We host on Hostinger — get up to 20% off your first plan.Get the link →
Referral link · we may earn a commissionReferral link — we may earn a commission at no extra cost to you.Download a working automation JSON
Can AI answer engines cite your site?
Outreach scripts that get replies
Find the 3 workflows costing you sleep
200+ prompts, ready to ship
12-month posting plan in 60 sec
Brand voice doc in 4 steps
Runway / Pika / Sora / Veo formats
Paste any n8n workflow JSON and get a rendered node graph plus a 20-point health check — hardcoded credentials, missing retry-on-fail, orphan nodes, unauthenticated webhooks, and more. Every finding cites the exact JSON path it came from.
Nothing is uploaded — parsing, the graph render, and the checklist all run in your browser. Updated August 2026.
Nothing is uploaded anywhere — parsing happens entirely in your browser.
How it works
In n8n, open the workflow and use the three-dot menu → Download, or select all nodes and copy — either gives you the raw workflow JSON.
Paste the JSON into the text area above (or click 'Load sample workflow' to see it work on a demo first).
Nodes render as colored boxes positioned from their real canvas coordinates, connected by the actual connection graph — trigger nodes in green, HTTP/API calls in terracotta, Code nodes in ink, logic nodes in violet.
Each finding is severity-tagged (critical / warning / info) and cites the JSON path it came from, so you can jump straight to the node and parameter that needs fixing.
What gets checked
Most n8n workflows I get called in to fix aren't broken — they're working exactly as built, which is the problem. A hardcoded API key sitting in a parameter field, a webhook with no authentication that anyone on the internet can POST to, an HTTP node with no retry that quietly drops a lead every time the target API hiccups for half a second. None of that shows up until it does.
This linter runs the same checklist I go through manually on a client workflow before I'll sign off on it, condensed into 20 automated checks. It won't catch business-logic bugs — it can't know your IF condition is testing the wrong field — but it will catch the structural and security issues that are cheap to fix now and expensive to debug in production.
| Check | Default severity | Why it matters |
|---|---|---|
| Error workflow configured | Warning | No fallback when an execution fails |
| Hardcoded credentials/tokens | Critical | Secrets leak if the JSON is shared |
| Credentials embedded in URLs | Critical | Same leak risk, easy to miss |
| Webhook without authentication | Critical | Anyone with the URL can trigger it |
| Retry-on-fail on HTTP/API nodes | Warning | One flaky call kills the run |
| HTTP timeout set | Info | A hung call can stall the whole workflow |
| Orphan/disconnected nodes | Warning | Dead weight that never executes |
| Empty Code nodes | Critical | Errors or silently no-ops at runtime |
| Deprecated typeVersion | Info | Running an older node version than current |
| Single-branch IF nodes | Info | The unwired branch dead-ends silently |
10 of the 20 checks shown — the rest cover node naming, Switch fallback branches, disabled nodes, and workflow-level structure. Full list runs live in the tool above.
Waseem, building from Bali · info@skynetjoe.com · Updated August 2026
Quick answers
No. Parsing, the node graph render, and the 20-point health check all run client-side, in your browser. Nothing is sent to a server or stored — refresh the page and it's gone.
In n8n, open the workflow, use the three-dot menu → Download (exports the whole workflow as JSON), or select all nodes (Ctrl/Cmd+A) and copy (Ctrl/Cmd+C) — n8n copies the selection as JSON to your clipboard, ready to paste here.
Structural and security issues that are cheap to catch before they bite in production: no error-workflow configured, hardcoded API keys/tokens/URLs in node parameters, missing retry-on-fail on HTTP/API nodes, orphaned nodes with no connections, a Webhook node with no authentication, older typeVersions against a known-latest map, empty Code nodes, missing HTTP timeouts, generic/default node names, single-branch IF nodes, unwired Switch outputs, disabled nodes left in, and a handful of other structural sanity checks. Every finding cites the exact JSON path it came from.
No — it's a manually maintained snapshot of common node typeVersions I keep current, not a live API call to n8n's node registry. If a node type isn't in that map, this check simply skips it rather than guessing.
It flags them with the exact path and a plain-English explanation — it doesn't auto-patch your workflow. For a hands-on fix pass, book a workflow rescue call and I'll go through it live.
Yes. If position data is missing, the graph falls back to a left-to-right grid layout so you can still see the node count and connections — just without the original canvas arrangement.
A workflow rescue call gets the critical items fixed live, on a screen-share, plus a second pass on the rest.
Book a workflow rescue call