notion_mcp: why it is not safe to use
Our review did not identify security or privacy issues in notion_mcp; it passed based on a limited, readable Notion-only task update scope.
What we found
Our review of `notion_mcp` did not find issues that would block use under our security and privacy checks. The repository is short and readable, with no encoded or hidden payloads, and we did not find hidden instructions in the README or source. The tool scope is narrow: it creates tasks and marks tasks complete in a user-connected Notion database.
We found no hardcoded secrets. The code expects `NOTION_API_KEY` and `NOTION_DATABASE_ID` from a local `.env` file, and `.env` is gitignored. Network activity appears limited to ordinary HTTPS calls to the configured Notion API for the connected database. We did not see evidence of remote code fetching, unrelated credential access, privilege changes, or delete functionality.
This is a point-in-time review of the current repository state and described behavior.
What to do instead
If you use this skill, keep the connected Notion integration scoped only to the database it needs, store the API key locally, and review requested actions before running them. If you need broader workspace automation, apply the same checks to any additional skills or integrations before enabling them.
Source: https://github.com/danhilse/notion_mcp
We report what our security review found at the time we checked, with the goal of keeping people safe. Projects change; if a maintainer has since fixed this, we are glad to recheck it. Email hello@agentpod.com.