Index live · v1.3.0 · MAY 26 2026

Notion

Official
byNotion

The official Notion MCP server provides full access to Notion's workspace through a hosted MCP endpoint. Create and edit pages, query databases, manage comments, and search across your entire workspace. Supports OAuth authentication and runs as a remote Streamable HTTP server.

Streamable HTTPTypeScriptAPI Key Required
~36K visitors/wk

Configuration

{
  "mcpServers": {
    "notion": {
      "url": "https://developers.notion.com/guides/mcp/overview",
      "headers": {
        "Authorization": "Bearer your-api-key-here"
      }
    }
  }
}

Add this to your claude_desktop_config.json file.

Quick Stats

Trust LevelOfficial
TransportStreamable HTTP
API KeyRequired
LanguageTypeScript
CategoryProductivity & PM
Visit Website

Author

N

Notion

Official

Tags

notesdatabaseswikiworkspacecollaboration

AgenticSkills Audit

Automated framework checks. Deep code review tracked separately. Read the methodology →

2/2
2 of 2 automated checks passed
Audited May 11, 2026
Hosted endpoint
TLS-only (HTTPS) endpoint
Mitigates: Plaintext credential interceptionResponded 404 over HTTPS
Evidence
OAuth 2.1 metadata (RFC 9728)
Mitigates: Token mismanagement, audience confusionRFC 9728 metadata present
Evidence
Repo-level checks
SECURITY.md published
Mitigates: Coordinated disclosure pathHosted server — repo-level check not applicable
Commit in last 90 days
Mitigates: Maintainer abandonmentHosted server — no public commit log
≥2 active contributors
Mitigates: Bus-factor of oneHosted server — no public contributor list
CI pipeline configured
Mitigates: Code health regressionHosted server — no public CI
Dependency lockfile committed
Mitigates: Dependency confusionHosted server — repo-level check not applicable
Signed releases (npm provenance)
Mitigates: Supply-chain backdoorHosted server — supply chain via vendor
Software Bill of Materials (SBOM)
Mitigates: Audit trailHosted server — repo-level check not applicable
License declared
Mitigates: Legal ambiguityHosted server — vendor terms of service apply

Deep framework checks (OAuth 2.1 / PKCE implementation, input validation, sandboxing) require human source review and are tracked separately. This scorecard covers programmatically verifiable signals only.