notion-mcp-server 2.6.1 → 2.8.0

package/README.md

@@ -26,6 +26,7 @@ An agent-first **Notion MCP server** (Model Context Protocol) that connects Clau
   - [Claude Code / Cursor / Claude Desktop](#claude-code--cursor--claude-desktop)
   - [Docker / Podman / OrbStack](#docker--podman--orbstack)
   - [Optional `NOTION_PAGE_ID`](#optional-notion_page_id)
+- [Remote / HTTP transport](#-remote--http-transport)
 - [Features: what this Notion MCP server does](#-features-what-this-notion-mcp-server-does)
 - [MCP tools for Notion (`notion_execute` & `notion_describe`)](#-mcp-tools-for-notion-notion_execute--notion_describe)
   - [`notion_execute`](#notion_execute)
@@ -246,6 +247,7 @@ blocklist). Each is a comma-separated list of **tokens**, where a token is eithe
 | `blocks` | `get_block` `get_block_children` | `append_blocks` `update_block` `delete_block`† `batch_mixed_blocks`† |
 | `databases` | `query_database` | `create_database` `update_database` |
 | `data_sources` | `list_data_sources` `get_data_source` | `update_data_source` |
+| `views` | `list_views` `get_view` `query_view` | `create_view` `update_view` `delete_view`† |
 | `comments` | `list_comments` `get_comment` | `add_page_comment` `add_discussion_comment` `update_comment` `delete_comment`† |
 | `users` | `list_users` `get_user` `get_bot_user` `get_self` | — |
 | `files` | `list_file_uploads` `get_file_upload` | `upload_file` |
@@ -388,6 +390,49 @@ claude mcp add notion -s user \
 
 ---
 
+## 🌐 Remote / HTTP transport
+
+By default the server speaks **stdio** (the local connector path above). To run it as a remote/hosted endpoint — for web clients, networked agents, or a shared deployment — set `MCP_TRANSPORT=http`:
+
+```bash
+MCP_TRANSPORT=http PORT=3000 NOTION_TOKEN=ntn_xxx npx -y notion-mcp-server
+# -> notion-mcp-server vX.Y.Z running on http://127.0.0.1:3000/mcp
+```
+
+It serves the MCP **Streamable HTTP** protocol at `POST/GET/DELETE /mcp` (stateful sessions via the `mcp-session-id` header) plus an unauthenticated `GET /health`. It's **single-tenant** — every request uses the one `NOTION_TOKEN` the process was started with.
+
+### Configuration
+
+| env | default | meaning |
+| --- | --- | --- |
+| `MCP_TRANSPORT` | `stdio` | set to `http` to enable the HTTP transport |
+| `PORT` | `3000` | listen port (`0` = OS-assigned) |
+| `HOST` | `127.0.0.1` | bind address. Loopback by default; set `0.0.0.0` to expose externally (do this only with `MCP_AUTH_TOKEN`) |
+| `MCP_AUTH_TOKEN` | — | when set, every `/mcp` request must send `Authorization: Bearer <token>` |
+| `MCP_ALLOWED_HOSTS` | localhost + bound host | comma-list for DNS-rebinding `Host` allowlist |
+| `MCP_ALLOWED_ORIGINS` | localhost origins | comma-list for browser `Origin` allowlist |
+
+> ⚠️ **Single-tenant means whoever reaches `/mcp` acts as your `NOTION_TOKEN`.** On loopback (the default) that's just local processes. Before binding a non-loopback `HOST`, set `MCP_AUTH_TOKEN` (the server logs a warning if you don't) and/or put it behind an authenticating reverse proxy.
+
+### Try it
+
+```bash
+# health check
+curl http://127.0.0.1:3000/health
+# -> {"status":"healthy","transport":"http","port":3000}
+
+# point the MCP Inspector at it
+npx @modelcontextprotocol/inspector --transport http --server-url http://127.0.0.1:3000/mcp
+```
+
+In Docker, set the env and publish the port:
+
+```bash
+docker run --rm -e NOTION_TOKEN=ntn_xxx -e MCP_TRANSPORT=http -p 3000:3000 ghcr.io/awkoy/notion-mcp-server
+```
+
+---
+
 ## 🌟 Features: what this Notion MCP server does
 
 - **Two-tool surface** — `notion_execute` (do it) + `notion_describe` (learn the shape). The whole API is one schema deep.
@@ -401,6 +446,7 @@ claude mcp add notion -s user \
 - **File uploads** — `upload_file` handles single-part and multi-part (5 MB chunks) transparently; auto-detects MIME from filename; rejects `application/octet-stream`.
 - **Opt-in auto-pagination** — pass `paginate: true` on `search_pages`, `list_comments`, or `query_database` and the server walks `next_cursor` for you (capped by `page_limit`, default 10 pages ≈ 1000 items at `page_size: 100`). Other list ops return a single Notion page with `has_more` / `next_cursor`.
 - **Typed `where` filter shorthand** — `query_database` accepts a `where` clause like `{Status: {equals: "Done"}, AND: [...]}` with operator objects (`eq`, `ne`, `gte`, `lte`, `contains`, `starts_with`, etc.); the server compiles it to Notion filter JSON. Pass raw Notion `filter` JSON for edge cases the shorthand can't express (the two fields are mutually exclusive).
+- **Database views** — `list_views` / `get_view` / `query_view` plus `create_view` / `update_view` / `delete_view`. `query_view` runs a view's stored filters/sorts and returns hydrated rows by default (`hydrate: false` for ids only); `create_view` / `update_view` reuse the same `where` shorthand for filters and take a raw `configuration` for type-specific layout (calendar/board/timeline/chart/map require it).
 - **Universal MCP compatibility** — Cursor, Claude Desktop, Claude Code, Cline, Zed, Continue, anything that speaks MCP stdio.
