Does not work with Claude Code and Notion MCP

[notxcain]

First of all thank you for this tool — the pain is real.

I tried using it with Claude Code and Notion MCP and it looks like it fails during the auth flow. Because normally, the CC redirects you to the Notion authorization page.

Config:

"notion": {
  "type": "stdio",
  "command": "npx",
  "args": [
    "@respawn-app/tool-filter-mcp",
    "--upstream",
    "https://mcp.notion.com/mcp"
  ]
}

P.S. Having --allow would greatly improve the UX when one needs only a couple of MCP tools.

[Nek-12]

Hi! Unfortunately, this doesn't support oauth, see #4 . Because claude code assumes that stdio mcps cannot have authentication. For the mcp to work, the only thing you can do right now is to use API tokens passed via env or headers (the mcp supports that). But oauth would be done through the MCP itself (something like a separate CLI flow `tool-filter-mcp --auth "mcp.notion.com/mcp"). And only then you'd be able to use it in CC.

That's a solution, but it's also a security risk unless we store the credentials in a keychain.

Would you be okay if we stored your refresh/auth tokens in plain text in your home directory? Because full auth implementation will take more time to implement.

[notxcain]

Ah, sorry I somehow missed the existing issue. Now I see the root cause.
The tool-filter-mcp --auth flow sounds good.
Regarding the token storage, I would suggest putting that on user's shoulders.
As a result of the --auth "https://mcp.notion.com/mcp" invocation, emit something like TOOL_FILTER_MCP_ED3AA1_TOKEN=KRp6vsjT3BlbkFJ8U4lSrP.
Explain that this has to be present in the environment.
Internally store the mapping of 'https://mcp.notion.com/mcp` to ED3AA1.
Would that work in general?

Also, I suspect tool-filter-mcp --auth would need some kind of --context because in different projects on the same machine there might be different MCP server identities.

[Nek-12]

No, that emission won't work. Refresh tokens expire, and the MCP needs to update them. Re-authing every few days is too annoying (i tried)

[notxcain]

Got it. @Nek-12 do you consider transforming this from stdio script into a local http server? With proper configuration (e.g. with different path mappings), could it be a single server handling all the the upstream servers?

[Nek-12]

That could make sense, but then the burden of running the server would be on user. Do you believe it's fine to start this MCP's server manually each time you run any of the agents? Or it running permanently as a system daemon?

[notxcain]

I'd let it run permanently, not a big deal.

[Nek-12]

@notxcain re: allow list:

To allow only specific tools (e.g., read_file, write_file, search):

--deny "^(?!read_file$|write_file$|search$).*"

This regex matches anything that is NOT exactly read_file, write_file, or search, effectively denying everything except those three.

To allow only tools matching a pattern (e.g., anything starting with git_):

--deny "^(?!git_).*"

This denies everything that doesn't start with git_.

To allow tools matching multiple patterns:

--deny "^(?!git_|file_|search).*"

The key is the negative lookahead (?!...) which creates an "inverted" match - denying everything that doesn't match your allowed patterns.