n8n Integration
Automate mlab.sh scanning, CVE intelligence and threat-actor data from your n8n workflows with the official community node package.
The official @mlabsh/n8n-nodes-mlab community package brings core scanning, CVE vulnerability intelligence and threat-actor data into n8n - no code required. It is a verified node, available on n8n Cloud and self-hosted.
npm package: @mlabsh/n8n-nodes-mlab. A verified community node package - installable everywhere: on n8n Cloud and on any self-hosted instance. On self-hosted it requires N8N_COMMUNITY_PACKAGES_ENABLED=true (the default).
What's in the package
The package ships three nodes. Only the Core node needs an API key - CVE and Threat Actors call public endpoints.
| Node | Service | Auth |
|---|---|---|
| mlab.sh Core | mlab.sh/api/v1 - domain / IP / crypto / file scans | API key |
| mlab.sh CVE | vuln.mlab.sh/api/v1 - CVE search & details | None (public) |
| mlab.sh Threat Actors | actors.mlab.sh/api/v1 - threat-actor intel | None (public) |
Installation
From the n8n UI (recommended)
In n8n, go to Settings → Community Nodes → Install.
Enter the npm package name:
@mlabsh/n8n-nodes-mlabAgree to the risk prompt and install. The mlab nodes appear in the nodes panel.
Manually (self-hosted)
# or your N8N_CUSTOM_EXTENSIONS path
cd ~/.n8n/nodes
npm install @mlabsh/n8n-nodes-mlabRestart n8n afterwards.
Credentials
Only the Core node needs credentials. The CVE and Threat Actors nodes call public, unauthenticated APIs - no credential required.
Create an API key at mlab.sh → Account → Settings → API Keys (it starts with mlab_).
In n8n, add a new mlab.sh API credential and paste the key.
The node sends it as Authorization: token mlab_.... The credential's Test button hits GET /limit/ip to validate the key.
Operations
mlab.sh Core
| Operation | Description |
|---|---|
| Domain → Scan | Launches POST /scan/domain. With Wait for Completion on (default) it polls status and returns the full results payload (subdomains, DNS, SSL, security.txt…). |
| Domain → Get Status / Get Results | Manage an async scan yourself. |
| IP → Lookup | GET /scan/ip - geolocation, ASN, ownership, reverse DNS, abuse contact. |
| Crypto → Lookup | GET /scan/crypto - sanctions, labels, risk score. Chain read from the address, except on EVM where it must be passed. |
| File → Upload | POST /upload/file from an input binary field (max 10MB), returns the sha256. |
| File → Get Results | GET /scan/file/results?sha256=… |
| Quota → Get | Remaining daily quota for a scan type (GET /limit/{type}). |
mlab.sh CVE
| Operation | Description |
|---|---|
| Search | GET /cve?q=… with optional severity, dateStart, exact, kev filters. |
| Get | GET /cve/CVE-XXXX-XXXX - full detail incl. EPSS & KEV. |
| Get Latest | GET /cve/latest - last 7 days. |
mlab.sh Threat Actors
| Operation | Description |
|---|---|
| List / Search | GET /actors with origin, motivation, sector, limit, offset. |
| Get | GET /actors/:slug - aliases, tools, CVEs, techniques. |
| Get by CVE | GET /cves/CVE-XXXX-XXXX/actors - reverse lookup. |
Example workflow
A typical alerting flow: a Schedule Trigger → mlab.sh CVE (Get Latest) → an IF node filtering on kev = true or cvss ≥ 9 → a Slack / Email node. Or enrich inbound IOCs: a Webhook → mlab.sh Core (IP Lookup) → route on the risk verdict. Because every node returns structured JSON, you can branch, merge and template the output like any other n8n data.
Requirements
Node ≥ 20.15 (same as n8n). The package is a verified community node, so it installs directly on n8n Cloud as well as on self-hosted instances (where N8N_COMMUNITY_PACKAGES_ENABLED=true is the default).