 
 ---
@@ -462,7 +508,7 @@ Return the JSON Schema + working example for a single operation. Use this when y
 { "operation": "query_database" }
 ```
 
-### Operations menu (35 ops, plus one alias)
+### Operations menu (41 ops, plus one alias)
 
 | Area | Operations |
 | --- | --- |
@@ -470,6 +516,7 @@ Return the JSON Schema + working example for a single operation. Use this when y
 | **Blocks** | `append_blocks`, `get_block`, `get_block_children`, `update_block`, `delete_block`, `batch_mixed_blocks` |
 | **Databases** | `create_database`, `query_database`, `update_database` |
 | **Data sources** | `list_data_sources`, `get_data_source`, `update_data_source` |
+| **Views** | `list_views`, `get_view`, `query_view`, `create_view`, `update_view`, `delete_view` |
 | **Comments** | `list_comments`, `add_page_comment`, `add_discussion_comment`, `get_comment`, `update_comment`, `delete_comment` |
 | **Users** | `list_users`, `get_user`, `get_bot_user` |
 | **Files** | `upload_file`, `list_file_uploads`, `get_file_upload` |

package/build/config/http.js

@@ -0,0 +1,29 @@
+const DEFAULT_PORT = 3000;
+const DEFAULT_HOST = "127.0.0.1";
+function parseList(raw) {
+    if (!raw)
+        return [];
+    return raw
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean);
+}
+/** Pure: derive the transport config from environment variables. No I/O.
+ *
+ *  `allowedHosts`/`allowedOrigins` are returned as the *explicit* env lists only
+ *  (empty when unset). The localhost defaults depend on the actually-bound port —
+ *  which can differ from `port` when `PORT=0` — so they are filled in by startHttp
+ *  after the socket is listening, not here. */
+export function parseHttpConfig(env) {
+    const transport = (env.MCP_TRANSPORT ?? "").trim().toLowerCase() === "http" ? "http" : "stdio";
+    const portRaw = (env.PORT ?? "").trim();
+    const portNum = Number.parseInt(portRaw, 10);
+    // 0 is valid — it asks the OS for an ephemeral port. Negatives/NaN -> default.
+    const port = Number.isInteger(portNum) && portNum >= 0 ? portNum : DEFAULT_PORT;
+    const host = (env.HOST ?? "").trim() || DEFAULT_HOST;
+    const authTokenRaw = (env.MCP_AUTH_TOKEN ?? "").trim();
+    const authToken = authTokenRaw === "" ? undefined : authTokenRaw;
+    const allowedHosts = parseList(env.MCP_ALLOWED_HOSTS);
+    const allowedOrigins = parseList(env.MCP_ALLOWED_ORIGINS);
+    return { transport, port, host, authToken, allowedHosts, allowedOrigins };
+}

package/build/index.js

@@ -1,10 +1,21 @@
 #!/usr/bin/env node
-import { startServer } from "./server/index.js";
-import { registerAllTools } from "./tools/index.js";
+import { initOperations } from "./operations/index.js";
+import { parseHttpConfig } from "./config/http.js";
+import { startStdio } from "./server/index.js";
 async function main() {
     try {
-        await registerAllTools();
-        await startServer();
+        // Populate the global operation registry once, before any server instance
+        // is built (the HTTP transport builds one server per session).
+        await initOperations();
+        const config = parseHttpConfig(process.env);
+        if (config.transport === "http") {
+            // Lazy import so the stdio path never loads the HTTP stack.
+            const { startHttp } = await import("./server/http.js");
+            await startHttp(config);
+        }
+        else {
+            await startStdio();
+        }
     }
     catch (error) {
         console.error("Unhandled server error:", error instanceof Error ? error.message : String(error));

package/build/operations/access.js

@@ -25,6 +25,7 @@ const DOMAIN_GROUPS = [
     "comments",
     "users",
     "files",
+    "views",
 ];
 /** Expand a single token to op names, or null if it matches no group and no op. */
 function expandToken(token, ops) {

package/build/operations/data-sources.js

@@ -58,7 +58,7 @@ const UpdateDataSourceParams = z.object({
     title: z.array(z.unknown()).optional().describe("Rich text array for the data source title."),
     properties: z.record(z.string(), DATABASE_PROPERTY_SCHEMA).optional(),
     icon: z.unknown().optional(),
-    archived: z.boolean().optional(),
+    archived: z.boolean().optional().describe("Deprecated alias for in_trash (removed on the 2026-03-11 surface). Routed to in_trash."),
     in_trash: z.boolean().optional(),
     verbose: VERBOSE,
 });
@@ -77,13 +77,15 @@ register({
     },
     handler: tryHandler(async ({ data_source_id, title, properties, icon, archived, in_trash, verbose }) => {
         const notion = await getClient();
+        // `archived` was removed on the 2026-03-11 surface; route the legacy alias
+        // into `in_trash` so we never send a field the API rejects.
+        const trash = in_trash ?? archived;
         const body = {
             data_source_id,
             ...(title !== undefined ? { title } : {}),
             ...(properties !== undefined ? { properties } : {}),
             ...(icon !== undefined ? { icon } : {}),
-            ...(archived !== undefined ? { archived } : {}),
-            ...(in_trash !== undefined ? { in_trash } : {}),
+            ...(trash !== undefined ? { in_trash: trash } : {}),
         };
         const response = await notion.dataSources.update(asSdk(body));
         return { ok: true, data: slimDataSource(response, verbose ?? false) };

package/build/operations/index.js

@@ -11,6 +11,7 @@ export async function initOperations() {
         import("./blocks.js"),
         import("./databases.js"),
         import("./data-sources.js"),
+        import("./views.js"),
         import("./comments.js"),
         import("./users.js"),
         import("./files.js"),

package/build/operations/views.js

@@ -0,0 +1,456 @@
+import { z } from "zod";
+import { isFullDatabase } from "@notionhq/client";
+import { getClient } from "../services/notion.js";
+import { register } from "./registry.js";
+import { tryHandler } from "../utils/handler.js";
+import { slimView, slimPage } from "../utils/slim.js";
+import { mapWithConcurrency } from "../dispatch/concurrency.js";
+import { WHERE_SCHEMA, compileWhere } from "../schema/filter-dsl.js";
+import { asSdk, } from "../utils/notion-types.js";
+const VERBOSE = z.boolean().optional();
+// Hydration fans out one pages.retrieve / views.retrieve per id. The dispatch
+// rate limiter only gates the operation as a whole, not these inner calls, so
+// keep the fan-out gentle (matches the dispatch batch default) to avoid bursting
+// past Notion's rate limit — a 429 here would surface as a hydration miss.
