Notion MCP Server: Setup, Permissions and Security (Oct 2026)

The Notion MCP server is Notion's own hosted server at https://mcp.notion.com/mcp. It lets an AI client search, read and edit your Notion workspace after you sign in with OAuth. TrustedMCP grades it B. The short version: use it, but keep tool approval on, because the agent gets everything your Notion account can reach.

What it connects

Notion MCP works through the Notion API. Its tools can:

• Search pages and databases in your workspace, and on Business or Enterprise with Notion AI, connected sources such as Slack and Google Drive.
• Read pages, databases and comments.
• Create, update, move and duplicate pages, and create databases and views.
• Comment: add, edit, resolve and delete your own comments.
• Delete pages and databases. Deletes move items to Trash, where they can be restored. The delete tools need a user_confirmed: true flag and are marked destructive, so clients that honor tool annotations ask you first.

There are also calendar tools for your connected calendars. The full list is on Notion's supported tools page. Every tool call counts toward the standard Notion API rate limits.

Setup

These snippets come from Notion's Connect to Notion MCP guide.

Claude Code:

claude mcp add --transport http notion https://mcp.notion.com/mcp

Then run /mcp in Claude Code and follow the OAuth flow. Add --scope project to share the server with your team through .mcp.json, or --scope user to use it across all your projects.

Cursor (.cursor/mcp.json in your project root, or ~/.cursor/mcp.json for all projects):

{
  "mcpServers": {
    "notion": {
      "url": "https://mcp.notion.com/mcp"
    }
  }
}

Then open Customize in Cursor's sidebar, enable Notion and complete the OAuth flow.

VS Code (.vscode/mcp.json in your workspace):

{
  "servers": {
    "notion": {
      "type": "http",
      "url": "https://mcp.notion.com/mcp"
    }
  }
}

Then run MCP: List Servers from the Command Palette, start the Notion server and complete the OAuth flow.

Codex: add this to ~/.codex/config.toml, then run codex mcp login notion.

[mcp_servers.notion]
url = "https://mcp.notion.com/mcp"

Notion's guide also covers fx, Hermes, Devin, Pi and Antigravity. For a client that only supports local stdio servers, Notion documents this mcp-remote bridge:

{
  "mcpServers": {
    "notion": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://mcp.notion.com/mcp"]
    }
  }
}

Security notes

OAuth means your full permissions. Notion's Help Center says MCP tools "act with your full Notion permissions" and "can access everything you can access." The OAuth sign-in has no scopes to pick, no read-only mode, and no page picker. Notion doesn't document a way to limit a user's OAuth connection to certain pages or teamspaces. If you can edit a page, so can the agent.

Page content is untrusted input. Notion's own security best practices warn about prompt injection: someone can hide instructions in content your client reads. Pages, database rows and comments written by other people all go into the model's context. With connected sources, a fetch can also return full Slack threads, Drive files or emails.

Admins have some controls. Workspace owners manage client access in Settings → Notion MCP → Manage workspace clients. Limiting which clients members can connect needs the Enterprise plan. Organization owners can list and revoke members' connections through the Admin API.

How to limit the risk:

1. Keep tool approval on. Notion itself recommends turning on confirmation before actions that change content. Read what the agent wants to write before you approve it.
2. Block write tools in your client if you only need reads. In Claude Code, add deny rules to your settings for tools such as mcp__notion__notion-update-page, mcp__notion__notion-move-pages and mcp__notion__notion-delete-pages.
3. Use a separate account or workspace for agent work if your main account can see sensitive pages. Since there are no page-level limits, this is the only way to shrink what the agent can see.
4. Only connect clients you trust, and check the server URL is mcp.notion.com before you install from a third-party marketplace.

Skip the old self-hosted server. Notion says its open-source notion-mcp-server package "is no longer actively maintained" and that issues and pull requests "are not actively monitored." It recommends the hosted server for most users.

See the 5-minute safety check for the general version of this process.

Why it grades B

• Authentication: 18 of 30. OAuth is the default, but it grants your full Notion permissions with no scopes or read-only mode, which counts as coarse.
• Maintenance: 18 of 25. Notion's docs and changelog are active, but the hosted server is closed source, so we score one band lower.
• Known CVEs: 25 of 25. None on record for Notion's hosted server.
• Transport: 20 of 20. Streamable HTTP over HTTPS, hosted by Notion. Nothing runs on your machine.

Full breakdown on the Notion MCP listing; the method is in how TrustedMCP scores servers.

Frequently asked questions

Is Notion MCP free?

Notion says Notion MCP works on every plan. Some features need Business or Enterprise, such as MCP tokens, connected-source search and unlimited SQL queries. Paid plans also get higher request limits.

What's the Notion MCP URL?

https://mcp.notion.com/mcp for Streamable HTTP, which Notion recommends. Use https://mcp.notion.com/sse only if your client doesn't support Streamable HTTP.

Notion MCP not working?

Notion's troubleshooting steps: complete the OAuth flow when prompted; disconnect and reconnect the client (look for Clear authentication or Disconnect in its MCP settings); and check your permissions in the workspace you're connecting to. If you see command not found for claude, install your client and make sure it's on your PATH. An admin can also block adding MCP servers, which shows as an enterprise policy error. Workspace guests can't connect at all; only members can.

Can I use Notion MCP without OAuth?

Yes, on Business and Enterprise. A workspace owner can create an MCP token in the Developer portal, and the client sends it as a bearer token to https://mcp.notion.com/mcp. These workspace-owned connections expose only the tools an admin selects, and the delete tools aren't on that list, so this is the closest thing to a limited mode. The old self-hosted server also uses an integration token, but Notion no longer maintains it.

How do I use Notion MCP in Claude Code?

Run claude mcp add --transport http notion https://mcp.notion.com/mcp, then /mcp to sign in. Use /context to see how many tokens each MCP server adds to your session. Notion also publishes a Notion plugin for Claude Code that adds the server plus Skills and slash commands. See why MCP servers eat your context window.

More: MCP security best practices · Collaboration category