@notionhq/notion-mcp-server

Security Hardening Guide: Notion MCP Server

Least-privilege permissions

• Create a dedicated Notion API key solely for the AI agent, separate from personal keys. This limits damage if the key leaks—the attacker only accesses what that specific key allows.
• Restrict database access by using Notion's sharing settings to grant the key access only to required databases, not your entire workspace. Think of it like giving a delivery person keys to one room instead of all rooms in a building.
• Use read-only access where possible. If the agent only needs to retrieve information, configure its permissions to read data without the ability to modify or delete anything.
• Rotate the API key regularly (every 90 days recommended). Treat it like changing a password—old keys should be disabled after you create a replacement.

Network isolation

• Restrict where the agent runs. Deploy it only on secure, controlled infrastructure (like company servers), not on public or shared cloud services where other applications could access the API key.
• Use a firewall or VPN to limit which services can communicate with the Notion API endpoint. Only your agent should be able to make requests, not random internet traffic.
• Keep the API key in a secrets manager (like your company's password vault), never hardcode it in configuration files or visible in code repositories.

Monitoring

• Enable Notion workspace audit logs and review them weekly for unexpected changes—look for database modifications, permission changes, or access from unfamiliar times. Notion logs who changed what and when.
• Set up alerts if the API key makes unusually large data requests or accesses databases it shouldn't. Most monitoring tools can flag abnormal activity patterns.
• Track MCP server updates by subscribing to security notices for the @notionhq/notion-mcp-server npm package, and apply patches within 7 days of release.

Red flags to watch for

• Unexpected database changes: If data appears modified, deleted, or reorganized without your agent being asked to do that task, the agent or key may be compromised.
• Slow Notion performance or large data movements: An attacker using a compromised key might be downloading your entire workspace—monitor for unusual bandwidth or API rate limits being hit.
• The AI agent suggests actions that seem wrong: If the agent tries to delete information, share sensitive data externally, or modify data you didn't ask it to touch, stop and revoke the key immediately. This indicates prompt injection (attacker manipulating the agent through text).
• Security warnings from your npm dependency scanner: If your development tools flag vulnerabilities in the Notion package, update or disable the agent until patches are available.