Trust Card · Static snapshot

makenotion__notion-mcp-server U

Ungraded — insufficient static coverage · 4 findings (0 critical) · scope moderate · Not ranked: insufficient static coverage.

Scanned 2026-10-19 · engine v0.1.3 (8 regex rules, OWASP-mapped) · upstream makenotion/notion-mcp-server @ 730ae78 (2026-09-20)

Score breakdown

No numeric score or breakdown: insufficient static coverage. Findings remain actionable; absence of findings is not evidence of safety.

Insufficient static coverage: Unsupported source present. Findings remain actionable; absence of findings is not evidence of safety.

Coverage: limited

Static-heuristic scope: 36 analyzed / 52 discovered files; 1 unsupported source files; 17 excluded; 0 read errors; 0 truncations. This is not a semantic coverage percentage or proof of safety.

Unsupported source present
Coverage describes the files read and regex rules applied, not semantic, runtime, or dependency coverage.
Supported code is JavaScript, TypeScript, and Python; JSON/YAML receive only the credential rule.
Skill instructions and other prose are not code-analyzed; declared controls are not verified enforcement.
Ignored directories, declarations, and non-implementation assets are outside rule scope.

File coverage, applied rules and scan limits

{
  "mode": "static-heuristic",
  "status": "limited",
  "reasons": [
    "Unsupported source present"
  ],
  "limitations": [
    "Coverage describes the files read and regex rules applied, not semantic, runtime, or dependency coverage.",
    "Supported code is JavaScript, TypeScript, and Python; JSON/YAML receive only the credential rule.",
    "Skill instructions and other prose are not code-analyzed; declared controls are not verified enforcement.",
    "Ignored directories, declarations, and non-implementation assets are outside rule scope."
  ],
  "discoveredFiles": 52,
  "analyzedFiles": [
    {
      "path": ".github/workflows/ci.yml",
      "scope": "data",
      "bytes": 919,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".github/workflows/increment-version.yml",
      "scope": "data",
      "bytes": 2128,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".github/workflows/publish.yml",
      "scope": "data",
      "bytes": 1886,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "docker-compose.yml",
      "scope": "data",
      "bytes": 107,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "package-lock.json",
      "scope": "data",
      "bytes": 171667,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "package.json",
      "scope": "data",
      "bytes": 1737,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "scripts/build-cli.js",
      "scope": "code",
      "bytes": 811,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "scripts/notion-openapi.json",
      "scope": "data",
      "bytes": 85302,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "scripts/server-options.test.ts",
      "scope": "code",
      "bytes": 3423,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "scripts/server-options.ts",
      "scope": "code",
      "bytes": 7065,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "scripts/start-server.ts",
      "scope": "code",
      "bytes": 10802,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/init-server.ts",
      "scope": "code",
      "bytes": 1428,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/openapi-mcp-server/auth/index.ts",
      "scope": "code",
      "bytes": 51,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/openapi-mcp-server/auth/template.ts",
      "scope": "code",
      "bytes": 761,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/openapi-mcp-server/auth/types.ts",
      "scope": "code",
      "bytes": 484,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/openapi-mcp-server/client/__tests__/http-client-upload.test.ts",
      "scope": "code",
      "bytes": 6397,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/openapi-mcp-server/client/__tests__/http-client.headers.test.ts",
      "scope": "code",
      "bytes": 3201,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/openapi-mcp-server/client/__tests__/http-client.integration.test.ts",
      "scope": "code",
      "bytes": 9149,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/openapi-mcp-server/client/__tests__/http-client.test.ts",
      "scope": "code",
      "bytes": 14660,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/openapi-mcp-server/client/__tests__/test-server.ts",
      "scope": "code",
      "bytes": 1540,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/openapi-mcp-server/client/http-client.ts",
      "scope": "code",
      "bytes": 8258,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/openapi-mcp-server/client/polyfill-headers.ts",
      "scope": "code",
      "bytes": 1087,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/openapi-mcp-server/index.ts",
      "scope": "code",
      "bytes": 167,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/openapi-mcp-server/mcp/__tests__/proxy.test.ts",
      "scope": "code",
      "bytes": 33860,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/openapi-mcp-server/mcp/__tests__/token.test.ts",
      "scope": "code",
      "bytes": 3795,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/openapi-mcp-server/mcp/proxy.ts",
      "scope": "code",
      "bytes": 11487,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/openapi-mcp-server/mcp/token.ts",
      "scope": "code",
      "bytes": 4549,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/openapi-mcp-server/openapi/__tests__/file-upload.test.ts",
      "scope": "code",
      "bytes": 2507,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/openapi-mcp-server/openapi/__tests__/notion-markdown-tools.test.ts",
      "scope": "code",
      "bytes": 2335,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/openapi-mcp-server/openapi/__tests__/notion-spec.snapshot.test.ts",
      "scope": "code",
      "bytes": 1817,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/openapi-mcp-server/openapi/__tests__/parser-multipart.test.ts",
      "scope": "code",
      "bytes": 21101,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/openapi-mcp-server/openapi/__tests__/parser.test.ts",
      "scope": "code",
      "bytes": 51329,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/openapi-mcp-server/openapi/file-upload.ts",
      "scope": "code",
      "bytes": 1466,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/openapi-mcp-server/openapi/parser.ts",
      "scope": "code",
      "bytes": 17091,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "tsconfig.json",
      "scope": "data",
      "bytes": 622,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "vitest.config.ts",
      "scope": "code",
      "bytes": 146,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    }
  ],
  "unsupportedSourceFiles": [
    "Dockerfile"
  ],
  "excludedFiles": [
    {
      "path": ".git",
      "reason": "ignored-directory"
    },
    {
      "path": ".dockerignore",
      "reason": "outside-rule-scope"
    },
    {
      "path": ".github/pull_request_template.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": ".gitignore",
      "reason": "outside-rule-scope"
    },
    {
      "path": "CLAUDE.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "Dockerfile",
      "reason": "unsupported-implementation"
    },
    {
      "path": "LICENSE",
      "reason": "outside-rule-scope"
    },
    {
      "path": "README.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "RELEASING.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/images/connections.png",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/images/integration-access.png",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/images/integrations-capabilities.png",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/images/integrations-creation.png",
      "reason": "outside-rule-scope"
    },
    {
      "path": "docs/images/page-access-edit.png",
      "reason": "outside-rule-scope"
    },
    {
      "path": "src/openapi-mcp-server/LICENSE",
      "reason": "outside-rule-scope"
    },
    {
      "path": "src/openapi-mcp-server/README.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "src/openapi-mcp-server/openapi/__tests__/__snapshots__/notion-spec.snapshot.test.ts.snap",
      "reason": "outside-rule-scope"
    }
  ],
  "readErrors": [],
  "truncation": [],
  "limits": {
    "maxFiles": 4000,
    "maxDepth": 12,
    "maxFileBytes": 1048576
  }
}