+const HYDRATE_CONCURRENCY = 3;
+const VIEW_TYPES = [
+    "table",
+    "board",
+    "list",
+    "calendar",
+    "timeline",
+    "gallery",
+    "form",
+    "chart",
+    "map",
+    "dashboard",
+];
+// View types whose SDK config carries a required field — we require an explicit
+// `configuration` so the call fails locally with a fix instead of a raw API 400.
+const REQUIRES_CONFIG = {
+    calendar: "date_property_id (calendar views group rows by a date property)",
+    timeline: "a timeline date/range configuration",
+    board: "group_by (board views group by a property)",
+    chart: "chart axes/aggregation configuration",
+    map: "a location property configuration",
+};
+// Resolve the (data_source_id, database_id) pair a view is created under.
+// Notion's createView requires BOTH in the body — the data source it targets
+// and the database it lives in — even though the SDK types database_id as
+// optional. We accept either input and look up the other.
+async function resolveViewTarget(notion, database_id, data_source_id) {
+    if (!database_id && !data_source_id) {
+        return {
+            error: {
+                code: "missing_target",
+                message: "Pass data_source_id or database_id.",
+                fix: "Provide data_source_id (preferred) or database_id.",
+            },
+        };
+    }
+    // data_source given without its database → look up the parent database.
+    if (data_source_id && !database_id) {
+        const ds = await notion.dataSources.retrieve({ data_source_id });
+        const parent = ds.parent;
+        const dbId = parent?.type === "database_id" ? parent.database_id : undefined;
+        if (!dbId) {
+            return {
+                error: {
+                    code: "no_parent_database",
+                    message: `Could not resolve the parent database of data source ${data_source_id}.`,
+                    fix: "Pass database_id explicitly alongside data_source_id.",
+                },
+            };
+        }
+        return { data_source_id, database_id: dbId };
+    }
+    // Both given → use as-is.
+    if (data_source_id && database_id) {
+        return { data_source_id, database_id };
+    }
+    // database given without a data source → resolve its single data source.
+    const db = await notion.databases.retrieve({ database_id: database_id });
+    const sources = isFullDatabase(db) ? db.data_sources : [];
+    if (sources.length === 0) {
+        return {
+            error: {
+                code: "no_data_source",
+                message: `Database ${database_id} has no data sources.`,
+                fix: "Pass data_source_id directly, or check the database in Notion.",
+            },
+        };
+    }
+    if (sources.length > 1) {
+        return {
+            error: {
+                code: "multi_source_database",
+                message: `Database ${database_id} has ${sources.length} data sources.`,
+                fix: `Pass data_source_id. Available: ${sources.map((s) => s.id).join(", ")}.`,
+            },
+        };
+    }
+    return { data_source_id: sources[0].id, database_id };
+}
+// Compile the typed `where` DSL into a Notion filter, or pass `filter` through.
+function compileViewFilter(where, filter) {
+    if (where !== undefined && filter !== undefined) {
+        return {
+            ok: false,
+            error: {
+                code: "filter_conflict",
+                message: "Pass `where` (typed DSL) or `filter` (raw JSON), not both.",
+                fix: "Use exactly one of `where` or `filter`.",
+            },
+        };
+    }
+    if (where !== undefined) {
+        try {
+            return { ok: true, filter: compileWhere(where) };
+        }
+        catch (err) {
+            return {
+                ok: false,
+                error: {
+                    code: "where_compile_error",
+                    message: err instanceof Error ? err.message : String(err),
+                    fix: "Check the `where` clause shape, or fall back to raw `filter`.",
+                },
+            };
+        }
+    }
+    if (filter !== undefined)
+        return { ok: true, filter };
+    return { ok: true };
+}
+// ──────────────────────────────────────────────────────────────────────────
+// get_view
+// ──────────────────────────────────────────────────────────────────────────
+const GetViewParams = z.object({
+    view_id: z.string().describe("View ID to retrieve."),
+    verbose: VERBOSE,
+});
+register({
+    name: "get_view",
+    access: "read",
+    domain: "views",
+    description: "Retrieve a single database view's configuration (name, type, filter, sorts, layout).",
+    batchable: true,
+    schema: GetViewParams,
+    example: { view_id: "<view-id>" },
+    handler: tryHandler(async ({ view_id, verbose }) => {
+        const notion = await getClient();
+        const view = await notion.views.retrieve({ view_id });
+        return { ok: true, data: slimView(view, verbose ?? false) };
+    }),
+});
+// ──────────────────────────────────────────────────────────────────────────
+// list_views
+// ──────────────────────────────────────────────────────────────────────────
+const ListViewsParams = z
+    .object({
+    database_id: z.string().optional().describe("List views under this database."),
+    data_source_id: z.string().optional().describe("List views under this data source."),
+    start_cursor: z.string().optional(),
+    page_size: z.number().min(1).max(100).optional(),
+    hydrate: z
+        .boolean()
+        .optional()
+        .describe("Fetch each view's name/type (default true). Set false for a cheap id-only list."),
+    verbose: VERBOSE,
+})
+    .refine((v) => Boolean(v.database_id) || Boolean(v.data_source_id), {
+    message: "Pass database_id or data_source_id.",
+});
+register({
+    name: "list_views",
+    access: "read",
+    domain: "views",
+    description: "List views under a database or data source. Hydrates id-only refs to {id,name,type} by default.",
+    batchable: false,
+    schema: ListViewsParams,
+    example: { database_id: "<database-id>" },
+    handler: tryHandler(async ({ database_id, data_source_id, start_cursor, page_size, hydrate, verbose }) => {
+        const notion = await getClient();
+        const list = await notion.views.list({
+            ...(database_id ? { database_id } : {}),
+            ...(data_source_id ? { data_source_id } : {}),
+            ...(start_cursor ? { start_cursor } : {}),
+            ...(page_size ? { page_size } : {}),
+        });
+        const refs = (list.results ?? []);
+        const envelope = {
+            has_more: list.has_more ?? false,
+            next_cursor: list.next_cursor ?? null,
+        };
+        if (hydrate === false) {
+            return { ok: true, data: { results: refs.map((r) => ({ id: r.id })), ...envelope } };
+        }
+        const results = await mapWithConcurrency(refs, HYDRATE_CONCURRENCY, async (ref) => {
+            const view = await notion.views.retrieve({ view_id: ref.id });
+            return slimView(view, verbose ?? false);
+        });
+        return { ok: true, data: { results, ...envelope } };
