Tracked packageView full profile for mcp-notion-server →

MCPSafe.io

Security pre-install checks for MCP servers.

Mostly safe — a couple of notes worth reading.

Compare to another server

github · mcp-notion-serverHEAD

Item: mcp-notion-server
Rating: 4
Author: MCPSafe

Scanned 5/3/2026, 7:18:38 PM·Cached result·Fast Scan·45 rules·How we decide ↗

AIVSS Score

2.8/ 10

Low

Severity Breakdown

critical

high

medium

low

MCP Server Information

Packagemcp-notion-server

VersionHEAD

SourceGITHUB

LicenseMIT

Publishersuekou

Package age1y 5m

Stars884

Downloads/wk—

Dependencies0

Repositoryhttps://github.com/suekou/mcp-notion-server

Findings

3 of 3 findings

medium (3)

3 findings

medium (3)

AIVSS 2.8CVSS 3.5

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

Evidence

server.setRequestHandler(
    CallToolRequestSchema,
    async (request: CallToolRequest) => {
      console.error("Received CallToolRequest:", request);
      try {
        if (!request.params.arguments) {
          throw new Error("No arguments provided");

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Report false positive →

AIVSS 2.5CVSS 4.0

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

Evidence

if (start_cursor) params.append("start_cursor", start_cursor);
    if (page_size) params.append("page_size", page_size.toString());

    const response = await fetch(`${this.baseUrl}/users?${params.toString()}`, {
      method: "GET",
      headers: this.headers,
    });

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Report false positive →

AIVSS 2.3CVSS 3.5

Package declares an install-time hook (npm postinstall/preinstall/prepare, setup.py cmdclass override, custom setuptools install class, or non-default pyproject build-backend). Anyone installing this package runs the hook. Confirm the hook is necessary and review its contents; prefer shipping a plain library without install-time execution.

Evidence

],
  "scripts": {
    "build": "tsc && node -e \"require('fs').chmodSync('build/index.js', '755')\"",
    "prepare": "npm run build",
    "watch": "tsc --watch",
    "inspector": "npx @modelcontextprotocol/inspector build/index.js",
    "test": "vitest run",

Remediation

Prefer libraries that do not require install-time code execution: - Drop `postinstall`/`preinstall`/`prepare` scripts if the work can happen at runtime or build-time instead. - Ship pre-built native binaries rather than compiling via a custom `cmdclass` or `build_ext` override. - For Dockerfiles: replace `RUN curl … | sh` with a pinned download + checksum verification + explicit `RUN` of a named script. - If the hook is unavoidable, document exactly what it does so downstream reviewers

Report false positive →

LLM summary— mcp-notion-server:HEAD

This package receives a B grade with a safety score of 90/100 but carries moderate security concerns including an ANSI escape injection vulnerability, a resource exhaustion risk, and a server configuration issue. While no critical or high-severity flaws were found, the three medium-severity findings warrant review before installation, particularly the injection vulnerability which could affect terminal output handling.

Signal scores

CVE check100

Static92

Publisher identity50

Permissions100

Supply chain92

Typosquat100

Package health85

Community82

Secrets & exfil100

Injection risks92

Destructive ops100

LLM judge panel

CVE check

No known CVEs found for this package or its dependencies.

Community trust

No community reports

Security policy: Not found
Advisories: 0

Scan details

Total findings: 3
Affected tools: 0 / 1
Scan type: Fast Scan
Rules run: 45
LLM consensus score: N/A
Scanned: 11d ago
Source: GITHUB

MCP Server Information

Source: GITHUB
Package: mcp-notion-server
Version: HEAD
License: MIT
Publisher: suekou
Verified: No
Account age: 2y 10m
Added: 1y 5m ago
Versions: 884
Repository: https://github.com/suekou/mcp-notion-server
Ecosystem: GitHub
Stars: 884
Forks: 171
Open issues: 17
Dependencies: 0

AIVSS Score

2.8/ 10Low

Internal score: 90/100

Severity breakdown

Scan Details

Total findings3

Affected tools0 / 1

Scanned11d ago

Scan modeFAST

SourceGITHUB

Scan IDpubfaste252a9368fab36ce8501

Want deeper analysis?

Fast scan found 3 findings using rule-based analysis. Upgrade for LLM consensus across 5 judges, AI-generated remediation, and cross-file taint analysis.

View plans Scan another package

Building your own MCP server?

Run this exact engine on your private repo — before users see it on /scan.

Same rules, same LLM judges, same grade. Private scans stay isolated to your account and never appear in the public registry. Required for code your team hasn’t shipped yet.

See plans with Private scans How private scans stay private

3 of 3 findings

medium (3)

3 findings

medium (3)

AIVSS 2.8CVSS 3.5

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

Evidence

server.setRequestHandler(
    CallToolRequestSchema,
    async (request: CallToolRequest) => {
      console.error("Received CallToolRequest:", request);
      try {
        if (!request.params.arguments) {
          throw new Error("No arguments provided");

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Report false positive →

AIVSS 2.5CVSS 4.0

Evidence

if (start_cursor) params.append("start_cursor", start_cursor);
    if (page_size) params.append("page_size", page_size.toString());

    const response = await fetch(`${this.baseUrl}/users?${params.toString()}`, {
      method: "GET",
      headers: this.headers,
    });

Remediation

Report false positive →

AIVSS 2.3CVSS 3.5

Evidence

],
  "scripts": {
    "build": "tsc && node -e \"require('fs').chmodSync('build/index.js', '755')\"",
    "prepare": "npm run build",
    "watch": "tsc --watch",
    "inspector": "npx @modelcontextprotocol/inspector build/index.js",
    "test": "vitest run",

Remediation

Report false positive →

131	if (start_cursor) params.append("start_cursor", start_cursor);
132	if (page_size) params.append("page_size", page_size.toString());
133
134	const response = await fetch(`${this.baseUrl}/users?${params.toString()}`, {
135	method: "GET",
136	headers: this.headers,
137	});

131	if (start_cursor) params.append("start_cursor", start_cursor);
132	if (page_size) params.append("page_size", page_size.toString());
133
134	const response = await fetch(`${this.baseUrl}/users?${params.toString()}`, {
135	method: "GET",
136	headers: this.headers,
137	});

39	server.setRequestHandler(
40	CallToolRequestSchema,
41	async (request: CallToolRequest) => {
42	console.error("Received CallToolRequest:", request);
43	try {
44	if (!request.params.arguments) {
45	throw new Error("No arguments provided");

15	],
16	"scripts": {
17	"build": "tsc && node -e \"require('fs').chmodSync('build/index.js', '755')\"",
18	"prepare": "npm run build",
19	"watch": "tsc --watch",
20	"inspector": "npx @modelcontextprotocol/inspector build/index.js",
21	"test": "vitest run",