Overview Creates one or more Notion pages, with the specified properties and content. Parent All pages created with a single call to this tool will have the same parent. The parent can be a Notion page ("page_id") or data source ("data_source_id"). If the parent is omitted, the pages are created ...
Risk signalsAccepts raw HTML/template content (pages[].content)
Part of the Notion server.
Free to start. No card required.
AI agents use notion-create-pages to create or modify resources in Notion. Write operations carry medium risk because an autonomous agent could trigger bulk unintended modifications. Rate limits prevent a single agent session from making hundreds of changes in rapid succession. Argument validation ensures the agent passes expected values.
Without a policy, an AI agent could call notion-create-pages repeatedly, creating or modifying resources faster than any human could review. PolicyLayer's rate limiting ensures write operations happen at a controlled pace, and argument validation catches malformed or unexpected inputs before they reach Notion.
Write tools can modify data. A rate limit prevents runaway bulk operations from AI agents.
{
"version": "1",
"default": "deny",
"tools": {
"notion-create-pages": {
"limits": [
{
"counter": "notion-create-pages_rate",
"window": "minute",
"max": 30,
"scope": "grant"
}
]
}
}
}See the full Notion policy for all 26 tools.
These attack patterns abuse exactly the kind of access notion-create-pages gives an agent. Each links to the full case and the policy that stops it:
Other write tools across the catalogue. The same approach applies to each: rate-limit and validate the arguments.
Overview Creates one or more Notion pages, with the specified properties and content. Parent All pages created with a single call to this tool will have the same parent. The parent can be a Notion page ("page_id") or data source ("data_source_id"). If the parent is omitted, the pages are created as standalone, workspace-level private pages, and the person that created them can organize them later as they see fit. If you have a database URL, ALWAYS pass it to the "fetch" tool first to get the schema and URLs of each data source under the database. You can't use the "database_id" parent type if the database has more than one data source, so you'll need to identify which "data_source_id" to use based on the situation and the results from the fetch tool (data source URLs look like collection://<data_source_id>). If you know the pages should be created under a data source, do NOT use the database ID or URL under the "page_id" parameter; "page_id" is only for regular, non-database pages. Content Notion page content is a string in Notion-flavored Markdown format. Don't include the page title at the top of the page's content. Only include it under "properties". IMPORTANT: For the complete Markdown specification, always first fetch the MCP resource at notion://docs/enhanced-markdown-spec. Do NOT guess or hallucinate Markdown syntax. This spec is also applicable to other tools like update-page and fetch. Properties Notion page properties are a JSON map of property names to SQLite values. When creating pages in a database: - Use the correct property names from the data source schema shown in the fetch tool results. - Always include a title property. Data sources always have exactly one title property, but it may not be named "title", so, again, rely on the fetched data source schema. For pages outside of a database: - The only allowed property is "title", which is the title of the page in inline markdown format. Always include a "title" property. IMPORTANT: Some property types require expanded formats: - Date properties: Split into "date:{property}:start", "date:{property}:end" (optional), and "date:{property}:is_datetime" (0 or 1) - Place properties: Split into "place:{property}:name", "place:{property}:address", "place:{property}:latitude", "place:{property}:longitude", and "place:{property}:google_place_id" (optional) - Number properties: Use JavaScript numbers (not strings) - Checkbox properties: Use "__YES__" for checked, "__NO__" for unchecked Special property naming: Properties named "id" or "url" (case insensitive) must be prefixed with "userDefined:" (e.g., "userDefined:URL", "userDefined:id") Templates When creating a page in a database, you can apply a template to pre-populate it with content and property values. Use the "fetch" tool on a database to see available templates in the <templates> section of each data source. When using a template: - Pass the template's ID as "template_id" in the page object. - Do NOT include "content" when using a template, as the template provides it. - You can still set "properties" alongside the template to override template defaults. - Template application is asynchronous. The page is created immediately but starts blank; the template content will appear shortly after. Icon and Cover Each page can optionally have an icon and a cover image. - "icon": An emoji character (e.g. "🚀"), a custom emoji by name (e.g. ":rocket_ship:"), or an external image URL. Use "none" to remove. Omit to leave unchanged. - "cover": An external image URL. Use "none" to remove. Omit to leave unchanged. Examples <example description="Create a page with an icon and cover"> { "pages": [ { "properties": {"title": "My Page"}, "icon": "🚀", "cover": "https://example.com/cover.jpg" } ] } </example> <example description="Create a page from a database template"> { "parent": {"data_source_id": "f336d0bc-b841-465b-8045-024475c079dd"}, "pages": [ { "template_id": "a5da15f6-b853-455d-8827-f906fb52db2b", "properties": { "Task Name": "New urgent bug" } } ] } </example> <example description="Create a standalone page with a title and content"> { "pages": [ { "properties": {"title": "Page title"}, "content": "# Section 1 {color="blue"} Section 1 content <details> <summary>Toggle block</summary> Hidden content inside toggle </details>" } ] } </example> <example description="Create a page under a database's data source"> { "parent": {"data_source_id": "f336d0bc-b841-465b-8045-024475c079dd"}, "pages": [ { "properties": { "Task Name": "Task 123", "Status": "In Progress", "Priority": 5, "Is Complete": "__YES__", "date:Due Date:start": "2024-12-25", "date:Due Date:is_datetime": 0 } } ] } </example> <example description="Create a page with an existing page as a parent"> { "parent": {"page_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"}, "pages": [ { "properties": {"title": "Page title"}, "content": "# Section 1 Section 1 content Section 2 Section 2 content" } ] } </example>. It is categorised as a Write tool in the Notion MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.
Register the Notion MCP server in PolicyLayer and add a rule for notion-create-pages: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Notion. Nothing to install.
notion-create-pages is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.
Yes. Add a rate_limit block to the notion-create-pages rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for notion-create-pages. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
notion-create-pages is provided by the Notion MCP server (@notion-mcp-server). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Deterministic rules across all 26 Notion tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.
Free to start. No card required.
4,600+ MCP servers and 31,000+ tools scanned and risk-classified.