Notion MCP Server by awkoy

Findings (4)

• highHigh. Something risky that needs a close look before you install.
  network issue

  Details are available to the maintainer after claiming this listing.
• lowLow. Minor, or common in normal tools. Shown for information.
  @hono/node-server@1.19.17: 1 known vulnerability

  GHSA-rmxm-3fg6-px4f

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  package.json has a prepare script

  npm run build

  package.json
• lowLow. Minor, or common in normal tools. Shown for information.
  Reads environment variables not listed in the manifest

  FIXTURE, SEARCH_QUERY, EXCLUDE_PAGES, MAX_PAGES, RATE_LIMIT_ENV_VAR, CONFIRM_DESTRUCTIVE_ENV_VAR, BLOCKED_ENV_VAR, ALLOWED_ENV_VAR, READ_ONLY_ENV_VAR, NOTION_UPLOAD_ROOT, NOTION_DAILY_LOG_PAGE_ID, HTTPS_PROXY, HTTP_PROXY, NOTION_FILE_URLS

Network activity

Tools exposed (3)

• notion_read

  Run one Notion read operation by name. Nothing is modified. Call: { operation, payload } — payload carries that operation's fields. Common: search_pages { query }, get_page { page_id }, get_page_markdown { page_id }, query_database { database_id, where? }, get_block_children { block_id }. Response

• notion_write

  Run one Notion write operation by name. Archive, trash and delete operations remove content — confirm with the user before running them. Two ways to call: • Single: { operation: "set_page_title", payload: { page_id, title } } • Batch: { operation: "set_page_title", payload: { items: [{page_id,

• notion_describe

  Return the JSON Schema and a working example for one operation, plus which tool runs it (notion_read or notion_write). Use this BEFORE calling the operation when the payload shape is non-trivial (query filters, structured block trees, database property definitions). For simple ops, just call it — er