Notion MCP server

What it does

Notion runs this server at https://mcp.notion.com/mcp. An agent connected to it can search your workspace, read pages and databases, query database rows with SQL, and create or edit pages, databases, views and comments. It acts as the person who signed in, so it reaches whatever that person can reach in the chosen workspace. Only workspace members can connect. Guests cannot.

Tools

The hosted server listed 49 tools to a connected client on Oct 16, 2026. Notion's supported tools page describes a few more, such as notion-delete-pages and comment editing, which did not appear in that list. Which tools you get depends on your plan, so run notion-get-tool-access to see your own.

Search and read

Pages, databases and views

Comments, people and teams

Files and folders

Skills

Custom Agent sessions

These need Notion AI and access to Custom Agents.

Plan and access

Set it up

Directly

In Claude Code, add the server and sign in:

claude mcp add --transport http notion https://mcp.notion.com/mcp

Then run /mcp in a session and finish the OAuth flow in your browser. For Cursor, put this in .cursor/mcp.json in the project, or in ~/.cursor/mcp.json for every project:

{
  "mcpServers": {
    "notion": {
      "url": "https://mcp.notion.com/mcp"
    }
  }
}

Enable Notion in Cursor's MCP settings and complete the sign-in. If your client cannot do Streamable HTTP, Notion also serves https://mcp.notion.com/sse. Business and Enterprise workspaces can skip the browser sign-in: a workspace owner creates a token with New MCP token in Notion's developer portal, and the client sends it as a bearer token. Notion's connection guide has the details, and the general client steps are in How to add MCP servers to Claude Code and How to set up MCP servers in Cursor.

Through Statio

Install Notion from the catalog and press Connect. You approve access on Notion's own page and land back on the server. The connection belongs to your organization, so one person connects it and everyone granted the server uses it. Nothing is granted by default, so grant the tools you want under Permissions.

The Statio desktop app then writes the client config for you. By hand, Cursor points at the local proxy, using the server name shown in your dashboard:

{
  "mcpServers": {
    "notion": {
      "url": "http://127.0.0.1:7777/notion/mcp"
    }
  }
}

For Claude Code, run mcphub config claude-code. Start a new session afterwards so the client reloads its tools. If the tools don't show up, see How to debug an MCP server that won't connect.

What to hold back

Notion is where teams keep specs, runbooks and meeting notes, which makes it the first thing people hand an agent for context. Most of those agents only need notion-search, notion-fetch and notion-query-data-sources. The write tools here edit shared documents as you, and several of them are hard to undo.

• notion-update-page can replace a page's whole body. On a page with subpages, a replace can delete them. A writing agent asked to "tidy up the onboarding doc" can take the nested pages with it.
• notion-update-data-source runs schema DDL. DROP COLUMN removes a property from every row at once, and an ALTER COLUMN on a select property drops any option the agent didn't list. Its in_trash flag moves the whole data source to Trash. Keep it from anything that only fills in rows.
• notion-move-pages changes a page's parent. Pages usually take their sharing from where they sit, so a move can put a private page in a teamspace, or hide a shared one.
• notion-create-comment posts under your name. A summariser that comments on every page it reads becomes noise in other people's notifications.
• notion-upload-skill, notion-convert-page-to-skill and notion-update-enabled-skills write instructions that agents load later. An agent that read a hostile page could turn that text into a standing instruction. Treat these as admin tools.
• notion-spawn-session and notion-send-message-to-session hand work to a Notion Custom Agent. What that agent then does in Notion runs on its own setup, outside the tools you granted here.

Reading carries its own risk. Anyone who can edit a page can plant text that an agent will read as instructions, so an agent that reads Notion and can also write somewhere else is the case to watch. The lethal trifecta: how AI agents leak data covers that pattern. Per-tool grants are how you keep the write side off, and MCP permissions explains how they work.

Questions