+    }),
+});
+// ──────────────────────────────────────────────────────────────────────────
+// query_view
+// ──────────────────────────────────────────────────────────────────────────
+const DEFAULT_PAGE_SIZE = 100;
+const MAX_PAGE_SIZE = 100;
+const DEFAULT_ITEM_LIMIT = 1000;
+const MAX_ITEM_LIMIT = 1000;
+const QueryViewParams = z.object({
+    view_id: z.string().describe("View ID. Executes the view's stored filters/sorts server-side."),
+    page_size: z.number().min(1).max(MAX_PAGE_SIZE).optional(),
+    paginate: z.boolean().optional().describe("Walk all result pages, up to page_limit rows."),
+    page_limit: z
+        .number()
+        .min(1)
+        .max(MAX_ITEM_LIMIT)
+        .optional()
+        .describe(`Max rows when paginate:true (default ${DEFAULT_ITEM_LIMIT}).`),
+    hydrate: z
+        .boolean()
+        .optional()
+        .describe("Fetch full row data for each result (default true). Set false to return ordered ids only."),
+    verbose: VERBOSE,
+});
+register({
+    name: "query_view",
+    access: "read",
+    domain: "views",
+    description: "Query a view: runs its stored filters/sorts and returns the matching rows. Hydrates row data by default.",
+    batchable: false,
+    schema: QueryViewParams,
+    example: { view_id: "<view-id>", page_size: 50 },
+    handler: tryHandler(async ({ view_id, page_size, paginate, page_limit, hydrate, verbose, }) => {
+        const notion = await getClient();
+        const pageSize = page_size ?? DEFAULT_PAGE_SIZE;
+        const doHydrate = hydrate !== false;
+        const hydrateIds = async (refs) => {
+            if (!doHydrate)
+                return refs.map((r) => ({ id: r.id }));
+            return mapWithConcurrency(refs, HYDRATE_CONCURRENCY, async (ref) => {
+                try {
+                    const page = await notion.pages.retrieve({ page_id: ref.id });
+                    return slimPage(page, verbose ?? false, true);
+                }
+                catch {
+                    // A row deleted between query and hydrate — surface the id, keep going.
+                    return { id: ref.id, _hydration_failed: true };
+                }
+            });
+        };
+        const first = (await notion.views.queries.create(asSdk({ view_id, page_size: pageSize })));
+        const queryId = first.id;
+        const totalCount = first.total_count;
+        if (!paginate) {
+            const rows = await hydrateIds(first.results ?? []);
+            const truncated = first.request_status?.type === "incomplete";
+            return {
+                ok: true,
+                data: {
+                    ...(totalCount !== undefined ? { total_count: totalCount } : {}),
+                    results: rows,
+                    has_more: first.has_more ?? false,
+                    next_cursor: first.next_cursor ?? null,
+                    ...(truncated ? { truncated: true } : {}),
+                },
+            };
+        }
+        // paginate: accumulate refs across pages up to page_limit, then hydrate once.
+        const limit = page_limit ?? DEFAULT_ITEM_LIMIT;
+        const refs = [];
+        let page = first;
+        let pagesWalked = 1;
+        let incomplete = first.request_status?.type === "incomplete";
+        for (const r of page.results ?? []) {
+            if (refs.length >= limit)
+                break;
+            refs.push({ id: r.id });
+        }
+        while (refs.length < limit && page.has_more && page.next_cursor) {
+            page = (await notion.views.queries.results(asSdk({
+                view_id,
+                query_id: queryId,
+                start_cursor: page.next_cursor,
+                page_size: pageSize,
+            })));
+            pagesWalked += 1;
+            if (page.request_status?.type === "incomplete")
+                incomplete = true;
+            for (const r of page.results ?? []) {
+                if (refs.length >= limit)
+                    break;
+                refs.push({ id: r.id });
+            }
+        }
+        // Best-effort cleanup of the server-side query job.
+        try {
+            await notion.views.queries.delete(asSdk({ view_id, query_id: queryId }));
+        }
+        catch {
+            /* ignore cleanup failures */
+        }
+        const rows = await hydrateIds(refs);
+        const truncated = incomplete || (Boolean(page.has_more) && refs.length >= limit);
+        return {
+            ok: true,
+            data: {
+                ...(totalCount !== undefined ? { total_count: totalCount } : {}),
+                results: rows,
+                truncated,
+                pages_walked: pagesWalked,
+            },
+        };
+    }),
+});
+// ──────────────────────────────────────────────────────────────────────────
+// create_view
+// ──────────────────────────────────────────────────────────────────────────
+const CreateViewParams = z.object({
+    data_source_id: z.string().optional(),
+    database_id: z
+        .string()
+        .optional()
+        .describe("Single-source databases are auto-resolved; multi-source require data_source_id."),
+    name: z.string().describe("View name."),
+    type: z.enum(VIEW_TYPES).describe("View type."),
+    where: WHERE_SCHEMA.optional().describe("Typed filter DSL (same shape as query_database `where`). Mutually exclusive with `filter`."),
+    filter: z.unknown().optional().describe("Raw Notion view filter JSON. Mutually exclusive with `where`."),
+    sorts: z.array(z.unknown()).optional(),
+    configuration: z
+        .unknown()
+        .optional()
+        .describe("Type-specific layout/grouping config (required for calendar/board/timeline/chart/map)."),
+    verbose: VERBOSE,
+});
+register({
+    name: "create_view",
+    access: "write",
+    domain: "views",
+    description: "Create a database view. table/list/gallery/form need only name+type; calendar/board/timeline/chart/map require `configuration`.",
+    batchable: true,
+    schema: CreateViewParams,
+    example: {
+        data_source_id: "<data-source-id>",
+        name: "Open Tasks",
+        type: "table",
+        where: { Status: "Open" },
+    },
+    rollback: async (data) => {
+        const id = data?.id;
+        if (!id)
+            return;
+        const notion = await getClient();
+        try {
+            await notion.views.delete({ view_id: id });
+        }
+        catch {
+            /* ignore */
+        }
+    },
+    handler: tryHandler(async ({ data_source_id, database_id, name, type, where, filter, sorts, configuration, verbose }) => {
+        if (REQUIRES_CONFIG[type] && configuration === undefined) {
+            return {
+                ok: false,
+                error: {
+                    code: "missing_view_config",
+                    message: `A ${type} view requires \`configuration\`.`,
+                    fix: `Pass \`configuration\` with ${REQUIRES_CONFIG[type]}.`,
+                },
+            };
+        }
+        // Validate inputs (filter shape) before any network call, so bad input
+        // surfaces without a round-trip and regardless of target resolution.
