Notion MCP server security: what an agent can read, change and trash

The short answer

Notion’s hosted MCP server at https://mcp.notion.com/mcp acts with your own permissions: after OAuth, the client can read and update anything you can access in that workspace.¹ There’s no read-only switch on the server. To narrow it, keep your client’s confirmation on for every tool that changes content, hide the tools you don’t need in clients that support it, connect through a Notion account with limited access, and have a workspace owner review which clients are connected.

What the tools cover

Notion’s supported-tools page lists more than sixty tools. Grouped by what they can do:

The two delete tools are the ones to understand. Each moves up to 20 pages or databases to Trash in one call, databases with all their rows, and anything trashed can be restored with notion-restore-pages or from Trash in Notion.⁴ That’s a softer failure than a database DROP: nothing is gone for good on the first call.

How the delete confirmation works

Notion added a guard to those two tools: the call must set user_confirmed: true. Without it, nothing moves to Trash, and the error lists the pages, or the databases and their row counts, so the client can confirm with the user.⁴

Be precise about what that does. user_confirmed is an argument in the tool call, and the model writes the tool call. A well-behaved client and model will show you the list and ask. But nothing in the protocol makes the model ask before setting the flag on the second attempt. The confirmation that holds is your client’s own approval prompt, the one you click. Keep that on for the delete, move and update tools, and don’t choose “always allow” for them.

Notion’s security page says the same thing from the other side: enable confirmation before actions that change content, review proposed actions, and treat content returned by tools as untrusted.²

The data leaves with the client

The less obvious risk is reading. Notion warns that a connected client may send content returned by Notion MCP to systems outside Notion, and that this can include full items from connected sources, such as Slack threads, Google Drive files and emails, when notion-fetch opens a connector search result.²

So a Notion connection can be all three legs of Simon Willison’s “lethal trifecta” at once: private data, untrusted content (anyone who can edit a shared page can plant instructions), and, if the agent also has a web or messaging tool, a way to send data out.⁵ For a coding agent, the simplest fix is not to give it Notion in the same session as tools that can reach the internet.

Ways to narrow it

The server doesn’t have a read-only mode, so the narrowing happens around it.

1. Hide write tools in the client. Some clients filter a server’s tools. Gemini CLI has includeTools as an allow-list and excludeTools to remove tools;⁶ Codex has enabled_tools and disabled_tools.⁷ A Codex entry that keeps Notion to reading:

Code A settings file: the rules a tool reads before it acts.

[mcp_servers.notion]
url = "https://mcp.notion.com/mcp"
enabled_tools = ["notion-search", "notion-fetch", "notion-query-data-sources"]

Hiding a tool in one client doesn’t change what the OAuth grant allows, but it does keep the model from calling it.

2. Use an account with less access. For shared or automated setups, Notion suggests a service account rather than a personal one.³ Give that account access to the teamspaces the agent needs and nothing else. The agent can only reach what the account can.

3. Let a workspace owner see the connections. Owners manage MCP clients in Settings → Notion MCP → Manage workspace clients; limiting which clients members can connect needs the Enterprise plan.²

4. Avoid the old open-source server. Notion says its open-source notion-mcp-server is no longer actively maintained.³

What a config scanner sees

A Notion entry is a URL, so a file-based scanner sees almost nothing. In our run of deedglass 0.13.0’s scan, the Notion server added no write paths to the grade.⁸ Everything that matters, the account and the client’s approval settings, lives outside the config file.

A checklist

• The connection uses https://mcp.notion.com/mcp, not a third-party URL or the old package.
• The Notion account behind it can reach only the teamspaces the agent needs.
• Your client asks before notion-delete-*, notion-move-pages and notion-update-*.
• No “always allow” on those tools.
• Notion isn’t in the same agent session as a web, email or messaging tool.
• A workspace owner has reviewed the connected clients.

Questions people ask

Can Notion MCP delete pages?

It can move up to 20 pages or databases to Trash per call with notion-delete-pages and notion-delete-databases, and they can be restored. The call needs user_confirmed: true.⁴

Does Notion MCP have a read-only mode?

Notion’s docs describe no read-only mode for the hosted server; a client can read and update anything the user can access.¹ Narrow it with client-side tool filters and a less-privileged account.

Is the notion-mcp-server package still maintained?

No. Notion says the open-source server is no longer actively maintained and recommends the hosted server.³

For the approval side, see human-in-the-loop approval and how to require approval for MCP tool calls. Where each client keeps its config is in the config paths table, and the broader review is the ten-minute MCP config audit. The trifecta itself is explained in the lethal trifecta post.

To see what the rest of your agent setup can change, run npx deedglass scan in the repository (what the grade means), or watch the checks in the playground.

Written with AI assistance and checked against our claims register.