Notion MCP server and Dome

1. 01

   Add the Notion MCP server

   Credentials are per user, through OAuth. Each teammate consents on their first call.

   $ dome tools add --name notion \
     --url https://mcp.notion.com/mcp \
     --auth-method oauth --credential-type per-user \
     --oauth-authorize-url https://mcp.notion.com/authorize \
     --oauth-token-url https://mcp.notion.com/token \
     --oauth-registration-url https://mcp.notion.com/register \
     --gateway ops-gateway

2. 02

   Sync the catalog

   Notion's tool list is fetched with your login, so connect Notion yourself before you sync. Otherwise agents hit “tool not available in this gateway”.

   $ dome tools catalog sync notion

3. 03

   Apply the rules

   Put the handbook's page_id in the rule, scope it to one agent, and simulate an update before you deploy.

   $ dome rules apply notion-args.cedar \
     --agent wiki-gardener --name notion-per-page

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about Notion itself, see Notion's documentation.

permit (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when { resource.connection_name == "notion" };
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "notion" &&
  resource.tool_name == "notion-update-page" &&
  resource has arguments && resource.arguments has command &&
  resource.arguments.command == "replace_content"
};
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "notion" &&
  resource.tool_name == "notion-update-page" &&
  resource has arguments && resource.arguments has page_id &&
  resource.arguments.page_id == "1c9e5d2a7b3f4e8a9d0c6b1a2e3f4d5c"
};