{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-11T21:09:20.344Z",
  "record_id": "VXI-EXT-TOOL-TRUST-NOTION-01-v1",
  "record_kind": "external_reference",
  "title": "Notion MCP: Content access and external sharing",
  "system": "Notion MCP",
  "evidence_family": "agent_tool_trust_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Can an agent assume Notion content stays inside Notion when using its MCP connector?",
  "near_questions": [
    "Does a workspace connector keep documents inside the workspace?",
    "Can Notion MCP send page content to another system?",
    "What can the official Notion MCP update?",
    "Does Notion OAuth establish a no-training guarantee?",
    "Which Notion user's access does an MCP connection use?",
    "Can a Notion page inject instructions into an agent?",
    "Who can revoke a Notion MCP connection?",
    "Does a trusted connector make every client trustworthy?",
    "What is missing before sharing private Notion documents?",
    "Can the Notion connector create databases?",
    "What should a saved Notion tool review record?",
    "Does this Notion profile verify our client policy?"
  ],
  "supported_claims": [
    {
      "claim": "Notion documents a hosted OAuth connector that can read and update accessible content. Its security guidance explicitly warns that connected clients may send returned content outside Notion. Check the client and model data policy as well as workspace access. The connector's publisher and valid login do not establish a no-egress or no-training guarantee.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent tool execution or security testing",
    "Vendor certification, guaranteed safety or no-training assurance"
  ],
  "public_summary": "Notion documents a hosted OAuth connector that can read and update accessible content. Its security guidance explicitly warns that connected clients may send returned content outside Notion. Check the client and model data policy as well as workspace access. The connector's publisher and valid login do not establish a no-egress or no-training guarantee.",
  "related_record_ids": [
    "VXI-EXT-TOOL-TRUST-ATLASSIAN-01-v1",
    "VXI-EXT-TOOL-TRUST-LINEAR-01-v1"
  ],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Notion MCP overview",
    "source_url": "https://developers.notion.com/guides/mcp/overview",
    "checked_on": "2026-10-11",
    "candidate_record_id": "VXI-EXT-TOOL-TRUST-NOTION-01-v1",
    "candidate_record_sha256": "4992d82877792199be2573a322c44703d17abb01cc9db5b9f9f82e856fec4acc",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "Notion documents a hosted OAuth connector that can read and update accessible content. Its security guidance explicitly warns that connected clients may send returned content outside Notion. Check the client and model data policy as well as workspace access. The connector's publisher and valid login do not establish a no-egress or no-training guarantee.",
    "required_buyer_context": "Notion-hosted remote MCP; excludes locally hosted alternatives. Workspace, client and account entitlements must be checked separately. Client/model training and retention policy, effective connected-source access and the buyer's workspace restrictions.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "trust_profile": {
    "schema": "varexis-agent-tool-trust/1",
    "identity": {
      "tool": "Notion MCP",
      "variant": "Notion-hosted remote MCP; excludes locally hosted alternatives. Workspace, client and account entitlements must be checked separately."
    },
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-11",
    "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.",
    "plan_scope": "Buyer plan, feature entitlement and effective configuration are not verified.",
    "findings": [
      {
        "field": "operator",
        "label": "Publisher and operator",
        "status": "documented",
        "statement": "Notion hosts the remote MCP service.",
        "source_ids": [
          "notion-main",
          "notion-security"
        ]
      },
      {
        "field": "purpose",
        "label": "Purpose",
        "status": "documented",
        "statement": "Search, read and update workspace content.",
        "source_ids": [
          "notion-main",
          "notion-security"
        ]
      },
      {
        "field": "reads",
        "label": "Read capability",
        "status": "documented",
        "statement": "Content accessible to the authorizing user, including supported search across connected sources.",
        "source_ids": [
          "notion-main",
          "notion-security"
        ]
      },
      {
        "field": "writes",
        "label": "Write capability",
        "status": "documented",
        "statement": "Documented operations include creating pages or databases and updating content.",
        "source_ids": [
          "notion-main",
          "notion-security"
        ]
      },
      {
        "field": "auth",
        "label": "Authentication",
        "status": "documented",
        "statement": "User authorization through OAuth; workspace and organization owners have documented connection management controls.",
        "source_ids": [
          "notion-main",
          "notion-security"
        ]
      },
      {
        "field": "permissions",
        "label": "Permission surface",
        "status": "documented",
        "statement": "The user's content access and workspace connection controls define relevant boundaries; buyer settings were not inspected.",
        "source_ids": [
          "notion-main",
          "notion-security"
        ]
      },
      {
        "field": "egress",
        "label": "Data leaving the environment",
        "status": "review_inference",
        "statement": "Notion explicitly states that an MCP client may send returned content to systems outside Notion.",
        "source_ids": [
          "notion-main",
          "notion-security"
        ]
      },
      {
        "field": "failures",
        "label": "Failure modes to consider",
        "status": "review_inference",
        "statement": "Treating workspace authorization as a data-residency promise; following instructions embedded in a page; unintended content changes.",
        "source_ids": [
          "notion-main",
          "notion-security"
        ]
      },
      {
        "field": "unknown",
        "label": "Unknowns and applicability",
        "status": "unknown",
        "statement": "Client/model training and retention policy, effective connected-source access and the buyer's workspace restrictions.",
        "source_ids": []
      },
      {
        "field": "gate",
        "label": "Suggested refusal or clarification condition",
        "status": "varexis_review_policy",
        "statement": "When a task requires no external disclosure, resolve the client's data flow before reading private pages; do not apply page instructions as user authority.",
        "source_ids": []
      }
    ],
    "evidence_sources": [
      {
        "source_id": "notion-main",
        "url": "https://developers.notion.com/guides/mcp/overview",
        "final_url": "https://developers.notion.com/guides/mcp/overview",
        "title": "Notion MCP overview",
        "checked_on": "2026-10-11",
        "sha256": "ebec8a48e17acd3aef72c5628476a2c9429b6e822aa37ffb3b391aebf324b423",
        "bytes": 342441
      },
      {
        "source_id": "notion-security",
        "url": "https://developers.notion.com/guides/mcp/mcp-security-best-practices",
        "final_url": "https://developers.notion.com/guides/mcp/mcp-security-best-practices",
        "title": "Notion MCP security guidance",
        "checked_on": "2026-10-11",
        "sha256": "d12c09d54088a85198dd5815e34f2af7967b91747dfbf263af74f7c813374a82",
        "bytes": 334240
      },
      {
        "source_id": "mcp-hints",
        "url": "https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/",
        "final_url": "https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/",
        "title": "MCP tool annotations and enforcement boundaries",
        "checked_on": "2026-10-11",
        "sha256": "82888044d831c3bd18f03d87a846ce5d27e028bd67a095edc04ba377fc622163",
        "bytes": 52715
      }
    ],
    "observed_tool_execution": false,
    "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.",
    "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.",
    "paid_value": {
      "decision_context": "Keep the documented content-sharing limitation with a dated connector approval discussion.",
      "free": "Complete profile, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.",
      "specific_watch": "Review the effective tool inventory and client data policy before a new integration decision."
    },
    "change_history": [
      {
        "version": 1,
        "date": "2026-10-11",
        "change": "Initial documentation review; no earlier vendor assessment claimed."
      }
    ]
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#notion-mcp-content-sharing-trust",
  "machine_readable_record": "/varexis-index/records/notion-mcp-content-sharing-trust.json"
}