Investigate phishing emails from Google Sheets with MCP server and Telegram
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This AI workflow has 13 nodes and runs on Google Sheets events (row added). Along the way it connects Google Sheets, Google Drive, MCP Client and Telegram.
How it runs
Trigger: On Google Sheets events (row added).
- Download file (Google Drive): download
- Code: runs custom JavaScript code
- Code: runs custom Python code
- MCP Client: uses MCP Client
- Split IOCs (Code): runs custom JavaScript code
- Merge: merges the data from its input branches
- Switch: routes items into 3 branches
- Build Report (Code): runs custom JavaScript code
- Check URL (MCP Client): uses MCP Client
- Check Hash (MCP Client): uses MCP Client
…plus 2 more steps. See the full node list below.
Services it uses
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (7)
- Google Sheets Trigger
n8n-nodes-base.googleSheetsTrigger - Google Drive
n8n-nodes-base.googleDrive - Code
n8n-nodes-base.code - MCP Client
@n8n/n8n-nodes-langchain.mcpClient - Switch
n8n-nodes-base.switch - Merge
n8n-nodes-base.merge - Telegram
n8n-nodes-base.telegram
From the author
Quick overview This workflow monitors a Google Sheet for newly submitted phishing emails, downloads the attached .eml/.msg from Google Drive, analyzes headers and IOCs via an MCP server, and sends a consolidated verdict and report to Telegram. How it works 1.…