Exposed webhooks
Public triggers with no visible authentication, feeding AI steps and CRM writes.
Your automations are running. Who's watching their security?
Xpera connects to Make and n8n, finds security risks in your workflows and their AI agents, and rescans on a schedule. Nothing is ever run.
Example workflow · 5 steps
Your business runs on automations. Are they secure?
Workflows hold credentials, move customer records and now let AI agents act on them.
Over-powered actions
Steps that can delete, export or change permissions in your CRM.
Unsafe data handling
CRM data sent to hosts you never approved, and secrets stored in the workflow.
Risky AI-agent reach
Untrusted input steering an agent that holds sensitive tools.
Insecure integrations
HTTP requests whose destination is built from incoming data.
Every workflow, one security picture.
Posture, open findings, connected accounts and scan history in one place.
Three steps. Nothing executed.
- 01
Connect
A read-only Make token or an n8n API key. Or upload a workflow file.
- 02
Analyze
Each configuration becomes a security graph that rules check. Workflows never run.
- 03
Monitor
Daily or weekly rescans, with evidence and a fix for every finding.
Security visibility for every workflow.
See which accounts, workflows, apps and agents connect, and where the findings sit.
AI agents act. Know what they can reach.
An agent with tools can write to your CRM, call APIs or start other workflows.
- Which tools and workflows each agent can call
- Whether untrusted input can reach it
- What its tools can change: create, update, delete, export
- What stays unknown, such as MCP tools, labelled as unverified
Built for Make and n8n.
The two platforms Xpera supports today.
Make
SupportedAPI token with read scopes only. Tokens with write or admin scopes are refused.
Reads: Scenarios, blueprints and AI agents
n8n
SupportedAPI key for your instance. Xpera only sends read requests.
Reads: Workflows, nodes and their connections
No account to connect? Upload a Make blueprint or n8n workflow file.
Findings you can act on.
Each one names the workflow, the path and the fix.
Example findings
Why it matters
The agent's output decides a delete step, with no approval on the way.
Recommended fix
Add a human approval before the delete, or limit the step to updates.
Scheduled monitoring, not guesswork.
Periodic rescans, not real-time: changes are picked up on the next run.
- MonBaseline scan
- Tue2 new findings
- WedNo changes
- Thu1 resolved
- FriNext run
Recurring scans
Daily or weekly, at the hour you choose.
Change history
New, resolved and changed findings per run.
Alerts
In-app and signed webhooks for new findings.
Workflow inventory
Every workflow with its scan state.
One platform for automation risk.
Workflow scanning
Webhooks, HTTP calls, credentials, dynamic hosts and risky CRM operations, checked by rules.
Attack paths
Follow untrusted input through AI steps to CRM writes and external destinations.
AI agents & tools
Which tools each agent can call, and what those tools can change.
Scheduled monitoring
Daily or weekly rescans show what changed since the last one.
Security Testing Lab
Simulate prompt injection and tool misuse with mocked tools and synthetic data.
Policies & reports
Allowlists, approvals, triage and PDF assessments for the whole team.
Pre-deployment checks
Coming soonCheck workflows before they go live.
Runtime insights
Coming soonAdd observed activity to findings.
Read-only by design.
Read-Only Static Assessments
Configurations are analyzed. Automations are never run or edited.
Organization-Level Isolation
Workflows, findings and credentials stay inside your organization.
Encrypted Credentials
Integration tokens are encrypted at rest and never shown again.
Honest Findings
Potential risks, confirmed weaknesses and unknowns are labelled apart.
Priced by the workflows you monitor.
Start with a 14-day free trial.
Starter
$39/mo
$31/mo billed annually
25 workflows
For independent automation builders and freelancers.
Get StartedGrowth
Recommended$129/mo
$103/mo billed annually
150 workflows
For businesses and growing automation teams.
Get StartedBusiness
$349/mo
$279/mo billed annually
500 workflows
For larger automation operations with higher security needs.
Get Started
Enterprise — Custom pricing
Higher limits, multiple environments, tailored onboarding and support.
Compare Plans
| Feature | Starter | Growth | Business |
|---|---|---|---|
| Monitored workflows | 25 | 150 | 500 |
| Connected accounts | 1 | 3 | 10 |
| Scheduled scanning | Daily | Daily | Daily |
| Security findings | Included | Included | Included |
| Risk dashboard | Included | Included | Included |
| Finding history | 30 days | 90 days | 1 year |
| Email alertsComing soon | Included | Included | Included |
| Team access | 1 user | 5 users | 15 users |
| Support | Standard | Priority | Priority |
Questions, answered.
What does Xpera do?
It reads your Make scenarios and n8n workflows, maps how data reaches AI agents, CRMs and external APIs, and reports potential risks with evidence and a fix.
How does it connect to Make and n8n?
Make: an API token with read scopes only; tokens with write or admin scopes are refused. n8n: an API key for your instance, used only for read requests. You can also upload a workflow file.
Does Xpera run or change my workflows?
No. Scans read configurations only. The Security Testing Lab uses mocked tools and synthetic data, never your systems.
How does scheduled monitoring work?
Pick a daily or weekly time. Each run rescans changed workflows, records what's new or resolved, and can alert you in the app or by signed webhook. It is periodic, not real-time.
What risks can it find?
Untrusted webhook input reaching AI steps, AI-controlled CRM writes and deletes, data sent to unapproved hosts, dynamic HTTP destinations, stored secrets, code nodes and opaque MCP tools.
How are my integrations secured?
Tokens are encrypted at rest and never shown again. Every organization's workflows, findings and credentials are isolated from others.
Does a clean scan mean my workflows are secure?
No scanner can guarantee that. Xpera gives evidence for your security reviews, alongside your other practices.
How do I get started?
Create an account, set up your organization, then connect Make or n8n (or upload a workflow) and run your first scan.
Your automations deserve security oversight.
Connect Make or n8n, or upload a workflow, and run your first scan.