SoftTech AI Registry
n8n · n8n

AI Agent tool execution

The n8n AI Agent node, used inside n8n workflows, determines which attached tool to use for a task and invokes it. Tools include integration nodes exposed as AI tools, Call n8n Workflow Tool, Custom Code Tool, HTTP Request Tool, AI Agent Tool, MCP Client Tool and search/vector-store tools. Excludes the standalone n8n Agents feature (Preview), AI Workflow Builder and the instance-level n8n MCP server.

Recorded characteristics

Function
n8n documents the AI Agent node as able to "understand the capabilities of different tools and determine which tool to use depending on the task"; at least one tool sub-node must be connected. The Tools Agent implements LangChain's tool-calling interface, describing available tools and their schemas to the model. n8n distinguishes the Agent node, which "makes decisions about what tools to use", from the Basic LLM Chain, which "doesn't support memory or tools". Agent-type consolidation: the agent-type setting is deprecated from n8n 1.82.0 and all AI Agent nodes now work as a Tools Agent; the Conversational, OpenAI Functions, Plan and Execute, ReAct and SQL agent types are labelled deprecated; the v1 node with the type setting will be removed in n8n 3.0. This is recorded as one capability. Tool surface: built-in integration nodes and a registry of MCP servers connected as tools, Call n8n Workflow Tool ("load any n8n workflow as a tool"), Custom Code Tool, HTTP Request Tool, AI Agent Tool (a root agent calls other agents as tools), MCP Client Tool (AI Agent -> external MCP server), and search/vector-store tools. Call n8n Workflow Tool: the agent can select it, inputs may be model-defined via $fromAI(), and operations in the called workflow use that workflow's own node credentials and configuration. AI-selected parameters: $fromAI() ("Let the model define this parameter") lets the model fill selected tool parameters; it is only available for tools connected to the AI Agent node and does not work with the Code tool. The builder decides which tools are attached, which parameters are model-defined and which remain fixed. Not every tool changes state; many retrieve or compute. The full reasoning-loop detail is not explicitly documented for the workflow-node runtime.
Data access
Determined by the tools and credentials attached by the workflow builder (integration nodes, HTTP requests, sub-workflows, MCP servers, vector stores). No data scope beyond configured tools is attributed.
Actions
Can take actions
External actions
Yes
Human confirmation
Conditional
Permission basis
Separate permissions
Administrative control
Human review for tools: the builder adds a Human review step in the AI Agent's Tools Panel and selects an approval channel (documented: Slack, Discord, Telegram, Microsoft Teams, Gmail, WhatsApp Business Cloud, Google Chat, Microsoft Outlook, n8n Chat). Review can apply to all tools connected to an AI Agent or to selected individual tools. When the agent decides to use a reviewed tool, the workflow pauses before execution and sends a request showing which tool the AI wants to use and with what parameters. Approve: the tool executes with the AI-specified input. Deny: the action is canceled and does not run, and the AI is informed of the rejection. Tools without review execute automatically. Human fallback (routing to a human when the AI cannot answer) is a separate pattern and is not pre-execution approval. Credential and sharing controls: tools use credentials configured in n8n and attached to the node by the builder; credentials can be shared with users or projects (users of a shared credential cannot view or edit its details); workflow sharing allows editors to use all credentials used in the workflow, including credentials not explicitly shared with them. Triggers: the node runs within workflows started by chat, webhook, schedule, application events or other workflows; trigger differences are kept within this capability.
Default state
Conditional
Availability
Actions require configuration: creating a workflow, adding the AI Agent node, configuring a chat model and its credential, attaching tools with their credentials and descriptions, optionally exposing parameters via $fromAI(), adding a trigger, publishing/activating the workflow, and optionally adding human review. Access to n8n does not give an AI Agent authority to act. The AI Agent node is current; no Preview label applies to it. The standalone n8n Agents feature is in Preview and excluded. No GA date is recorded.
Licensing
No separate AI Agent SKU is recorded. Credential sharing is available on n8n Cloud (all plans) and self-hosted Business and Enterprise. Plan details are not inferred beyond the documentation.
External model or provider
No single model or provider. The AI Agent uses a customer-selected chat model sub-node from multiple providers (for example OpenAI, Anthropic, Azure OpenAI, Groq, Mistral). The AI Agent Tool documents an optional fallback model used if the primary model fails or is unavailable.
Limitations and uncertainty
Permission basis is recorded as separate_permissions: AI Agent tools execute using credentials stored/configured in n8n and attached to the relevant tool or workflow node by the workflow builder. These credentials may belong to or be shared by different users/projects; sharing a credential does not by itself make the record mixed. Invoking-user passthrough is not established (not user_permissions); the agent has no established external identity of its own (not dedicated_agent_identity); multiple authentication methods do not make it mixed. Unresolved: no single reproduced worked example of a specific AI Agent-node external write (classification rests on n8n's documented action classes: sending messages, modifying records, deleting data, external communications, purchases); full reasoning-loop detail is not explicit for the workflow-node runtime; human-review behaviour across every unattended trigger is not established; end-user credential behaviour with AI Agent tools is not established; Chat Hub Personal Agent tool behaviour is not established; standalone n8n Agents (Preview) are excluded and kept as a future candidate; the instance-level n8n MCP server (external client -> n8n workflow) is excluded and kept as a possible future candidate; AI Workflow Builder is design-time and excluded; no GA date established.

Evidence