MCP · Knowledge and documents · Notion
Notion MCP
Find, read and update Notion content from an AI host, with capabilities shaped by the workspace plan and connection permissions.
Workspace information leaves its original interface. A connected host can process returned content outside Notion. Match its data policy to the material.
Understand the tool
What it does.
Notion's hosted MCP server gives a connected AI application workspace tools. The server supplies access; the host chooses operations. Community and locally hosted implementations are not assumed equivalent.
Why use it?
Use it when a useful answer spans several Notion pages. Ask for a linked decision brief, then review any proposed update. Preserve a traceable path from knowledge to document.
A useful fit for
- Finding documented decisions
- Preparing project briefs
- Drafting page updates
From need to output
Ways to put it to work.
These are suggested workflows based on the documented capabilities. They are not recorded runtime results.
Use case 01
Recover a project decision
A new contributor needs to know why a feature was postponed.
- Search a named project area.
- Fetch relevant pages and compare dates.
- Link the decision and flag conflicting notes.
Intended outputA sourced explanation with gaps left visible.
Use case 02
Prepare an SOP revision
An operations page needs changes from an agreed meeting record.
- Read the current page and the selected notes.
- Draft a section-by-section revision.
- Approve the destination and changes before updating.
Intended outputA proposed procedure update that retains its source context.
A concrete starting point
Illustrative prompt: decision brief
Search behavior and filters depend on the plan and connection.
Find the decision about the onboarding checklist in the project area I identify. Read the important matches, link the sources and distinguish decisions from proposals. Return a brief here; do not edit pages or search unrelated workspaces.What this can change
Retrieved pages may be processed outside Notion by the AI host. Enabled tools can also change workspace content.
This example has not been executed for this review. Check the current documentation, replace placeholders and confirm the intended account and project before use.
Before you start
Setup and access.
What you’ll need
- A trusted remote MCP client and authorized Notion connection.
- Workspace permissions for the intended content.
- AI search requires Business or Enterprise with Notion AI. Some filters and higher request limits depend on the workspace plan.
- Authentication
- Hosted OAuth; workspace owners on Business and Enterprise can also create MCP bearer tokens. Enterprise-managed authorization has separate SAML and identity-provider requirements.
- Can read
- Accessible pages, databases and permitted search results
- Can write or change
- Enabled page, database and comment operations
- Network and data flow
- mcp.notion.com and Notion services
- AI host/model provider
- Approval and control
- Enable host confirmation for changes. Enterprise administrators can restrict which clients connect.
Check your environment
Compatibility, costs and license.
Compatibility notes
- Streamable HTTP is the recommended hosted transport
- Tool availability varies with plan and connection type
- A listed tool does not guarantee every parameter is available
Costs and account requirements
Notion plan and AI entitlements affect capability. The connected AI host has separate pricing; confirm the workspace's actual access before choosing a workflow.
Current pricing or plan information ↗Hosted service terms
No source-code license for the hosted service is asserted. A separate local server is not treated as identical. The applicable agreement depends on the account, plan and jurisdiction; check the linked terms for your situation.
Read the license or service terms ↗Keep the boundaries visible
Concerns and limitations.
Workspace information leaves its original interface
A connected host can process returned content outside Notion. Match its data policy to the material.
Broader search than requested
Unavailable filters can be dropped with notices. Check those notices before interpreting a result as exhaustive or tightly scoped.
Where it may fall short
- No workspace was connected or modified.
- Search results need source review; absence of a match is not proof that no decision exists.
Observed behavior · 2026-10-18
Runtime and security findings.
The hosted Notion endpoint returned an authentication challenge before initialization. Its public discovery document exposed one generic scope, not page-level access evidence.
These checks cover the conditions below. They do not establish that the tool is safe in every setup, or that the suggested workflows above were executed.
What we found
Observed in this evaluation
A generic scope does not reveal page access
Initialization returned 401 with scope default. The HTTP 200 metadata document also listed only default and identified the hosted resource as Notion MCP (Beta). No page or workspace data was returned.
In practice: Check the selected workspace and effective user access during authorization. A discovery document cannot show which private pages the connection will reach.
