notion-mcp-server

makenotion/notion-mcp-server

This project is Notion's local Model Context Protocol (MCP) server that exposes Notion API endpoints as tools for AI agents. The main risk is that tool path parameters are not URL-encoded or validated, allowing prompt-injected arguments to traverse URL paths and call Notion API endpoints outside the exposed tool set using the user's integration token.

What it can reach

Network

Makes authenticated HTTPS requests to https://api.notion.com (or a configured BASE_URL) and optionally listens as an HTTP server on 127.0.0.1:3000 when run with --transport http.

Secrets

Reads Notion integration credentials and server auth tokens from NOTION_TOKEN, OPENAPI_MCP_HEADERS, AUTH_TOKEN, and optional per-request HTTP headers.

Files

Reads the bundled OpenAPI specification file and, in HTTP transport mode when no auth token is configured, writes a generated bearer token file to the system temporary directory.

Findings

1. MediumUnencoded path parameters allow Notion API path traversal across endpoints

   src/openapi-mcp-server/client/http-client.ts:131

   Tool arguments mapped to OpenAPI path parameters (such as page_id, block_id, database_id, data_source_id, and user_id) are passed directly to openapi-client-axios without URL encoding or format validation, while all remaining arguments are forwarded in the request body. Through prompt injection, an attacker can pass values containing '../' or query strings (for example, setting block_id or page_id to '../...') to invoke Notion API endpoints that were intentionally omitted from the MCP server's OpenAPI specification.

   Fix: Validate path parameters against their expected format (such as UUIDs) and apply encodeURIComponent() to every path parameter value before passing urlParameters to openapi-client-axios, or reject values containing '/', '..', '?', or '#'.

2. LowAuto-generated HTTP auth token is written to a predictable temporary file without exclusive creation

   scripts/start-server.ts:53

   When started with '--transport http' and no explicit auth token, the server writes the generated bearer token to a predictable path in os.tmpdir() ('.notion-mcp-auth-token-<pid>') using fs.writeFileSync without the exclusive creation flag ('wx') and never removes the file on exit. On multi-user systems, a local attacker could pre-create the file or a symlink to intercept the token, or read leftover token files.

   Fix: Create the token file inside a private directory created with fs.mkdtempSync, write the file using flag 'wx' with mode 0o600, and delete the file on process exit.

3. LowHTTP transport stores MCP sessions in memory without an upper bound or idle timeout

   scripts/start-server.ts:171

   In HTTP transport mode, every initialize request allocates a new StreamableHTTPServerTransport and MCPProxy instance and stores it in the in-memory transports map until an explicit close or DELETE request occurs. There is no cap on active sessions or idle expiration, which can lead to memory exhaustion if many sessions are opened.

   Fix: Enforce a maximum number of concurrent sessions and evict idle sessions after a configurable timeout.