notion-mcp-server 2.5.1 → 2.6.1

package/README.md

@@ -211,6 +211,7 @@ If you ran a v1.x setup, **nothing in your environment needs to change**. Both e
 | `NOTION_RATE_LIMIT` | ✅ New, optional | Requests per second for the shared limiter. Defaults to `3` (Notion's documented per-integration limit). |
 | `NOTION_ALLOWED_OPERATIONS` | ✅ New, optional | Comma-separated allowlist of operations or group presets (`read`, `write`, `destructive`, plus per-domain groups `pages`, `blocks`, `databases`, `data_sources`, `comments`, `users`, `files`). Unset ⇒ all operations enabled. See [Restricting operations](#restricting-operations). |
 | `NOTION_BLOCKED_OPERATIONS` | ✅ New, optional | Comma-separated blocklist (same token vocabulary). Applied after the allowlist, so a blocked operation is always disabled. |
+| `NOTION_READ_ONLY` | ✅ New, optional | Set to `true`/`1`/`yes` to disable every write operation in one switch (equivalent to `NOTION_BLOCKED_OPERATIONS=write`). Composes with the allow/block lists. See [Restricting operations](#restricting-operations). |
 | `NOTION_DAILY_LOG_PAGE_ID` | ✅ Optional | Used only by the daily-log MCP prompt. Ignore if you don't call that prompt. |
 
 The only v2 break is the **tool surface itself** — v1's `notion_pages`, `notion_blocks`, `notion_database`, `notion_comments`, `notion_users` are replaced by `notion_execute` and `notion_describe`. Modern MCP clients (Claude Code, Cursor, Claude Desktop) rediscover tools at startup, so they pick up the new surface automatically. If your client hard-codes the v1 tool names, see [MIGRATION.md](./MIGRATION.md) for the rename map.
@@ -302,8 +303,8 @@ Unknown tokens and a fail-closed allowlist are logged there too. If the count or
   operations can also remove content via a parameter — e.g. `update_database` /
   `update_data_source` accept `in_trash`, and `update_page_markdown` can replace a page
   body. Blocking `destructive` does **not** disable those write ops. **For a guaranteed
-  no-mutation deployment, use the allowlist** (`NOTION_ALLOWED_OPERATIONS=read`), which
-  excludes every write operation.
+  no-mutation deployment, use the allowlist** (`NOTION_ALLOWED_OPERATIONS=read`) or the
+  shorthand `NOTION_READ_ONLY=true` — both leave only read operations enabled.
 - MCP *prompts* (e.g. the daily-log prompt) may still reference operations you have
   disabled. The prompt text is unaffected by the allowlist; the underlying operation is
   still rejected at execution time.
@@ -475,6 +476,18 @@ Return the JSON Schema + working example for a single operation. Use this when y
 
 The authoritative list (with batchability) is also served as an MCP resource at `notion://operations` — useful as a one-shot cheat sheet for the LLM.
 
+### MCP resources
+
+The server exposes three resources, so clients that support resource attachment (`@`-mention) can pull Notion content into context without a tool call:
+
+| Resource URI | Returns |
+| --- | --- |
+| `notion://operations` | Markdown cheat sheet of every enabled operation. |
+| `notion://page/<page_id>` | The page body as markdown. |
+| `notion://database/<data_source_id>` | The data source's schema as JSON. |
+
+The dynamic page/database resources route through the same auth, rate limiting, and access gating as tool calls — a page disabled by your allow/block config (or `NOTION_READ_ONLY`) returns an error envelope, not content.
+
 ---
 
 ## 🛠 Development

package/build/config/index.js

@@ -1,7 +1,14 @@
+import { createRequire } from "node:module";
+// Read the version straight from package.json so the MCP handshake always
+// reports the real published version instead of a hand-maintained constant
+// that silently drifts. createRequire resolves relative to this module, which
+// is two levels deep in both src/ (src/config/index.ts) and build/.
+const require = createRequire(import.meta.url);
+const pkg = require("../../package.json");
 // Configuration
 export const CONFIG = {
     serverName: "notion-mcp-server",
     serverTitle: "Notion",
-    serverVersion: "1.4.0",
+    serverVersion: pkg.version,
     serverUrl: "https://github.com/awkoy/notion-mcp-server",
 };

