How to Set Up the Notion MCP Server: Connect AI to Your Workspace Safely

The Notion MCP server turns your workspace into something an AI assistant can actually work with: search pages, query databases, create meeting notes, update project trackers. But your Notion workspace is also where the sensitive stuff lives — roadmaps, salaries, customer notes. The default setup ties an integration token with workspace access into a plaintext config file on someone’s laptop, with zero visibility into what the model reads or writes.

Here’s the better path: run the Notion MCP server hosted on MCP Trail, keep the credential server-side, and get an audit trail of every page the AI touches. No npm, no Node, no config-file surgery.

Why host the Notion MCP server behind a gateway?

• Your Notion credentials stay out of client configs — the OAuth connection lives in an encrypted vault and is injected at runtime
• Full audit trail of every search, read, and page edit the assistant performs
• DLP scanning can redact or block sensitive strings (API keys, personal data) flowing out of your workspace
• Write operations can require approval — page edits wait for a human sign-off if you want them to

What you’ll need

1. A Notion account — that’s it. Authorization is one-click OAuth; no internal integration or token to create
2. A free MCP Trail account
3. An MCP client — Claude Desktop, Claude Code, Cursor, or similar

Step 1: Create your free MCP Trail account

Sign up at app.mcptrail.com. The free tier is enough for this whole tutorial.

Step 2: Connect Notion from the MCP Marketplace

Open MCP Marketplace in the sidebar, search for Notion, and click Connect.

Step 3: Connect your Notion workspace (one-click OAuth)

No integration to build, no token to paste. The wizard shows a Connect account step — click it and Notion’s own authorization popup opens, asking which workspace and which pages to grant access to. Approve, and you’re connected.

MCP Trail’s OAuth broker stores the resulting access in an encrypted per-user vault, injects it into the hosted server at runtime, and refreshes it automatically. It never appears on the client side, and you can disconnect the workspace at any time from Vault in the sidebar.

Scope tip: Notion’s consent screen lets you pick exactly which pages to share. Grant a dedicated top-level page or a few databases rather than the whole workspace — least privilege starts here.

Step 4: Watch the server come online

The wizard boots the hosted runtime, completes the MCP handshake, and lists the Notion tools it discovered (search, page reads, database queries, page creation). Green checks mean you’re live.

Step 5: Connect your AI client

Click Connect an agent and pick your client — the panel generates the exact snippet. Under the hood it’s one HTTP endpoint plus a bearer token:

{
  "mcpServers": {
    "notion": {
      "url": "https://<your-endpoint>",
      "headers": { "Authorization": "Bearer <your-token>" }
    }
  }
}

Or with Claude Code:

claude mcp add --transport http notion "https://<your-endpoint>" \
  --header "Authorization: Bearer <your-token>"

Step 6: Verify it works

Try a real prompt:

Search my Notion workspace for the Q3 planning page and summarize it

Then open Audit log in the sidebar. You’ll see the exact tool calls — which pages were searched, which were read — with timestamps and arguments.

Protect what the AI can do in Notion

A knowledge base has a different risk profile than a code repo: the danger is mostly data leaving and pages being overwritten. Two controls worth switching on:

• Custom DLP rules (sidebar → Custom DLP rules): block or redact patterns like customer emails or internal project codenames in tool results
• Approval for writes: set page-creation and update tools to route through the Approval queue, so the assistant drafts but a human approves

Prefer to run it locally?

You can run Notion’s MCP server locally via npx with NOTION_TOKEN set in your client config. It works — but the token sits in plaintext, nothing is logged, and every teammate repeats the setup. Hosted is the sturdier default for teams.

FAQ

Which Notion pages can the MCP server see?

Only the pages and databases you selected on Notion’s OAuth consent screen when connecting. MCP Trail adds gateway-level controls on top; it can’t widen Notion-side permissions.

Can the AI edit or delete my Notion pages?

Only if the tools for it are enabled. On MCP Trail you can disable write tools entirely, or leave them on behind human approval — the safest middle ground.

Does this work with Claude Desktop and Cursor?

Yes. Any MCP client that supports HTTP servers connects with the endpoint URL and bearer token; the Connect an agent panel generates ready-made configs for both.

Is there a free tier?

Yes — signing up at app.mcptrail.com is free and covers this whole setup, including the audit log.

Related Articles

• How to Set Up the GitHub MCP Server
• How to Set Up the Slack MCP Server
• How to Protect Sensitive Data When Using MCP Servers
• How to Combine Multiple MCP Servers into One Endpoint
• MCP Security Best Practices

Ready to connect your workspace? Create your free MCP Trail account and set up Notion in minutes.