+        const compiled = compileViewFilter(where, filter);
+        if (!compiled.ok)
+            return { ok: false, error: compiled.error };
+        const notion = await getClient();
+        const resolved = await resolveViewTarget(notion, database_id, data_source_id);
+        if (resolved.error)
+            return { ok: false, error: resolved.error };
+        const body = {
+            data_source_id: resolved.data_source_id,
+            // createView requires database_id in the body (SDK types it optional, but
+            // the API rejects a body without it — confirmed against the live API).
+            database_id: resolved.database_id,
+            name,
+            type,
+            ...(compiled.filter !== undefined ? { filter: compiled.filter } : {}),
+            ...(sorts !== undefined ? { sorts } : {}),
+            ...(configuration !== undefined ? { configuration } : {}),
+        };
+        const view = await notion.views.create(asSdk(body));
+        return { ok: true, data: slimView(view, verbose ?? false) };
+    }),
+});
+// ──────────────────────────────────────────────────────────────────────────
+// update_view
+// ──────────────────────────────────────────────────────────────────────────
+const UpdateViewParams = z.object({
+    view_id: z.string(),
+    name: z.string().optional(),
+    where: WHERE_SCHEMA.optional().describe("Replace the view filter (typed DSL). Mutually exclusive with `filter`."),
+    filter: z.unknown().optional().describe("Replace the view filter (raw JSON). Mutually exclusive with `where`."),
+    sorts: z.array(z.unknown()).optional(),
+    configuration: z.unknown().optional(),
+    clear: z
+        .array(z.enum(["filter", "sorts", "configuration"]))
+        .optional()
+        .describe("Fields to clear (set to null)."),
+    verbose: VERBOSE,
+});
+register({
+    name: "update_view",
+    access: "write",
+    domain: "views",
+    description: "Update a view's name/filter/sorts/configuration. Use `clear` to remove filter/sorts/configuration.",
+    batchable: true,
+    schema: UpdateViewParams,
+    example: { view_id: "<view-id>", name: "Renamed" },
+    handler: tryHandler(async ({ view_id, name, where, filter, sorts, configuration, clear, verbose }) => {
+        const compiled = compileViewFilter(where, filter);
+        if (!compiled.ok)
+            return { ok: false, error: compiled.error };
+        const toClear = new Set(clear ?? []);
+        const body = { view_id };
+        if (name !== undefined)
+            body.name = name;
+        if (compiled.filter !== undefined)
+            body.filter = compiled.filter;
+        if (sorts !== undefined)
+            body.sorts = sorts;
+        if (configuration !== undefined)
+            body.configuration = configuration;
+        if (toClear.has("filter"))
+            body.filter = null;
+        if (toClear.has("sorts"))
+            body.sorts = null;
+        if (toClear.has("configuration"))
+            body.configuration = null;
+        const notion = await getClient();
+        const view = await notion.views.update(asSdk(body));
+        return { ok: true, data: slimView(view, verbose ?? false) };
+    }),
+});
+// ──────────────────────────────────────────────────────────────────────────
+// delete_view
+// ──────────────────────────────────────────────────────────────────────────
+const DeleteViewParams = z.object({ view_id: z.string() });
+register({
+    name: "delete_view",
+    access: "write",
+    domain: "views",
+    destructive: true,
+    description: "Delete a database view. Irreversible. Honors NOTION_READ_ONLY and the operation allow/block lists.",
+    batchable: true,
+    schema: DeleteViewParams,
+    example: { view_id: "<view-id>" },
+    handler: tryHandler(async ({ view_id }) => {
+        const notion = await getClient();
+        const result = await notion.views.delete({ view_id });
+        const r = result;
+        return { ok: true, data: { id: r.id ?? view_id, deleted: r.deleted ?? true } };
+    }),
+});

package/build/prompts/index.js

@@ -1,5 +1,4 @@
 import { z } from "zod";
-import { server } from "../server/index.js";
 function userMessage(text) {
     return {
         messages: [
@@ -10,7 +9,7 @@ function userMessage(text) {
         ],
     };
 }
-export function registerAllPrompts() {
+export function registerAllPrompts(server) {
     server.registerPrompt("create_task", {
         title: "Create Notion task",
         description: "Create a new task page in Notion with optional status and due date.",

package/build/schema/blocks.js

@@ -21,6 +21,7 @@ export const BASE_BLOCK_REQUEST_SCHEMA = z.object({
         .optional()
         .describe("Whether block has child blocks"),
     archived: z.boolean().optional().describe("Whether block is archived"),
+    in_trash: z.boolean().optional().describe("Whether block is in trash (2026-03-11 surface)"),
 });
 export const TEXT_BLOCK_BASE_REQUEST_SCHEMA = z.object({
     rich_text: z

package/build/server/auth.js

@@ -0,0 +1,36 @@
+import { timingSafeEqual } from "node:crypto";
+function bearerToken(headers) {
+    const raw = headers["authorization"] ?? headers["Authorization"];
+    const value = Array.isArray(raw) ? raw[0] : raw;
+    if (!value)
+        return null;
+    const parts = value.trim().split(/\s+/);
+    if (parts.length !== 2 || parts[0].toLowerCase() !== "bearer")
+        return null;
+    return parts[1];
+}
+function constantTimeEqual(a, b) {
+    // timingSafeEqual requires equal-length buffers; differing lengths are a
+    // mismatch by definition (the length leak is acceptable and standard).
+    if (a.length !== b.length)
+        return false;
+    return timingSafeEqual(Buffer.from(a), Buffer.from(b));
+}
+/**
+ * Gate an HTTP request against the optional bearer token.
+ * - No token configured  -> open (ok).
+ * - Token configured, header missing/malformed -> 401.
+ * - Token configured, value mismatch            -> 403.
