n8n/MCP readers: deterministic key choice in _top_level_string, a specific next_action for unread other-host MCP files, exact mcpClientTool matching #1073

Deferred by the engineering-review implementation loop from #1072 (issue #1025).

Problem

Three small reader issues surfaced while reviewing #1072, each outside that issue's scope:

1. src/agents_shipgate/inputs/n8n/_common.py:87 _top_level_string(value, keys: set[str]) picks among candidate keys by set iteration order, which depends on the hash seed. Callers at _auth_risk.py:168, _common.py:284, _tools.py:323 and _workflows.py:435 can therefore choose a different key between runs when a node carries several of the candidate keys. fix(readers): read n8n include/excludeTools and host MCP keys/files #1072 fixed this only for the MCP selection mode. This is a determinism defect in a product that promises byte-identical reports.
2. After fix(readers): read n8n include/excludeTools and host MCP keys/files #1072 a codex_config workspace that keeps a .vscode/mcp.json or .cursor/mcp.json under its root cannot reach passed until Read the allowlist files hosts shipped in 2026: GitHub managed-settings MCP allowlist, .github/agents/, Claude managed-settings, Cursor permissions.json, Copilot / Gemini CLI / Windsurf MCP configs #663 reads those files, and the warning's generic next_action ("Fix or re-declare the named source so the loader stops warning") names no way to clear it other than narrowing path or moving the file. The next_action should say that the file is unread pending Read the allowlist files hosts shipped in 2026: GitHub managed-settings MCP allowlist, .github/agents/, Claude managed-settings, Cursor permissions.json, Copilot / Gemini CLI / Windsurf MCP configs #663 and name the two options.
3. _node_kind matches the newer non-tool @n8n/n8n-nodes-langchain.mcpClient node on the substring mcpclient. If that node is ever wired as an ai_tool, a node with no include (it selects one tool) would be read as all.

Proposed fix

(1) Iterate keys in a fixed order (a tuple, or sorted) and add a determinism test that runs the n8n reader under two PYTHONHASHSEED values on a node with several candidate keys. (2) Give the other-host warning a specific next_action with the two options and a reference to #663. (3) Match the tool node by its exact type name rather than a substring, with a test for the non-tool node.

Acceptance criteria

• The n8n reader output is identical under different PYTHONHASHSEED values for a node with several candidate keys.
• The other-host MCP file warning names the two ways to clear it.
• The non-tool mcpClient node is not read as an MCP tool selection.

Source

Engineering review 2026-10-12 follow-up (PR #1072 implementer and reviewer notes). Tracked in #1060.