# notion probes, 2026-09-17T18:06Z, from a cloud container (one IP), no credentials, no payment
# Responses are cut at 6000 bytes (initialize), 2500 (protected resource), 9000 (authorization server), 4000 (REST). Nothing here was sent with a credential.

## 1. MCP initialize, POST https://mcp.notion.com/mcp
$ curl -sS -i -m 25 -X POST https://mcp.notion.com/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '<initialize>'
HTTP/1.1 200 Connection Established

HTTP/2 401 
date: Thu, 17 Sep 2026 18:06:12 GMT
content-type: application/json
content-length: 79
cache-control: no-store
www-authenticate: Bearer realm="OAuth", resource_metadata="https://mcp.notion.com/.well-known/oauth-protected-resource/mcp", error="invalid_token", error_description="Missing or invalid access token"
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
set-cookie: __cf_bm=[redacted by the prober: a session cookie, never published]
server: cloudflare
cf-ray: a3ca0b200bef7d47-BOS

{"error":"invalid_token","error_description":"Missing or invalid access token"}

## 2. Protected-resource metadata, GET https://mcp.notion.com/.well-known/oauth-protected-resource/mcp
HTTP/1.1 200 Connection Established

HTTP/2 200 
date: Thu, 17 Sep 2026 18:06:13 GMT
content-type: application/json
content-length: 197
strict-transport-security: max-age=31536000; includeSubDomains; preload
set-cookie: __cf_bm=[redacted by the prober: a session cookie, never published]
server: cloudflare
cf-ray: a3ca0b23da7b68b4-BOS

{"resource":"https://mcp.notion.com/mcp","authorization_servers":["https://mcp.notion.com"],"scopes_supported":["default"],"bearer_methods_supported":["header"],"resource_name":"Notion MCP (Beta)"}

## 3. Authorization-server metadata, GET https://mcp.notion.com/.well-known/oauth-authorization-server
HTTP/1.1 200 Connection Established

HTTP/2 200 
date: Thu, 17 Sep 2026 18:06:13 GMT
content-type: application/json
content-length: 905
strict-transport-security: max-age=31536000; includeSubDomains; preload
set-cookie: __cf_bm=[redacted by the prober: a session cookie, never published]
server: cloudflare
cf-ray: a3ca0b27d9fa4e45-BOS

{"issuer":"https://mcp.notion.com","authorization_endpoint":"https://mcp.notion.com/authorize","token_endpoint":"https://mcp.notion.com/token","registration_endpoint":"https://mcp.notion.com/register","scopes_supported":["default"],"response_types_supported":["code"],"response_modes_supported":["query"],"grant_types_supported":["authorization_code","refresh_token","urn:ietf:params:oauth:grant-type:jwt-bearer"],"authorization_grant_profiles_supported":["urn:ietf:params:oauth:grant-profile:id-jag"],"token_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","none"],"revocation_endpoint":"https://mcp.notion.com/token","code_challenge_methods_supported":["plain","S256"],"client_id_metadata_document_supported":true,"introspection_endpoint":"https://mcp.notion.com/introspect","introspection_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","none"]}

## 4. REST, GET https://api.notion.com/v1/users/me, no Authorization header
HTTP/1.1 200 Connection Established

HTTP/2 401 
date: Thu, 17 Sep 2026 18:06:14 GMT
content-type: application/json; charset=utf-8
content-length: 178
cf-ray: a3ca0b2d791a6cae-BOS
cf-cache-status: DYNAMIC
etag: W/"b2-Y/FgXx9gnvx3q4Vlqb0fiKSm6zk"
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
content-security-policy: default-src 'none'
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-notion-request-id: bde15dc0-e895-435d-9b48-d5e27b97fff6
x-permitted-cross-domain-policies: none
x-xss-protection: 0
set-cookie: __cf_bm=[redacted by the prober: a session cookie, never published]

{"object":"error","status":401,"code":"unauthorized","message":"Authorization header must use the format \"Bearer <token>\".","request_id":"bde15dc0-e895-435d-9b48-d5e27b97fff6"}