+ */
+export function checkAuth(headers, expectedToken) {
+    if (!expectedToken)
+        return { ok: true };
+    const provided = bearerToken(headers);
+    if (provided === null) {
+        return { ok: false, status: 401, message: "Unauthorized: missing bearer token" };
+    }
+    if (!constantTimeEqual(provided, expectedToken)) {
+        return { ok: false, status: 403, message: "Forbidden: invalid bearer token" };
+    }
+    return { ok: true };
+}

package/build/server/http.js

@@ -0,0 +1,202 @@
+import http from "node:http";
+import { randomUUID } from "node:crypto";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
+import { CONFIG } from "../config/index.js";
+import { createServer, logAccessSummary, verifyNotionAuth } from "./index.js";
+import { checkAuth } from "./auth.js";
+const MAX_BODY_BYTES = 4 * 1024 * 1024; // 4 MB
+class BodyError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+function readJsonBody(req) {
+    return new Promise((resolve, reject) => {
+        let size = 0;
+        const chunks = [];
+        req.on("data", (chunk) => {
+            size += chunk.length;
+            if (size > MAX_BODY_BYTES) {
+                reject(new BodyError(413, "Request body too large"));
+                req.destroy();
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on("end", () => {
+            const raw = Buffer.concat(chunks).toString("utf8");
+            if (raw.trim() === "")
+                return resolve(undefined);
+            try {
+                resolve(JSON.parse(raw));
+            }
+            catch {
+                reject(new BodyError(400, "Invalid JSON body"));
+            }
+        });
+        req.on("error", reject);
+    });
+}
+/** Discard any remaining request body and resolve once it's fully consumed. */
+function drain(req) {
+    if (req.readableEnded || req.destroyed)
+        return Promise.resolve();
+    return new Promise((resolve) => {
+        req.on("end", resolve);
+        req.on("close", resolve);
+        req.on("error", () => resolve());
+        req.resume();
+    });
+}
+async function sendJsonRpcError(req, res, status, code, message) {
+    // Fully drain the request body before responding. Ending the response while the
+    // client is still streaming the body resets the socket (ECONNRESET) and the client
+    // never sees our status — so we wait for the upload to finish first.
+    await drain(req);
+    if (res.headersSent || res.writableEnded || res.destroyed)
+        return;
+    const payload = JSON.stringify({ jsonrpc: "2.0", error: { code, message }, id: null });
+    // Connection: close — we rejected this request without reusing the socket; some
+    // keep-alive clients (Node's undici fetch) otherwise RST when they get an early
+    // response while still uploading the body. Explicit length avoids chunked framing.
+    res.writeHead(status, {
+        "content-type": "application/json",
+        "content-length": Buffer.byteLength(payload),
+        connection: "close",
+    });
+    res.end(payload);
+}
+function isLoopbackHost(host) {
+    return (host === "127.0.0.1" ||
+        host === "localhost" ||
+        host === "::1" ||
+        host === "[::1]");
+}
+/** Localhost Host-header allowlist for DNS-rebinding protection, using the
+ *  actually-bound port (handles PORT=0). Used when MCP_ALLOWED_HOSTS is unset. */
+function defaultAllowedHosts(host, port) {
+    const names = new Set(["127.0.0.1", "localhost", "[::1]", host]);
+    const out = [];
+    for (const n of names)
+        out.push(n, `${n}:${port}`);
+    return out;
+}
+function defaultAllowedOrigins(port) {
+    return ["127.0.0.1", "localhost", "[::1]"].map((h) => `http://${h}:${port}`);
+}
+export async function startHttp(config) {
+    // One transport per session; the connected server instance lives behind it.
+    const transports = {};
+    const httpServer = http.createServer((req, res) => {
+        void handle(req, res).catch(async (err) => {
+            console.error("HTTP handler error:", err);
+            await sendJsonRpcError(req, res, 500, -32603, "Internal server error");
+        });
+    });
+    // Bind first so we know the real port (PORT=0 -> OS-assigned) before building
+    // the DNS-rebinding allowlist. Reject (don't hang) on a bind failure like EADDRINUSE.
+    await new Promise((resolve, reject) => {
+        httpServer.once("error", reject);
+        httpServer.listen(config.port, config.host, () => {
+            httpServer.removeListener("error", reject);
+            resolve();
+        });
+    });
+    const addr = httpServer.address();
+    const port = typeof addr === "object" && addr ? addr.port : config.port;
+    const allowedHosts = config.allowedHosts.length > 0
+        ? config.allowedHosts
+        : defaultAllowedHosts(config.host, port);
+    const allowedOrigins = config.allowedOrigins.length > 0
+        ? config.allowedOrigins
+        : defaultAllowedOrigins(port);
+    async function handle(req, res) {
+        const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+        const pathname = url.pathname;
+        // Liveness probe — no auth, no session.
+        if (req.method === "GET" && pathname === "/health") {
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify({ status: "healthy", transport: "http", port }));
+            return;
+        }
+        if (pathname !== "/mcp") {
+            await sendJsonRpcError(req, res, 404, -32601, "Not found");
+            return;
+        }
+        const auth = checkAuth(req.headers, config.authToken);
+        if (!auth.ok) {
+            await sendJsonRpcError(req, res, auth.status, auth.status === 401 ? -32001 : -32002, auth.message);
+            return;
+        }
+        const sessionId = req.headers["mcp-session-id"];
+        if (req.method === "POST") {
+            let body;
+            try {
+                body = await readJsonBody(req);
+            }
+            catch (e) {
+                const status = e instanceof BodyError ? e.status : 400;
+                await sendJsonRpcError(req, res, status, -32700, e instanceof Error ? e.message : "Parse error");
+                return;
+            }
+            let transport = sessionId ? transports[sessionId] : undefined;
+            if (!transport) {
+                if (!sessionId && isInitializeRequest(body)) {
+                    transport = new StreamableHTTPServerTransport({
+                        sessionIdGenerator: () => randomUUID(),
+                        onsessioninitialized: (id) => {
+                            transports[id] = transport;
+                        },
+                        enableDnsRebindingProtection: true,
+                        allowedHosts,
+                        allowedOrigins,
+                    });
+                    transport.onclose = () => {
+                        if (transport.sessionId)
+                            delete transports[transport.sessionId];
+                    };
+                    const server = createServer();
+                    await server.connect(transport);
+                }
+                else {
+                    await sendJsonRpcError(req, res, 400, -32000, "Bad Request: no valid session ID");
+                    return;
+                }
+            }
+            await transport.handleRequest(req, res, body);
+            return;
+        }
+        if (req.method === "GET" || req.method === "DELETE") {
+            const transport = sessionId ? transports[sessionId] : undefined;
+            if (!transport) {
+                await sendJsonRpcError(req, res, 400, -32000, "Bad Request: invalid or missing session ID");
+                return;
+            }
+            await transport.handleRequest(req, res);
+            return;
+        }
+        await sendJsonRpcError(req, res, 405, -32601, "Method not allowed");
+    }
+    console.error(`${CONFIG.serverName} v${CONFIG.serverVersion} running on http://${config.host}:${port}/mcp`);
+    if (!config.authToken && !isLoopbackHost(config.host)) {
+        console.error("WARNING: HTTP endpoint bound to a non-loopback host without MCP_AUTH_TOKEN — anyone who can reach it acts as your NOTION_TOKEN. Set MCP_AUTH_TOKEN.");
+    }
+    logAccessSummary();
+    verifyNotionAuth();
+    const close = () => new Promise((resolve, reject) => {
+        for (const id of Object.keys(transports)) {
+            try {
+                transports[id].close();
+            }
+            catch {
+                // best-effort
+            }
+        }
+        httpServer.closeAllConnections?.();
+        httpServer.close((err) => (err ? reject(err) : resolve()));
+    });
+    return { port, close };
+}

package/build/server/index.js

@@ -2,36 +2,62 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CONFIG } from "../config/index.js";
 import { getClient } from "../services/notion.js";
-export const server = new McpServer({
-    name: CONFIG.serverName,
-    title: CONFIG.serverTitle,
-    version: CONFIG.serverVersion,
-    websiteUrl: CONFIG.serverUrl,
-}, {
-    capabilities: {
-        tools: {},
-        prompts: {},
-    },
-    instructions: `
+import { registerAllTools } from "../tools/index.js";
+import { accessSummary } from "../operations/access.js";
+/**
+ * Build a fresh, fully-registered MCP server instance.
