Back to MCP Trust Indexm8ven
49
/ 100
2 days ago
glama

Notion Cowork Bridge

Gives Notion Custom Agents real file tools and a real terminal over the Model Context Protocol, enabling them to read, edit, and run commands directly on the user's machine.

→ soumosa/notion-cowork-bridge· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Tool annotations don’t match behaviour
2 read-only tools perform write/delete/exec — browser_snapshot (line 86: rm(session.profileDir, { recursive: true, force: true })); browser_screenshot (line 86: rm(session.profileDir, { recursive: true, force: true }))
⚠️
Tool descriptions don’t match what handlers do
1 tool describes read intent but its handler mutates — capture_screenshot (line 103: spawn(browser, args, {)
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 1 credential: MCP_AUTH_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configCHECK_STRICT
configMCP_ALLOWED_HOSTS— export ="localhost"
configMCP_AUDIT_LOG— per-platform (above) Where the JSON-lines audit log is written
🔐 secretMCP_AUTH_TOKEN— The bridge won't start and bridge.log mentions . The
configMCP_BACKGROUND_LOG_LIMIT_BYTES
configMCP_BACKGROUND_RETENTION_HOURS
configMCP_BACKGROUND_TOTAL_LOG_LIMIT_BYTES
configMCP_BROWSER_IDLE_SECONDS
configMCP_BROWSER_PATH
configMCP_BROWSER_TTL_SECONDS
configMCP_MAX_BACKGROUND_PROCESSES
configMCP_MAX_BROWSER_SESSIONS
configMCP_MAX_PREVIEWS
configMCP_NGROK_API_URL
configMCP_PORT— export =3210
configMCP_PREVIEW_TTL_SECONDS
configMCP_SCREENSHOT_BROWSER— autodetected Path to the browser capture_screenshot should drive
configMCP_SHELL— see below Shell used for terminal commands
configMCP_WORKSPACE_ROOT— export ="$HOME/Desktop/notion-workspace"
configProgramFiles
configProgramFiles(x86)
configSHELL— Used as the shell on macOS and Linux when MCP_SHELL is unset
configXDG_STATE_HOME
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 8 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/soumosa-notion-cowork-bridge-1ifasj)](https://m8ven.ai/mcp/soumosa-notion-cowork-bridge-1ifasj)
commit: 314bedce3f8fc8208e9c09512b8b6f29aa8950c0
code hash: 2120ceaafd0d83d1b14fc02e3c3b758d05c0ae1f8abe850f0dbac4b9803bb1f6
verified: 7/29/2026, 9:11:56 AM
view raw JSON →