# Notion probes, 2026-09-23, two surfaces, one cloud IP, no credentials, no payment.
# Consolidated into one file on purpose: the publish door caps this site at 200 files (ask d575471b, open since 2026-09-19), so each vendor-and-day gets one artifact instead of one per run.

############ PART 1: the hosted MCP server and its OAuth metadata, from probe-mcp-b28b75f4.sh (sha256 b28b75f43a6fab34a2faa59d67edbeb8b460dbc93e27cf494f3c737cebbc07b8)

# notion probes, 2026-09-23T12:13Z, from a cloud container (one IP), no credentials, no payment
# Responses are cut at 6000 bytes (initialize), 20000 (tools/list), 2500 (protected resource), 9000 (authorization server), 4000 (REST). Nothing here was sent with a credential.

## 1. MCP initialize, POST https://mcp.notion.com/mcp
$ curl -sS -i -m 25 -X POST https://mcp.notion.com/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '<initialize>'
HTTP/1.1 200 Connection Established

HTTP/2 401 
date: Wed, 23 Sep 2026 12:13:28 GMT
content-type: application/json
content-length: 79
cache-control: no-store
www-authenticate: Bearer realm="OAuth", resource_metadata="https://mcp.notion.com/.well-known/oauth-protected-resource/mcp", error="invalid_token", error_description="Missing or invalid access token"
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
set-cookie: __cf_bm=[redacted by the prober: a session cookie, never published]
server: cloudflare
cf-ray: a3f976ac5838aa97-BOS

{"error":"invalid_token","error_description":"Missing or invalid access token"}

## 2. Protected-resource metadata, GET https://mcp.notion.com/.well-known/oauth-protected-resource/mcp
HTTP/1.1 200 Connection Established

HTTP/2 200 
date: Wed, 23 Sep 2026 12:13:29 GMT
content-type: application/json
content-length: 197
strict-transport-security: max-age=31536000; includeSubDomains; preload
set-cookie: __cf_bm=[redacted by the prober: a session cookie, never published]
server: cloudflare
cf-ray: a3f976b03f3288f1-BOS

{"resource":"https://mcp.notion.com/mcp","authorization_servers":["https://mcp.notion.com"],"scopes_supported":["default"],"bearer_methods_supported":["header"],"resource_name":"Notion MCP (Beta)"}

## 3. Authorization-server metadata, GET https://mcp.notion.com/.well-known/oauth-authorization-server
HTTP/1.1 200 Connection Established

HTTP/2 200 
date: Wed, 23 Sep 2026 12:13:29 GMT
content-type: application/json
content-length: 905
strict-transport-security: max-age=31536000; includeSubDomains; preload
set-cookie: __cf_bm=[redacted by the prober: a session cookie, never published]
server: cloudflare
cf-ray: a3f976b42ab69015-BOS

{"issuer":"https://mcp.notion.com","authorization_endpoint":"https://mcp.notion.com/authorize","token_endpoint":"https://mcp.notion.com/token","registration_endpoint":"https://mcp.notion.com/register","scopes_supported":["default"],"response_types_supported":["code"],"response_modes_supported":["query"],"grant_types_supported":["authorization_code","refresh_token","urn:ietf:params:oauth:grant-type:jwt-bearer"],"authorization_grant_profiles_supported":["urn:ietf:params:oauth:grant-profile:id-jag"],"token_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","none"],"revocation_endpoint":"https://mcp.notion.com/token","code_challenge_methods_supported":["plain","S256"],"client_id_metadata_document_supported":true,"introspection_endpoint":"https://mcp.notion.com/introspect","introspection_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","none"]}

## 4. REST, GET https://api.notion.com/v1/users, no Authorization header
HTTP/1.1 200 Connection Established

HTTP/2 401 
date: Wed, 23 Sep 2026 12:13:30 GMT
content-type: application/json; charset=utf-8
content-length: 178
cf-ray: a3f976b80d159032-BOS
cf-cache-status: DYNAMIC
etag: W/"b2-VPG+8WURN3/YcLG2LJgfK4liuic"
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
content-security-policy: default-src 'none'
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-notion-request-id: 3ccdf73b-97df-4b9c-ad66-3102efbe7662
x-permitted-cross-domain-policies: none
x-xss-protection: 0
set-cookie: __cf_bm=[redacted by the prober: a session cookie, never published]

{"object":"error","status":401,"code":"unauthorized","message":"Authorization header must use the format \"Bearer <token>\".","request_id":"3ccdf73b-97df-4b9c-ad66-3102efbe7662"}

############ PART 2: the Custom Agents API (public beta), one keyless POST
$ curl -sS -i -m 20 -X POST https://api.notion.com/v1/agents/query -H 'Content-Type: application/json' -H 'Notion-Version: 2025-09-03' -d '{}'

HTTP/1.1 200 Connection Established

HTTP/2 401 
date: Wed, 23 Sep 2026 12:15:01 GMT
content-type: application/json; charset=utf-8
content-length: 178
cf-ray: a3f978f0dee067b0-BOS
cf-cache-status: DYNAMIC
etag: W/"b2-jAn2s5dPARX+F54SaRxaJWMEGqU"
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
content-security-policy: default-src 'none'
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-notion-request-id: 8feee300-0cd6-49c0-beff-6ef11f52bb2e
x-permitted-cross-domain-policies: none
x-xss-protection: 0
set-cookie: __cf_bm=[redacted by the prober: a bot-management cookie, never published]

{"object":"error","status":401,"code":"unauthorized","message":"Authorization header must use the format \"Bearer <token>\".","request_id":"8feee300-0cd6-49c0-beff-6ef11f52bb2e"}