+ *
+ * A factory (not a module singleton) because the Streamable HTTP transport needs
+ * one server per session. `initOperations()` must have run before this is called —
+ * it populates the global operation registry that the tools read from; this factory
+ * only wires the server's tools/resources/prompts and never re-registers operations.
+ */
+export function createServer() {
+    const server = new McpServer({
+        name: CONFIG.serverName,
+        title: CONFIG.serverTitle,
+        version: CONFIG.serverVersion,
+        websiteUrl: CONFIG.serverUrl,
+    }, {
+        capabilities: {
+            tools: {},
+            prompts: {},
+            resources: {},
+        },
+        instructions: `
       MCP server for Notion.
       It is used to create, update and delete Notion entities.
     `,
-});
-export async function startServer() {
+    });
+    registerAllTools(server);
+    return server;
+}
+/** Log the operation access summary once at startup (not per session). */
+export function logAccessSummary() {
+    const s = accessSummary();
+    console.error(`Operation access: ${s.enabled}/${s.total} enabled (allow=${s.allow}; block=${s.block}${s.readOnly ? "; read-only" : ""})`);
+}
+/** Fire-and-forget Notion auth probe; logs who we connected as, never throws. */
+export function verifyNotionAuth() {
+    getClient()
+        .then((c) => c.users.me({}))
+        .then((me) => {
+        const who = "name" in me && me.name ? me.name : me.id;
+        console.error(`Notion auth OK — connected as ${who} (NOTION_TOKEN)`);
+    })
+        .catch((err) => {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Notion auth check failed (server still running): ${msg}`);
+    });
+}
+export async function startStdio() {
     try {
+        const server = createServer();
         const transport = new StdioServerTransport();
         await server.connect(transport);
         console.error(`${CONFIG.serverName} v${CONFIG.serverVersion} running on stdio`);
-        getClient()
-            .then((c) => c.users.me({}))
-            .then((me) => {
-            const who = "name" in me && me.name ? me.name : me.id;
-            console.error(`Notion auth OK — connected as ${who} (NOTION_TOKEN)`);
-        })
-            .catch((err) => {
-            const msg = err instanceof Error ? err.message : String(err);
-            console.error(`Notion auth check failed (server still running): ${msg}`);
-        });
+        logAccessSummary();
+        verifyNotionAuth();
     }
     catch (error) {
         console.error("Server initialization error:", error instanceof Error ? error.message : String(error));

package/build/services/notion.js

@@ -7,7 +7,7 @@ export async function getClient() {
     if (token !== cachedToken || cachedClient === null) {
         const fresh = new Client({
             auth: token,
-            notionVersion: "2025-09-03",
+            notionVersion: "2026-03-11",
         });
         cachedClient = fresh;
         cachedToken = token;

package/build/tools/index.js

@@ -1,9 +1,8 @@
 import { z } from "zod";
 import { ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { server } from "../server/index.js";
 import { readNotionResource } from "./resources.js";
-import { initOperations, getOperation } from "../operations/index.js";
-import { isOperationAllowed, operationNotAllowedError, enabledOperationNames, enabledOperations, accessSummary, } from "../operations/access.js";
+import { getOperation } from "../operations/index.js";
+import { isOperationAllowed, operationNotAllowedError, enabledOperationNames, enabledOperations, } from "../operations/access.js";
 import { dispatch } from "../dispatch/index.js";
 import { emitJsonSchema } from "../schema/emit.js";
 import { registerAllPrompts } from "../prompts/index.js";
@@ -38,8 +37,7 @@ If the payload is malformed, the error response includes the full schema + a wor
 
 Most responses are slimmed by default. Pass verbose:true inside payload (single) or per-item (batch) to get the raw Notion SDK response.`;
 const DESCRIBE_DESCRIPTION = `Return the JSON Schema and a working example for one operation. Use this BEFORE notion_execute when the payload shape is non-trivial (query filters, structured block trees, database property definitions). For simple ops, just call notion_execute — its errors carry the schema.`;
-export async function registerAllTools() {
-    await initOperations();
+export function registerAllTools(server) {
     server.registerTool("notion_execute", {
         title: "Notion Execute",
         description: EXECUTE_DESCRIPTION,
@@ -126,9 +124,7 @@ export async function registerAllTools() {
         const { mimeType, text } = await readNotionResource("database", firstVar(variables.dataSourceId));
         return { contents: [{ uri: uri.href, mimeType, text }] };
     });
-    registerAllPrompts();
-    const s = accessSummary();
-    console.error(`Operation access: ${s.enabled}/${s.total} enabled (allow=${s.allow}; block=${s.block}${s.readOnly ? "; read-only" : ""})`);
+    registerAllPrompts(server);
 }
 function renderOperationsIndex() {
     const lines = [
@@ -142,12 +138,13 @@ function renderOperationsIndex() {
     for (const def of enabledOperations()) {
         lines.push(`| \`${def.name}\` | ${def.batchable ? "yes" : "no"} | ${def.description} |`);
     }
-    // Only document the query_database filter DSL when that op is actually enabled —
-    // otherwise the menu advertises a disabled operation.
