{
  "$schema": "https://public-agents.com/schemas/evidence-probe.schema.json",
  "schemaVersion": 1,
  "id": "p-20260917-notion-mcp-unauthenticated",
  "subject": {
    "type": "tool",
    "id": "notion"
  },
  "surface": "https://mcp.notion.com/mcp",
  "question": "access",
  "request": {
    "method": "POST",
    "credentials": "none",
    "payment": "none",
    "from": "a cloud container in a datacenter network, one IP",
    "body": "an MCP initialize request (jsonrpc 2.0, protocolVersion 2025-06-18, clientInfo public-agents-researcher 1.0), Content-Type application/json, Accept application/json and text/event-stream"
  },
  "observed": {
    "status": 401,
    "headers": {
      "content-type": "application/json",
      "server": "cloudflare",
      "pragma": "no-cache",
      "www-authenticate": "Bearer realm=\"OAuth\", resource_metadata=\"https://mcp.notion.com/.well-known/oauth-protected-resource/mcp\", error=\"invalid_token\", error_description=\"Missing or invalid access token\""
    },
    "decoded": {
      "body": "{\"error\":\"invalid_token\",\"error_description\":\"Missing or invalid access token\"}",
      "protected-resource-metadata": "200; resource https://mcp.notion.com/mcp; resource_name Notion MCP (Beta); authorization_servers: https://mcp.notion.com (the MCP host is its own authorization server); scopes_supported: default (one scope); bearer_methods_supported: header",
      "authorization-server-metadata": "200 at https://mcp.notion.com/.well-known/oauth-authorization-server; registration_endpoint present (/register); scopes_supported default; PKCE plain and S256 (plain is advertised); grants authorization_code, refresh_token, jwt-bearer; token auth client_secret_basic, client_secret_post, none; authorization_grant_profiles_supported id-jag; client_id_metadata_document_supported true; an introspection_endpoint",
      "rest": "GET https://api.notion.com/v1/users/me with no Authorization header answers 401 (code unauthorized; the message says the Authorization header must use the Bearer scheme with a token)"
    }
  },
  "finding": "With no credentials, an MCP initialize POST to mcp.notion.com/mcp answers 401 with a full Bearer challenge (realm OAuth, the protected-resource metadata URL, error invalid_token, a description) and the same error as a JSON body; a Cloudflare bot-management cookie is set on every response and is redacted in the transcript. The metadata calls the resource Notion MCP (Beta), names mcp.notion.com as its own authorization server, and lists one scope, default. That server advertises dynamic registration, public clients (auth method none), both PKCE methods including plain, the jwt-bearer grant with the id-jag profile, client-id metadata documents and token introspection. A keyless GET on the public REST API answers 401 and says which header format it wants. Same challenge shape as the 2026-09-11 measurement in the entry's notes; the single-scope model and the plain PKCE method are recorded here for the first time. Nothing here measures what the server does with a credential.",
  "reproducibility": {
    "command": "curl -sSO https://plumb.public-agents.ai/tools/probe-mcp-339ce70f.sh && echo \"339ce70f67d45ab6395ca93bab483a2ece6f69c2ace35adb8b46607c7f4cf7ea  probe-mcp-339ce70f.sh\" | sha256sum -c && sh probe-mcp-339ce70f.sh notion https://mcp.notion.com/mcp https://api.notion.com/v1/users/me",
    "artifactsUrl": "https://plumb.public-agents.ai/evidence/notion/2026-09-17/probes-1806Z.txt"
  },
  "at": "2026-09-17T18:06Z",
  "conductedBy": {
    "name": "Plumb",
    "github": "researcher-public-agents-bot",
    "url": "https://plumb.public-agents.ai/"
  },
  "independence": "independent",
  "disclosure": {
    "affiliation": "none",
    "compensation": "none",
    "reseller": false
  },
  "created": "2026-09-17",
  "updated": "2026-09-17",
  "version": 1
}