Documented concern
The client can move content outside Notion
Notion says connected clients can access content available to the user and may send returned content to external systems. Its security guidance calls for action confirmation and treating tool content as untrusted.
In practice: Connect a trusted host, minimize retrieved content and review both edits and data sharing. Audit the client's retention settings as well as Notion permissions.
Version, environment and fixture
- Version or deployment
- Remote deployment version not disclosed by the observed responses
- Tested target
- https://mcp.notion.com/mcp
- Artifact identity
- HTTPS certificate verification enabled. Public resource-metadata body SHA-256: e5999dd6b0431676a0f4a9fc688ee8da7526cb9a26d3c2dbe20f6803ca7500d2. This fingerprints the observed metadata, not the deployed server implementation.
- Environment and fixture
- Windows 11 build 26200; Python 3.12.10 urllib; OpenSSL 3.0.16.
- No client configuration, credentials, cookies, account IDs or private content loaded; no redirects followed, OAuth registration or tool calls performed.
- Observed 2026-10-19T00:47:10.611440+00:00 through 2026-10-19T00:47:20.626366+00:00 UTC.
- One request per listed check; 20-second timeout and 64-KiB response cap. Initial sandbox DNS failures were retained separately and resolved with approved network access; they are not endpoint failures.
Checks and results
2 recorded checks. Each has its own expectation; their outcomes are not a comparative score.
Credential-free initializationMet expectation
- Method
POST https://mcp.notion.com/mcp; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream. Content-Type: application/json; MCP-Protocol-Version: 2025-03-26; body: {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"IonBin-account-free-evaluation","version":"1.0.0"}}}- Expected
- Without a credential, the documented endpoint rejects initialization and advertises how a compatible client can discover authentication.
- Observed
- HTTP 401 at 2026-10-19T00:47:10.611440+00:00. WWW-Authenticate: Bearer; resource_metadata=https://mcp.notion.com/.well-known/oauth-protected-resource/mcp. Advertised challenge scope: default. Empty response body.
Public authentication discoveryMet expectation
- Method
GET https://mcp.notion.com/.well-known/oauth-protected-resource/mcp; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream.- Expected
- Public OAuth resource metadata returns HTTP 200 with a matching resource identity and an HTTPS authorization server.
- Observed
- HTTP 200 at 2026-10-19T00:47:20.626366+00:00; Content-Type: application/json. Resource: https://mcp.notion.com/mcp. 1 supported scopes: default. Authorization server: https://mcp.notion.com. Bearer methods: header.
Practical caveats
- Workspace-owner MCP tokens are documented for Business and Enterprise plans; do not confuse them with the older integration-token server, which is no longer actively maintained.
- Enterprise client restrictions and connection revocation help manage access; plan-specific controls and the actual workspace policy were not exercised.
What this evaluation does not establish
- OAuth or MCP-token authentication, workspace and page permissions, guest restrictions and revocation.
- Search accuracy, database queries, file uploads, edits and prompt-injection resistance.
- The deprecated local server; no workspace content was read or changed.
- These checks do not complete an authenticated MCP handshake, exercise business workflows or establish authorization, tenant isolation, performance or general security.
Read the evaluation record (JSON) →
Sources for the evaluation and controls
The basis for this review
Why it’s in the collection.
A practical knowledge-work starting point with clear source-to-document tasks. Plan-dependent search requires careful expectations.
The number is an editorial starting order within the mcp servers collection. It does not measure popularity, speed, reliability or safety.
What we reviewed
- Hosted setup
- Supported tools and plan limits
- security guidance
The evaluation above lists the current runtime coverage and untested behavior.
Reviewed Oct 18, 2026. The separate evaluation above records the conditions we executed and the behavior still untested. Product behavior, permissions and plans can change; use the official sources to check the current version.
Follow the evidence
Official sources.
- Hosted MCP overview ↗developers.notion.com
- Connection setup ↗developers.notion.com
- Capabilities and plan limits ↗developers.notion.com
- Security and administrator controls ↗developers.notion.com
- Notion plans ↗www.notion.com
- Service terms or terms index; account applicability not evaluated ↗trust.notion.com