Notion
Notion's official MCP for reading and writing pages, databases, and comments. Best-in-class for personal-knowledge-base agents.
Delv Safety Grade: A+
Score 93/100 · assessed 2026-04-22
Notion's official MCP server is a first-party integration from a major SaaS vendor with strong operational track record. The package ships via npm with proper versioning and is maintained by Notion's developer team, giving it excellent supply-chain hygiene and low bus-factor risk. Permissions are scoped to Notion's API surface: reading and writing pages, databases, and comments within workspaces you explicitly authorise via API key. This is broader than read-only but appropriately scoped to Notion's domain. The main risk is that NOTION_API_KEY grants full workspace access, so a compromised key or malicious prompt could modify or delete significant amounts of data. However, this is inherent to Notion's API design rather than a flaw in the MCP implementation. Transparency is excellent with public repo, clear documentation, and active maintenance. No known security incidents.
Lethal Trifecta (prompt-injection exposure)
TRIFECTA RISKShared pages can embed untrusted content. Database access is private. API supports writes.
Green flags
- Official first-party integration from established vendor
- Distributed via npm with semantic versioning
- Public GitHub repo with active maintenance and issue tracking
- Clear documentation on Notion developer portal
- Scoped to single service domain (Notion only)
Red flags
- API key grants full workspace access, not scoped to specific pages
- Write permissions include deletion via Notion API
- No built-in rate limiting visible in MCP layer
Permissions requested
Install
npx -y @notionhq/notion-mcp-server
NOTION_API_KEYReview
Install this if you use Notion for anything more structured than a diary and want Claude to interact with it natively. Skip it if you're not already invested in Notion's ecosystem or if you need a read-only safety net. The first-party polish is worth the five-minute setup.
Good at
- First-party support means it tracks Notion's API changes and handles edge cases like nested blocks and database rollups correctly.
- Full read-write access to pages, databases, and comments gives agents real workspace agency, not just read-only context.
- Works across Claude Desktop, Cursor, Windsurf, and other MCP hosts without needing separate integrations.
- Handles pagination and complex queries internally, so you don't have to prompt around API limits.
- Notion's permissions model applies cleanly, so you can scope access per integration without exposing your entire workspace.
Watch out
- Requires manual OAuth setup and explicit sharing of databases with the integration, which adds friction if you're not already familiar with Notion's permissions.
- Write access is enabled by default, so a poorly prompted agent can overwrite or delete content without a safety net.
- Hosts beyond Claude Desktop often need manual config file edits rather than a GUI setup flow.
- No built-in versioning or undo at the MCP layer, so you're relying on Notion's page history if something goes wrong.
Getting started
Works with
Similar MCPs
- AsanaOfficial Asana MCP. Access the Work Graph - tasks, projects, teams - from AI clients via OAuth. Remote server, Streamable HTTP transport, no local install needed.
- ClickUpOfficial ClickUp MCP - ~49 tools across 14 categories (tasks, docs, time tracking, chat, comments, bulk ops). The largest project-management surface area in any MCP server right now.
- LinearCreate, update, and query Linear issues from Claude. Useful for teams whose PM lives in Linear and want the agent to file tickets from conversation.
- Google CalendarSchedule, list, update events directly from Claude. Combine with Gmail MCP for an actual personal-assistant feel.