Automate your server management with n8n workflows. The ManageLM community node runs tasks and scans on your Linux and Windows servers, searches your whole fleet, acts on hosting resources, and starts workflows on infrastructure events.
The ManageLM n8n community node lets you build automation workflows around your server infrastructure. It includes two nodes:
Combine them with any of n8n's 400+ integrations: Slack alerts when a monitor goes down, PagerDuty incidents when agents go offline, Jira tickets when a backup or a credential rotation fails, and more.
Submit tasks with natural language instructions, answer their questions and follow up. Wait for the result up to a limit you choose.
Start security audits, inventory, access, certificate and activity scans, and read their latest results.
14 searches: agents, inventory, security issues, activity, SSH keys, sudo rules, certificates, monitors, backups, credentials, keystore and cloud resources.
Start, stop, reboot and snapshot VMs through your hosting connectors, within the actions each connector allows.
More than 30 events across every ManageLM category, with HMAC signature verification on every delivery.
An API key acts as the person who created it, limited to the authorizations they chose. Any user can create one.
Open your n8n instance
Go to Settings > Community Nodes
Click Install a community node
Enter n8n-nodes-managelm and click Install
# Inside your n8n installation directory
npm install n8n-nodes-managelm
FROM n8nio/n8n:latest RUN npm install n8n-nodes-managelm
Tip: After installation, restart n8n. The ManageLM node and trigger will appear in the node panel under the search.
The action node uses the ManageLM API credential, which requires two fields:
| Field | Description |
|---|---|
| Portal URL | Base URL of your ManageLM portal (e.g. https://app.managelm.com). Self-hosted users: use your own URL. |
| API Key | API key from Settings > MCP & API in the portal (mlm_ak_...) |
In the ManageLM portal, go to Settings > MCP & API > API Keys
Create a key and tick the authorizations your workflows need: for example Reports to start scans, Hosting for VM actions, Credentials or Keystore to search those. Only permissions you hold yourself are offered.
In n8n, go to Credentials > New > ManageLM API
Paste the portal URL and API key, then click Test and save
Important: a key acts as you. It sees the servers you can see and does what you can do, limited to the authorizations you gave it. Keys cover the same features as MCP: portal settings and management (users, API keys, webhooks, creating or deleting agents, skills and groups) stay in the portal.
The ManageLM Trigger starts a workflow when a ManageLM event occurs. The webhook is created once by an admin in the portal, and every delivery is verified with its HMAC secret.
Add a ManageLM Trigger node to your workflow and copy its Production URL
In the portal, go to Settings > MCP & API > Webhooks (admins), paste the URL, choose the event categories and set an HMAC secret
In n8n, create a ManageLM Webhook credential with the same secret and select it in the trigger node
Optionally select Events to react to only some of the events the webhook receives (leave empty for all)
Activate the workflow
The trigger outputs a JSON object with the event data. All fields from the webhook payload are flattened:
{
"event": "task.completed",
"timestamp": "2026-03-21T14:30:00.000Z",
"task_id": "a1b2c3d4-...",
"agent_id": "e5f6g7h8-...",
"hostname": "web-prod-01",
"display_name": "web-prod-01",
"skill_slug": "packages",
"status": "completed",
"summary": "Updated 12 packages successfully",
"mutating": true
}
The ManageLM action node covers the features ManageLM exposes to AI clients through MCP. Select a Resource and an Operation, fill in the parameters, and execute.
| Operation | Description |
|---|---|
| Submit | Run a skill on a server with a natural language instruction. Optionally wait for the result. |
| Answer | Answer the question of a task waiting for input |
| Follow Up | Continue the conversation of a completed task |
| Get | Get task status and result by ID |
| Get Many | List tasks with filters (agent, status, time range, limit) |
| Get Changes | View the files a task changed, with an optional full diff |
| Revert | Revert the file changes of a task |
Waiting for tasks: Submit, Answer and Follow Up wait up to Max Wait seconds (default 120). A task still running then returns { task_id, still_running: true }: loop on Task > Get until its status is completed, failed, timeout or needs_input.