Fix first (0 critical/high)

Severity	Rule	Finding	Remediation
MEDIUM	`AT-SEC-007` (LLM02)	Raw Secret Leakage in Debug Logging `scripts/start-server.ts:54` Evidence: console.log(`Generated auth token written to: ${authTokenFilePath}`)	Implement PII/secret redaction masks before writing to log streams.
MEDIUM	`AT-SEC-007` (LLM02)	Raw Secret Leakage in Debug Logging `scripts/start-server.ts:150` Evidence: console.log(`Initializing session with per-request Notion token ${redactToken(resolution.token)}`)	Implement PII/secret redaction masks before writing to log streams.
MEDIUM	`AT-SEC-007` (LLM02)	Raw Secret Leakage in Debug Logging `scripts/start-server.ts:249` Evidence: console.log(`Authentication: Bearer token required`)	Implement PII/secret redaction masks before writing to log streams.
MEDIUM	`AT-SEC-007` (LLM02)	Raw Secret Leakage in Debug Logging `scripts/start-server.ts:251` Evidence: console.log(`Read your auth token from: ${authTokenFilePath}`)	Implement PII/secret redaction masks before writing to log streams.

Permissions

Scope: moderate · Shell: disabled · Network egress: yes · File deletion: none · Human approval: none

Provenance

License: MIT · Lockfile: yes · Security policy: no · Signals: unverified origin

Independently scanned by the OpenTrustBench registry (not self-reported by the project). Static analysis only — no code executed, findings need human triage, counts may include test/example code. Static snapshot; re-scan before relying on it: npx @opentrustbench/cli scan https://github.com/makenotion/notion-mcp-server. Scores move with every upstream commit; pages refresh weekly. How scoring works.