WAF blocking n8n MCP / REST API workflow updates with Code nodes

**Context:**

I’m running n8n self-hosted on Render, managing workflows via the **n8n MCP server** (Model Context Protocol for AI-assisted automation). The underlying issue is WAF blocking REST API calls, but the symptom first appeared as MCP tool failures.

**The Issue:**

When updating workflows that contain multiple Code nodes (3+) with JavaScript, requests return 403 Forbidden with a Cloudflare WAF block page. Smaller payloads with the same structure succeed.

**How it manifests:**

- **Via n8n MCP:** `n8n_update_full_workflow` or `n8n_create_workflow` fails with 403

- **Via REST API:** PUT `/api/v1/workflows/{id}` returns Cloudflare block page

- **Via n8n UI:** Works fine (same operations succeed)

**What I’ve Tried:**

- Smaller payloads (1-2 Code nodes): Works

- Manual updates via n8n UI: Works

- Incremental node addition via MCP: Sometimes blocked mid-sequence

**Environment:**

- n8n self-hosted on Render (Hobby plan)

- n8n MCP server for programmatic workflow management

- Also affects direct REST API calls

**Error:**

- HTTP 403 Forbidden

- Cloudflare WAF block page (not n8n API error)

- CF-RAY: `9c88dd08b97a0731`

**Questions:**

1. Anyone else using n8n MCP or REST API on Render hitting this?

2. Any known workarounds for programmatic workflow management?

3. Is there a way to request WAF tuning for specific endpoints?

-–

## How to Check if You’re Affected

1. Host n8n on Render

2. Use n8n MCP or REST API to create/update a workflow

3. Include 3+ Code nodes with `jsCode` parameters (~500+ chars each)

4. Total payload ~2.5KB+

5. Check if you get HTTP 403 with Cloudflare block page

**How to get your CF-RAY (trace ID):**

```bash

curl -i -X PUT “https://[your-service].onrender.com/api/v1/workflows/[id]” \

-H “Content-Type: application/json” \

-H “X-N8N-API-KEY: [key]” \

-d ‘{“name”:“test”,“nodes”:[…]}’ 2>&1 | grep -i “cf-ray”

```

Or check MCP error output - the CF-RAY may be in the response body.

**If you hit this issue**, please reply with:

- Your CF-RAY ID

- Your use case (n8n MCP, direct API, Claude Code, etc.)

More data points help Render prioritize a fix.

-–

**Support ticket submitted:** Via Render chatbox. no ticket number provided.