This is a submission for the Notion MCP Challenge

What I Built

A question most organisations have not yet asked: who is auditing the MCP servers your AI agents depend on?

Every time an AI agent calls a tool-whether to read a file, query a database, or hit an API-it places trust in an MCP server. That server might:

• contain command injection vulnerabilities.

• It might exfiltrate credentials via undisclosed network calls.

• It might embed hidden instructions in tool descriptions designed to manipulate AI behaviour.

Under ISO 27001, these MCP servers constitute third-party software components: information assets (A.8.1) with supply chain risk (A.15.1) that require vulnerability assessment (A.12.6), audit logging (A.12.4), and regular compliance review (A.18.2). Most organisations today cannot answer a basic auditor question: “Show me your inventory of MCP servers and their security posture.”

This is not a hypothetical risk. Researchers from the University of Delaware published the first comprehensive security analysis of the MCP ecosystem (Li & Gao, 2025), analysing 67,057 MCP servers across six public registries. Their findings:

• Hosts lack output verification: LLM-generated outputs are not validated before being translated into tool invocations
• A substantial number of servers can be hijacked: registries lack vetted submission processes
• Sensitive data exfiltration is a documented attack vector: through undisclosed network calls and credential access

The mcp-audit-hub is a security audit system that scans MCP servers for vulnerabilities using AST-based static analysis, with Notion MCP as the operational backbone. Notion serves as a management and compliance dashboard where:

• Every MCP server the organisation uses is inventoried with risk classification
• Every scan is logged with an immutable, timestamped audit trail
• Every vulnerability finding is tracked with severity, remediation status, and ownership
• Non-technical team members can request scans directly from Notion, with no terminal access required

Getting Started

Clone the repo, install dependencies, and connect to your Notion workspace in under 5 minutes:

git clone https://github.com/michaelterungwamzer-sys/mcp-audit-hub.git
cd mcp-audit-hub && npm install && npm run build
export NOTION_TOKEN="ntn_your_token"
node bin/mcp-audit.js hub init --page <notion-page-id>

Full setup instructions (creating a Notion integration, sharing pages, etc.) are in the README.

How Data Flows Between CLI and Notion

Most integrations only push data into Notion. mcp-audit-hub is bidirectional — data flows in both directions, and the system monitors itself continuously. Here’s how each workflow operates:

1. CLI → Notion (Push scan results)

mcp-audit hub sync @modelcontextprotocol/server-filesystem

Scans the server, displays results in the terminal, and pushes structured data into five linked Notion databases.

2. Notion → Scanner (Trigger scans from Notion)

A team member adds a row in Notion’s Scan Requests database. An agent picks it up, runs the scan, and writes the results back. The requester never touches a terminal.

[14:32:01] New request: @modelcontextprotocol/server-github (by Nora)
[14:32:01] Status → scanning
[14:32:18] Scan complete: 85/100 PASS (2 findings)
[14:32:20] Status → completed ✔

3. Continuous Monitoring (Automated re-scans and escalations)

An admin sets a Review Cadence (weekly, monthly, or quarterly) on any server in Notion. The watch agent automatically re-scans overdue servers, advances the review date, and creates an Escalation entry if the score regresses.

[09:15:00] Recurring scan: @mcp/server-filesystem (cadence: weekly, due: 2026-03-22)
[09:15:12] Scan complete: 52/100 WARN (4 findings)
[09:15:14] ESCALATION: score-regression (85 -> 52)

What the Scanner Detects

Twelve analyzers perform AST-based static analysis:

ISO 27001 Alignment

When an auditor asks “How do you manage the security of third-party MCP servers?”, the organisation opens Notion:

Video Demo

29.03.2026_22.48.31_REC

screenrec.com

Show us the code

Direction 1 (CLI → Notion):     mcp-audit hub sync → results land in Notion
Direction 2 (Notion → Scanner): Create request in Notion → agent scans → results appear

Architecture:

┌────────────────────────────────────────────────────────┐
│  mcp-audit-hub                                         │
│                                                        │
│  CLI: hub init / sync / watch / status                 │
│       │                    │                           │
│       v                    v                           │
│  Scanner Engine       Hub Layer                        │
│  (12 AST analyzers)   (MCP Client ↔ Notion MCP)        │
│                            │                           │
│                            v                           │
│                    Notion Workspace                    │
│                    ├─ Server Registry (asset inventory)│
│                    ├─ Scan History (audit trail)       │
│                    ├─ Findings (vulnerability log)     │
│                    ├─ Scan Requests (trigger surface)  │
│                    └─ Escalations (regression alerts)  │
└────────────────────────────────────────────────────────┘

Tech stack: TypeScript, Node.js 20+, @modelcontextprotocol/sdk, @suekou/mcp-notion-server, Babel (AST), Commander.js, Vitest

How I Used Notion MCP

This project could not exist in the same form without Notion MCP.

The traditional alternative

Without Notion MCP, building this system would require:

1. A custom database: PostgreSQL or SQLite for server registry, scan history, findings
2. A web dashboard: React or similar to visualise the data
3. A request system: a form or API for non-technical users to request scans
4. Notifications: email or Slack integration when scans complete
5. Deployment and maintenance: hosting, backups, monitoring

That represents roughly a month of work for a team.

What Notion MCP makes possible

With Notion MCP, I replaced all of the above with five MCP tool calls:

The result:

• No database to manage: Notion is the database
• No dashboard to build: Notion is the dashboard
• No auth to implement: Notion handles workspace permissions
• No deployment: it’s a CLI tool that communicates with Notion via MCP
• Team adoption is immediate: everyone already has Notion open

The real unlock is Direction 2: Notion as a trigger surface. The watch loop turns a Notion database into a job queue. A compliance officer adds a row. An agent processes it. Results appear. No API, no form, no engineering ticket—just a row in a database everyone already uses.

References

• Li, X. & Gao, X. (2025). “Toward Understanding Security Issues in the Model Context Protocol Ecosystem.” University of Delaware. arXiv:2510.16558
• ISO/IEC 27001:2022. Information security management systems. Annex A controls: A.8.1, A.8.2, A.12.4, A.12.6, A.14.2, A.15.1, A.18.2.
• Model Context Protocol Specification: https://spec.modelcontextprotocol.io/