Skip to main content
Version: 19.x (unreleased)

Connect a Notion MCP Server to Teleport

Report an Issue

Teleport can provide secure access to MCP servers via Teleport Application Service.

In this guide, you will:

  1. Configure your Notion service for access by the MCP server.
  2. Run the Notion MCP Server.
  3. Enroll the MCP server into your Teleport cluster and connect to it.

How it works​

The Notion MCP server uses an integration token to access Notion and runs on a local endpoint reachable by the Teleport Application Service. Teleport proxies all client requests to the server, which interacts with Notion using the permissions granted to the integration.

Prerequisites​

  • A running Teleport (v18.3.0 or higher) cluster. If you want to get started with Teleport, sign up for a free trial or set up a demo environment.

  • The tsh client.

    Installing tsh client

    1. Determine the version of your Teleport cluster. The tsh client must be at most one major version behind your Teleport cluster version. Send a GET request to the Proxy Service at /v1/webapi/find and use a JSON query tool to obtain your cluster version. Replace teleport.example.com:443 with the web address of your Teleport Proxy Service:

      TELEPORT_DOMAIN=teleport.example.com:443
      TELEPORT_VERSION="$(curl -s https://$TELEPORT_DOMAIN/v1/webapi/find | jq -r '.server_version')"

    2. Follow the instructions for your platform to install tsh client:

      Download the signed macOS .pkg installer for Teleport, which includes the tsh client:

      curl -O https://cdn.teleport.dev/teleport-${TELEPORT_VERSION?}.pkg

      In Finder double-click the pkg file to begin installation.

      danger

      Using Homebrew to install Teleport is not supported. The Teleport package in Homebrew is not maintained by Teleport and we can't guarantee its reliability or security.

  • Access to your Notion workspace and sufficient privileges to manage integrations.
  • A host to run the MCP server that is reachable by the Teleport Application Service.
  • A running Teleport Application Service. If you have not yet done this, follow the Getting Started guide.
  • A Teleport user with sufficient permissions (e.g. role mcp-user) to access MCP servers.

Step 1/3. Create an integration in Notion​

Go to https://www.notion.so/profile/integrations and create a new internal integration.

To limit the scope available to LLMs, disable all permissions except "Read Content" in the "Capabilities" section.

Next, open "Access" tab and select the pages you want the integration to be able to access.

Finally, return to the "Configuration" tab, copy the "Internal Integration Secret" for use in the next step.

Step 2/3. Run the Notion MCP server​

Start the Notion MCP server using your Notion integration token ntn_your_internal_integration_secret:

export NOTION_TOKEN=ntn_your_internal_integration_secret
npx @notionhq/notion-mcp-server --transport http --port 8000 --auth-token teleport-local-connection

The MCP server listens on all network interfaces by default. Run it on a private network and ensure the hostname localhost is reachable by the Teleport Application Service.

The --auth-token value is the shared secret Teleport uses to authenticate to the MCP server. Since the MCP server is not publicly accessible, using a fixed value is acceptable.

Step 3/3. Connect via Teleport​

You can register an MCP application in Teleport by defining it in your Teleport Application Service configuration, or by using dynamic registration with tctl or Terraform:

Replace MCP_HOST with the host running the Notion MCP server:

app_service:
  enabled: "yes"
  apps:
  - name: "notion-mcp"
    uri: "mcp+http://MCP_HOST:8000/mcp"
    labels:
      env: dev
      service: notion

Restart the Application Service.

To grant access to the MCP server and all its tools, assign the preset mcp-user role to your Teleport user.

Optionally, you can limit which MCP tools the user can access by adjusting the mcp.tools list in their role. For example:

kind: role
version: v8
metadata:
  name: notion-mcp-readonly
spec:
  allow:
    app_labels:
      'service': 'notion'
    mcp:
      tools:
      - API-get-*
      - API-retrieve-*
      - API-post-database-query
      - API-post-search

Now wait until the application appears in tsh mcp ls, then configure your MCP clients to access the MCP server, for example:

tsh mcp config notion-mcp --client-config claude

After configuring your MCP client, you will find Notion-related tools from teleport-mcp-notion-mcp. You can now use these tools to interactive with Notion via Teleport in your MCP clients:

Next steps​