Notion MCP Server — agentic threat model

Not certain from the listing — The MCP server itself does not bundle a specific foundation model, but it is designed to be consumed by LLMs. The primary L1 threat is that the consuming model can be manipulated via adversarial prompt injection contained within retrieved Notion pages.

The agent directly queries and updates Notion databases and pages. The primary threat is data poisoning (injecting malicious instructions into Notion pages to hijack the consuming agent) and data exfiltration of sensitive workspace content via read tools.

The server exposes tools for searching, reading, querying, and updating Notion. Framework-level threats include tool misuse and insecure tool integration, where an LLM is tricked into executing unintended update or write commands on the workspace.

The server relies on a NOTION_API_TOKEN for authentication. Infrastructure threats include the exposure or theft of this token, which grants full access to all Notion pages shared with the integration, potentially leading to unauthorized API access outside the MCP context.

Not certain from the listing — There is no mention of built-in logging, audit trails, or guardrails to monitor what queries are executed or to detect anomalous data modification patterns before they are committed to Notion.

Authorization is binary and scoped at the integration level via NOTION_API_TOKEN. There is a lack of fine-grained access control (e.g., read-only vs. write-only scopes) within the MCP server itself, relying entirely on Notion's native sharing model.

As an MCP server, this agent is designed to be plugged into broader multi-agent or orchestrator ecosystems. A compromised or malicious orchestrator agent could abuse this server to systematically scrape or corrupt an entire corporate knowledge base.