MCP server · Org-owned · Audited from source
Notion MCP server
by makenotion/notion-mcp-serverMIT licenceAudited 21 Sep 2026 · source ccf053fb9abb
Is it safe? With care — CAUTION, grade B (88/100). It exposes 3 tools: 2 read, 1 write and 0 destructive. The audit recorded 12 findings (0 critical, 0 high, 4 medium, 8 low). Maintainer's description: Official Notion MCP Server
Cite
Cite this page
ModelsAtlas. “Notion MCP server (makenotion/notion-mcp-server)”. Retrieved 21 Sep 2026. https://modelsatlas.com/mcp/makenotion/notion-12
7 MCP servers are called Notion. This is the one we pick. Compare all 7 →
- makenotion/notion-mcp-server Org-owned★ 4,641!CAUTION
- suekou/mcp-notion-server★ 919✓SAFE
- badhansen/notion-mcp★ 31✓SAFE
- danhilse/notion_mcp★ 208!CAUTION
Trust audit
Audit 0.4.1 · full source read 21 Sep 2026
12 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.
What the source does
- FilesystemNone observedNothing seen in the source
- NetworkDeclared1 observation
- ShellNone observedNothing seen in the source
- DependenciesNot pinnedSome ranges float
- SecretsNone foundNo keys in source
“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.
Five audit layers
| Layer | What we check | Result |
|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS |
L1 Static source | Secrets, path traversal, supply chain | WARN 12 findings |
L2 Instructions | Prompt injection and authority framing in docs and tool descriptions | PASS |
L3 Inventory | Declared tools match the source | PASS |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED |
Provenance & runtime
Who published it, and what the audit could and could not run
Provenance
- Repository owner
makenotionOrganizationAccount type recorded when we read the repository. - PackagePublished on npm
@notionhq/notion-mcp-serverat version 2.5.2 - LicenceMITFrom the repository, as read at the audited commit.
- Last pushTodayActivity of the repository when we read it.
- Source commit readccf053fb9abbThe audit covers exactly this commit, read on 21 Sep 2026.
Runtime
- Sandbox runNot run yetThis audit read the source only; it did not execute the server.
- Tool inventory3 declaredRead from the source and classed read, write or destructive.
Every value here is read from the record's own repository and audit.Suggest a correction
Findings (12)
Sorted by severity
MEDIUMInformation disclosuredisclose.log_secret · scripts/start-server.ts:54
console.log(`Generated auth token written to: ${authTokenFilePath}`)- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMInformation disclosuredisclose.log_secret · scripts/start-server.ts:150
console.log(`Initializing session with per-request Notion token ${redactToken(resolution.token)}`)- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMInformation disclosuredisclose.log_secret · scripts/start-server.ts:249
console.log(`Authentication: Bearer token required`)
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMInformation disclosuredisclose.log_secret · scripts/start-server.ts:251
console.log(`Read your auth token from: ${authTokenFilePath}`)- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · src/openapi-mcp-server/mcp/__tests__/proxy.test.ts:3
import { HttpClient } from '../../client/http-client'- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · src/openapi-mcp-server/mcp/__tests__/proxy.test.ts:8
vi.mock('../../client/http-client')- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · README.md:363
When using Streamable HTTP transport, the server will be available at `http://127.0.0.1:<port>/mcp` by default.
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · scripts/server-options.test.ts:19
expect(getHttpServerDisplayUrl(options)).toBe('http://127.0.0.1:3000')- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · scripts/server-options.test.ts:35
expect(getHttpServerDisplayUrl(options)).toBe('http://127.0.0.1:8080')- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · scripts/server-options.test.ts:78
expect(dnsOptions.allowedOrigins).toContain('http://127.0.0.1:4321')- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · src/openapi-mcp-server/client/__tests__/test-server.ts:25
resolve({ server, baseUrl: `http://127.0.0.1:${port}` })- Why
- No further detail recorded for this rule.
- Fix
- —
LOWSupply chainsupply.unpinned · package.json
@modelcontextprotocol/sdk, axios, express, form-data, mustache, node-fetch, openapi-client-axios, openapi-schema-validator
- Why
- 22 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
Tools it exposes
3 declared in source · 0 destructive
| Tool | Risk | What it does |
|---|---|---|
createAB | write | Create an A-B object |
getAB | read | Get an A-B object |
getComposed | read | Get a composed resource |
Install
Package version 2.5.2 · audited commit ccf053f
Read the findings first. The most severe is Information disclosure (medium) at scripts/start-server.ts.
One-click links open your editor with the config below filled in, exactly as the snippets show it, pinned to version 2.5.2. The audit covers commit ccf053f only.
claude mcp add notion-mcp-server --env AUTH_TOKEN=${AUTH_TOKEN} --env ENABLE_TOKEN_PASSTHROUGH=${ENABLE_TOKEN_PASSTHROUGH} --env NOTION_TOKEN=${NOTION_TOKEN} -- npx -y @notionhq/[email protected]{
"mcpServers": {
"notion-mcp-server": {
"command": "npx",
"args": [
"-y",
"@notionhq/[email protected]"
],
"env": {
"AUTH_TOKEN": "${AUTH_TOKEN}",
"ENABLE_TOKEN_PASSTHROUGH": "${ENABLE_TOKEN_PASSTHROUGH}",
"NOTION_TOKEN": "${NOTION_TOKEN}"
}
}
}
}The command pins the package version recorded in the source (2.5.2); the audit covers commit ccf053fb9abb. Transport: stdio · streamable-http. Reads these environment variables: AUTH_TOKEN, ENABLE_TOKEN_PASSTHROUGH, NOTION_TOKEN. Give it the narrowest token it needs.
Audit history
- !CAUTION B 88 / 100
Source changed, verdict held ·
ccf053fb9abb - !CAUTION B 88 / 100
First audit ·
fda23548d239
README badge
For maintainers · updates on every re-audit
[](https://modelsatlas.com/mcp/makenotion/notion-12/)
The badge always shows the latest audit; a maintainer cannot pin an old verdict.
Other ratings
Cited, never blended into our score
No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.
Questions about Notion MCP server
What is the Notion MCP server?
What tools does Notion expose?
Is Notion safe to connect to an agent?
What credentials does Notion need?
How does Notion run?
How current is this page?
Which Notion MCP server is the right one?
Sources
- makenotion/notion-mcp-server on GitHub — the source we read, its licence, stars and activityObserved · 21 Sep 2026
- ModelsAtlas trust audit — CAUTION verdict for commit ccf053fb9abbObserved · 21 Sep 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What is the Notion MCP server?
- What tools does Notion expose?
- Is Notion safe to connect to an agent?