package/build/operations/access.js

@@ -1,6 +1,13 @@
 import { listOperations } from "./registry.js";
 export const ALLOWED_ENV_VAR = "NOTION_ALLOWED_OPERATIONS";
 export const BLOCKED_ENV_VAR = "NOTION_BLOCKED_OPERATIONS";
+export const READ_ONLY_ENV_VAR = "NOTION_READ_ONLY";
+/** Interpret common truthy strings ("true", "1", "yes", "on") as enabling read-only mode. */
+export function parseReadOnly(raw) {
+    if (!raw)
+        return false;
+    return ["true", "1", "yes", "on"].includes(raw.trim().toLowerCase());
+}
 function parseList(raw) {
     if (!raw)
         return [];
@@ -35,8 +42,8 @@ function expandToken(token, ops) {
             return ops.some((o) => o.name === token) ? [token] : null;
     }
 }
-/** Pure resolver: (ops, allow, block) -> enabled set. No env / registry access. */
-export function resolveEnabled(ops, allowEnv, blockEnv) {
+/** Pure resolver: (ops, allow, block, readOnly) -> enabled set. No env / registry access. */
+export function resolveEnabled(ops, allowEnv, blockEnv, readOnly = false) {
     const warnings = [];
     const expand = (tokens, label) => {
         const set = new Set();
@@ -55,6 +62,13 @@ export function resolveEnabled(ops, allowEnv, blockEnv) {
         ? expand(parseList(allowEnv), ALLOWED_ENV_VAR)
         : new Set(ops.map((o) => o.name));
     const blockSet = expand(parseList(blockEnv), BLOCKED_ENV_VAR);
+    // Read-only mode is sugar for "block every write op" — it layers onto the
+    // blocklist so it composes with any allow/block configuration already set.
+    if (readOnly) {
+        for (const o of ops)
+            if (o.access === "write")
+                blockSet.add(o.name);
+    }
     const enabled = new Set([...allowSet].filter((n) => !blockSet.has(n)));
     // An allowlist that resolves to nothing executable — every token invalid, or
     // every allowed op also blocked — is a misconfiguration. Surface it loudly
@@ -71,7 +85,7 @@ function compute() {
         domain: o.domain,
         destructive: o.destructive,
     }));
-    const result = resolveEnabled(ops, process.env[ALLOWED_ENV_VAR], process.env[BLOCKED_ENV_VAR]);
+    const result = resolveEnabled(ops, process.env[ALLOWED_ENV_VAR], process.env[BLOCKED_ENV_VAR], parseReadOnly(process.env[READ_ONLY_ENV_VAR]));
     for (const w of result.warnings) {
         console.error(`[operation-access] ${w}`);
     }
@@ -110,6 +124,7 @@ export function accessSummary() {
         total: listOperations().length,
         allow: process.env[ALLOWED_ENV_VAR]?.trim() || "(all)",
         block: process.env[BLOCKED_ENV_VAR]?.trim() || "(none)",
+        readOnly: parseReadOnly(process.env[READ_ONLY_ENV_VAR]),
     };
 }
 /** Clear the memoized result so the next call re-reads env. Used by tests. */

package/build/tools/index.js

@@ -1,5 +1,7 @@
 import { z } from "zod";
+import { ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { server } from "../server/index.js";
+import { readNotionResource } from "./resources.js";
 import { initOperations, getOperation } from "../operations/index.js";
 import { isOperationAllowed, operationNotAllowedError, enabledOperationNames, enabledOperations, accessSummary, } from "../operations/access.js";
 import { dispatch } from "../dispatch/index.js";
@@ -105,9 +107,28 @@ export async function registerAllTools() {
             },
         ],
     }));
+    // Dynamic resources: let clients @-mention / attach a Notion page or database
+    // by id. Pages come back as markdown; databases as their (slim) schema JSON.
+    const firstVar = (v) => (Array.isArray(v) ? v[0] : v);
+    server.registerResource("notion-page", new ResourceTemplate("notion://page/{pageId}", { list: undefined }), {
+        title: "Notion page (markdown)",
+        description: "Read any Notion page as markdown by id — notion://page/<page_id>.",
+        mimeType: "text/markdown",
+    }, async (uri, variables) => {
+        const { mimeType, text } = await readNotionResource("page", firstVar(variables.pageId));
+        return { contents: [{ uri: uri.href, mimeType, text }] };
+    });
+    server.registerResource("notion-database", new ResourceTemplate("notion://database/{dataSourceId}", { list: undefined }), {
+        title: "Notion database (schema)",
+        description: "Read a Notion data source's schema by id — notion://database/<data_source_id>.",
+        mimeType: "application/json",
+    }, async (uri, variables) => {
+        const { mimeType, text } = await readNotionResource("database", firstVar(variables.dataSourceId));
+        return { contents: [{ uri: uri.href, mimeType, text }] };
+    });
     registerAllPrompts();
     const s = accessSummary();
-    console.error(`Operation access: ${s.enabled}/${s.total} enabled (allow=${s.allow}; block=${s.block})`);
+    console.error(`Operation access: ${s.enabled}/${s.total} enabled (allow=${s.allow}; block=${s.block}${s.readOnly ? "; read-only" : ""})`);
 }
 function renderOperationsIndex() {
     const lines = [

package/build/tools/resources.js

@@ -0,0 +1,28 @@
+import { dispatch } from "../dispatch/index.js";
+/**
+ * Read a Notion entity for exposure as an MCP resource. Routes through the
+ * normal dispatch path so resource reads share the same auth, rate limiting,
+ * retry, and access gating as tool calls. A failed read returns the error
+ * envelope as JSON rather than throwing, so the client still gets a body.
+ */
+export async function readNotionResource(kind, id) {
+    if (kind === "page") {
+        const result = await dispatch("get_page_markdown", { page_id: id });
+        if (result.ok && "data" in result) {
+            const data = result.data;
+            return { mimeType: "text/markdown", text: data.markdown ?? "" };
+        }
+        return errorContent(result);
+    }
+    const result = await dispatch("get_data_source", { data_source_id: id });
+    if (result.ok && "data" in result) {
+        return { mimeType: "application/json", text: JSON.stringify(result.data) };
+    }
+    return errorContent(result);
+}
+function errorContent(result) {
+    const error = result && typeof result === "object" && "error" in result
+        ? result.error
+        : result;
+    return { mimeType: "application/json", text: JSON.stringify(error) };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "notion-mcp-server",
-  "version": "2.5.1",
+  "version": "2.6.1",
   "type": "module",
   "bin": {
     "notion-mcp-server": "build/index.js"