-    if (!isOperationAllowed("query_database")) {
+    // Document the WHERE DSL when any operation that accepts it is enabled.
+    // query_database, create_view, and update_view all take the same `where`.
+    const whereOps = ["query_database", "create_view", "update_view"].filter((op) => isOperationAllowed(op));
+    if (whereOps.length === 0) {
         return lines.join("\n");
     }
-    lines.push("", "## `query_database` WHERE DSL", "");
-    lines.push("`query_database.where` is a compact DSL that compiles to the Notion filter object. AND-by-default at the top level; nest `and`/`or`/`not` (case-insensitive — `AND`/`OR`/`NOT` also work) for boolean groups, prefix scalars with `__type` to force the property type, or fall back to raw `filter` for anything the DSL can't express.", "", "Common shapes:", "", "```jsonc", "// Single equality (property type inferred from value, or from data source schema via __type):", "{ \"where\": { \"Status\": \"Open\" } }", "", "// AND of multiple properties (top-level keys are implicit AND):", "{ \"where\": { \"Status\": \"Done\", \"Done\": true } }", "", "// Explicit operator on one property:", "{ \"where\": { \"Priority\": { \"gte\": 3 } } }", "", "// Boolean groups (lowercase or uppercase — both work):", "{ \"where\": { \"or\": [ { \"Status\": \"Open\" }, { \"Status\": \"In progress\" } ] } }", "{ \"where\": { \"and\": [ { \"Status\": \"Done\" }, { \"Priority\": { \"gte\": 5 } } ] } }", "{ \"where\": { \"not\": { \"Status\": \"Done\" } } }", "", "// in / notIn fan out to OR / AND of equals:", "{ \"where\": { \"Status\": { \"in\": [\"Open\", \"In progress\"] } } }", "", "// Force property type when value shape is ambiguous (e.g. a string that's actually a multi_select tag):", "{ \"where\": { \"Tags\": { \"__type\": \"multi_select\", \"eq\": \"alpha\" } } }", "{ \"where\": { \"Created\": { \"__type\": \"date\", \"on_or_after\": \"2026-01-01\" } } }", "```", "", "If a column is literally named `and`/`or`/`not`, wrap it as an operator object (e.g. `{ \"and\": { \"__type\": \"select\", \"eq\": \"x\" } }`) so it isn't parsed as a combinator. For anything the DSL can't express, pass `filter` (raw Notion filter object) instead of `where`.");
+    lines.push("", "## WHERE filter DSL", "");
+    lines.push(`The same \`where\` DSL is accepted by ${whereOps.map((o) => `\`${o}\``).join(", ")}. It is a compact shorthand that compiles to the Notion filter object. AND-by-default at the top level; nest \`and\`/\`or\`/\`not\` (case-insensitive — \`AND\`/\`OR\`/\`NOT\` also work) for boolean groups, prefix scalars with \`__type\` to force the property type, or fall back to raw \`filter\` for anything the DSL can't express.`, "", "Common shapes:", "", "```jsonc", "// Single equality (property type inferred from value, or from data source schema via __type):", "{ \"where\": { \"Status\": \"Open\" } }", "", "// AND of multiple properties (top-level keys are implicit AND):", "{ \"where\": { \"Status\": \"Done\", \"Done\": true } }", "", "// Explicit operator on one property:", "{ \"where\": { \"Priority\": { \"gte\": 3 } } }", "", "// Boolean groups (lowercase or uppercase — both work):", "{ \"where\": { \"or\": [ { \"Status\": \"Open\" }, { \"Status\": \"In progress\" } ] } }", "{ \"where\": { \"and\": [ { \"Status\": \"Done\" }, { \"Priority\": { \"gte\": 5 } } ] } }", "{ \"where\": { \"not\": { \"Status\": \"Done\" } } }", "", "// in / notIn fan out to OR / AND of equals:", "{ \"where\": { \"Status\": { \"in\": [\"Open\", \"In progress\"] } } }", "", "// Force property type when value shape is ambiguous (e.g. a string that's actually a multi_select tag):", "{ \"where\": { \"Tags\": { \"__type\": \"multi_select\", \"eq\": \"alpha\" } } }", "{ \"where\": { \"Created\": { \"__type\": \"date\", \"on_or_after\": \"2026-01-01\" } } }", "```", "", "If a column is literally named `and`/`or`/`not`, wrap it as an operator object (e.g. `{ \"and\": { \"__type\": \"select\", \"eq\": \"x\" } }`) so it isn't parsed as a combinator. For anything the DSL can't express, pass `filter` (raw Notion filter object) instead of `where`.");
     return lines.join("\n");
 }

package/build/utils/slim.js

@@ -205,6 +205,21 @@ export function slimDataSource(ds, verbose = false) {
         ...(ds.in_trash ? { in_trash: true } : {}),
     };
 }
+// View objects are loosely typed on the SDK surface, so accept `unknown` and
+// narrow defensively. Default keeps the high-signal fields (id/name/type and
+// any filter/sorts); the bulky type-specific `configuration` is verbose-only.
+export function slimView(view, verbose = false) {
+    if (verbose)
+        return view;
+    const v = (view ?? {});
+    return {
+        id: v.id,
+        ...(v.name !== undefined ? { name: v.name } : {}),
+        ...(v.type !== undefined ? { type: v.type } : {}),
+        ...(v.filter ? { filter: v.filter } : {}),
+        ...(Array.isArray(v.sorts) && v.sorts.length ? { sorts: v.sorts } : {}),
+    };
+}
 export function slimItem(item, verbose = false, includeProperties = false) {
     if (verbose)
         return item;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "notion-mcp-server",
-  "version": "2.6.1",
+  "version": "2.8.0",
   "type": "module",
   "bin": {
     "notion-mcp-server": "build/index.js"