the push-gate. Same bypass as above.
6. n8nac test cannot trigger schedule/manual/errorTrigger — only webhook/chat/form. For other triggers, prompt the user to "Execute Workflow" in the n8n UI (see build-workflow Path B).
7. mcpTrigger workflows require manual UI publish after every push. n8nac push writes a new draft; the previously-published MCP endpoint may diverge.
8. Archived workflows are read-only. push will reject. Unarchive in n8n UI first (no n8nac command for this).
9. Curl carve-out: /api/v1/data-tables is the only n8n public API path you may hit directly (see /n8n-autopilot:data-tables). Everything else goes through n8nac.
10. Old commands removed in n8nac >= 2.3: init, init-auth, init-project no longer exist — use setup --mode <mode>. Post-setup binding is via env add / env auth set / env use (NOT workspace pin-instance, which is also removed). workspace set-project, workspace set-sync-folder, workspace clear-*, workspace migrate, workspace migrate-v1, and instance-target are all gone — use env update <name> --project-name/--workflows-path instead.

When this cheat-sheet is not enough

Read n8nac-reference/reference.md — the full machine-generated help tree (61 command/subcommand blocks).