Quietsmith
n8n Handoff Pack

Know what's missing before your client does.

You built the workflow. Now you need to hand it off without a videocall, without re-linking nodes, and without accidentally shipping your own credentials inside the JSON. This reads the export file and tells you exactly what's left to do.

Try the scanner See pricing Lite free · Pro $24 once
Why this one

Your workflow never leaves your browser.

The JSON file is read and analyzed entirely client-side. No server receives your nodes, parameters, credentials, or any other part of the export. The only network request the tool ever makes is verifying a Pro license key with Gumroad — and that request contains the key alone, never your workflow data.

Nothing is uploaded

The file stays in your browser tab. Node names, webhook paths, hardcoded values, credential references — none of it is sent anywhere. Close the tab and nothing remains.

No n8n access needed

The tool never connects to your n8n instance or your client's. It reads a JSON file you already exported — no API key, no OAuth, no instance URL.

Deterministic, not AI

Every finding comes from pattern-matching rules (R1–R6), not a language model. The results are reproducible, auditable, and fast.

How it works

Drop a JSON, read the checklist.

Export a workflow from n8n, load it into the scanner, and get a structured inventory of everything your client needs to set up — plus a scan for the things you forgot to remove.

01
Dependency inventoryCredentials to create (grouped by type), community nodes to install, sub-workflows to deliver separately, environment variables to set, and webhooks to reconfigure.
02
Handoff risk scanDeterministic rules that flag likely secrets in plain text, localhost and staging URLs, hardcoded resource IDs, custom webhook paths, and embedded email addresses — masked in the report so you can share it safely.
03
Delivery pack exportA Markdown checklist with setup steps, credential ownership table, and smoke tests. Your client fills in the real values by hand — the tool never has access to them.

It does not modify, clean, or rewrite your original workflow file. It reads the JSON you give it and produces a separate Markdown report.

Honest comparison

When to use something else.

This is a pre-delivery scanner, not a deployment tool. If you need the things on the right, use one of those instead.

Use Handoff Pack

You want to know what credentials, nodes, and variables a workflow needs before handing the JSON to a client.

Use INST or source control

You want to deploy a workflow directly into a client's n8n instance with credential mapping and execution.

Use Handoff Pack

You want a deterministic scan for hardcoded secrets and environment values before delivering the file.

Use n8n Security Audit

You want a full security audit of a live n8n instance, including execution history and access control.

Use Handoff Pack

You deliver to clients who aren't technical enough to reverse-engineer the JSON themselves.

Use documentation generators

You want LLM-generated prose documentation of what the workflow does, not a structured handoff checklist.

Use Handoff Pack

You don't want to share your n8n instance URL or API key with any third-party tool.

Use n8n Environments

You have n8n Business or Enterprise and want built-in promotion between your own staging and production instances.

Pricing

Free to use. One payment to unlock everything.

Lite gives you the full dependency inventory and the two most critical risk rules on a single workflow — enough to see if it's useful before you pay anything.

Lite — Free
  • One workflow at a time
  • Full dependency inventory (credentials, community nodes, sub-workflows, variables, webhooks)
  • Critical risk rules: known secret prefixes and localhost/IP URLs
  • Single Markdown export per workflow
Pro
$24once — not per month
  • Batch mode — load multiple workflows per project
  • Full R1–R6 risk scan (adds likely tokens, staging URLs, resource IDs, webhook paths, embedded emails)
  • ZIP export with a Markdown file per workflow plus a combined index
  • Extended smoke test checklist and delivery sign-off line
  • Yours permanently — no renewal, no expiry
Buy the unlock Try it first
Questions

Before you buy

Does my workflow data get uploaded anywhere?
No. The JSON is parsed by JavaScript running in your browser tab. The only network request the tool makes is to verify your Pro license key with Gumroad — that request contains the key and nothing else. Your nodes, parameters, and credential references never leave your machine.
Can it connect to my n8n instance or deploy workflows for me?
No, and this is permanent. The tool reads a JSON file you already exported. It never connects to any n8n instance, never touches real credentials, and never writes to a live workflow. This is a deliberate scope decision — not a missing feature — because storing or transferring credentials turns a simple tool into sensitive infrastructure.
Does the risk scan catch every secret?
No. The R1–R6 rules are deterministic pattern matches — known token prefixes, localhost URLs, staging hostnames, resource IDs, webhook paths, and email addresses. They're fast, private, and reliable for common cases, but not a substitute for reading the workflow yourself before handoff.
Does it look at my actual credentials?
No — n8n's export format never puts a credential's real value in the JSON, only a reference (id and name). The risk scan looks at node parameters and notes, where hardcoded secrets sometimes end up by accident.
Does the license expire?
No. You pay once and it stays unlocked. The key is stored in your browser's localStorage so Pro persists across sessions. Clearing browser data removes it — just re-enter the key.
Can I get a refund?
Yes. Email support@quietsmith.com and we'll refund it — that's why Lite exists, so you can verify it's useful on your workflows before you spend anything.