Lists: searches and Get Many return one item holding the result arrays. Add a Split Out node to handle the rows one by one.
| Operation | Description |
|---|---|
| Start | Start a scan on an agent: Security Audit, Inventory, Access (SSH keys and sudo), Certificates, or Activity (last 24 hours). Requires the Reports authorization. |
| Get Result | Get the latest result of that scan for an agent |
| Operation | Description |
|---|---|
| Agents | Agents by health, OS, status, group, site or text |
| Inventory | Packages, services and containers across agents |
| Security | Audit findings, pentest findings and threat alerts, with severity, source and time range |
| Activity | Logins, failed logins, sudo commands and file changes, with a time range |
| SSH Keys / Sudo Rules | Access across the fleet, mapped to your team |
| Certificates (Discovered) | Certificates found on your servers: expired, expiring, weak, self-signed, unmanaged |
| Certificates (Managed) | Certificates ManageLM issues and renews |
| Monitors / Backups | Monitors with their current status, backups with their last run |
| Credentials / Keystore | Rotating credentials and keystore keys, metadata only. Require their authorization. |
| Hosting Connectors / Cloud Resources | Connected providers, and the VMs, volumes, networks and security groups they discover |
| Resource | Operations |
|---|---|
| Hosting | Get Actions (what a connector allows), Run Action (start, stop, reboot, snapshot a VM; requires the Hosting authorization). Run Action acts immediately, with no confirmation step, even for a shutdown or a reboot. |
| Agent | Get Many, Get, Get Skills |
| Skill | Get Many, Get Catalog |
| Account | Get (account and team), Get Groups, Get Sites |
| Send yourself an email |
Send a Slack message when any agent goes offline:
ManageLM Trigger (agent.offline)
→ Slack: Send Message
Channel: #ops-alerts
Text: "Server {{ $json.hostname }} went offline"
Audit every server each morning and email the high-severity findings:
Schedule Trigger (daily at 06:00)
→ ManageLM: Agent > Get Many
→ Loop Over Items
→ ManageLM: Scan > Start (Security Audit, agent_id)
→ Wait 5 minutes
→ ManageLM: Search > Security (source: audits, severity: high)
→ IF: findings > 0
→ Email: Send summary
Open a Jira issue when a backup or a credential rotation fails:
ManageLM Trigger (backup.failed, credential.rotation_failed)
→ Jira: Create Issue
Summary: "{{ $json.event }} on {{ $json.hostname }}"
Submit a task from a Slack slash command and return the result:
Webhook (Slack slash command)
→ ManageLM: Task > Submit
agent_id, skill_slug: "packages"
instruction: "List outdated packages"
wait: true, max wait: 60
→ IF: still_running
→ Wait 30s → ManageLM: Task > Get
→ Slack: Reply with task summary
A ManageLM webhook subscribes to event categories and receives every event in them. All payloads include event and timestamp; the trigger node flattens the event data next to them.
| Category | Events |
|---|---|
| Agent | agent.enrolled, agent.approved, agent.online, agent.offline |
| Task | task.completed, task.failed, task.needs_input |
| Report | report.completed, report.failed, report.stalled |
| Monitor | monitor.down, monitor.up, monitor.stalled, monitor.created, monitor.deleted |
| Backup | backup.completed, backup.failed |
| Certificate | cert.issued, cert.renewed, cert.renewal_failed, cert.revoked, cert.reactivated, cert.deleted |
| Credential | credential.rotated, credential.rotation_failed |
| Keystore | keystore.access_denied, keystore.key_deleted |
| Pentest | pentest.completed, pentest.failed |
| Console sessions | console.opened, console.closed |
| Desktop sessions | desktop.opened, desktop.closed |
| File sessions | files.opened |
Tip: Use the trigger's Events option to keep only some events of a category, and the n8n IF node to filter by hostname or skill: for example, only alert on task.failed events from production servers.
Restart n8n completely. Community nodes are loaded at startup. If using Docker, rebuild the container.
The secret in the ManageLM Webhook credential differs from the one on the portal webhook, or the webhook has no secret. Set the same secret on both sides. A delivery is also refused when the n8n server's clock is more than 5 minutes off: keep it synchronized (NTP).
The API key is invalid, expired or disabled, or its owner was disabled. Check it in Settings > MCP & API and update the n8n credential.
The operation needs an authorization the key does not carry (for example Reports to start a scan), the key's owner cannot access that agent, or the call comes from an IP outside the owner's IP whitelist. Portal settings and management are never available to keys.
The target agent is offline. Use the Agent > Get operation to check the agent's status before submitting tasks.