Incompatible with Notion Agent: strict schema validation rejects unknown fields (nonce, notion_user_id, prompt)

[darkangelpraha]

Problem

When Notion Agent connects to the hosted Supabase MCP server (https://mcp.supabase.com/mcp?project_ref=...), the connection fails immediately with:

{"message": "Unrecognized key(s) in object: 'nonce', 'notion_user_id', 'prompt'"}

Notion Agent sends these extra fields during MCP initialization. The Supabase MCP server uses strict schema validation and rejects unknown keys.

Steps to Reproduce

1. In Notion Agent, add a custom MCP server: https://mcp.supabase.com/mcp?project_ref=<your_ref>
2. Attempt to connect
3. Error appears in the browser

Expected Behavior

The MCP server should either ignore unknown keys (strip them) or accept them gracefully, maintaining compatibility with MCP clients that send extra fields.

Actual Behavior

Connection fails immediately.

Possible Fix

Change Zod schema validation from .strict() to .strip() (or add .passthrough()) in the MCP initialization handler so that unknown fields are silently ignored rather than causing an error.

Related

This is also filed on the Notion side: makenotion/notion-mcp-server#221

[gregnr]

Thanks for reporting @darkangelpraha. Just tried this myself and was able to reproduce the same error.

We do indeed require a strict set of params on our OAuth /authorize endpoint. The reason is for correctness - if we silently ignore params that have real meaning but we haven't implemented, we'd be giving the client a false impression that we've handled them.

In this case nonce and prompt are both params sent as part of the OIDC spec, which we don't support at the moment. If we were to silently ignore something like prompt=none, the client is expecting us to either accept or reject the request without user interaction, but instead we'd still be sending the user to a consent screen.

notion_user_id is a different case - it isn't part of any standard spec, so we could potentially ignore it safely. I'll look into that.

The MCP spec doesn't include OIDC, so our expectation is that MCP clients only send query params that align with what is included:

• OAuth 2.1 draft
• RFC8414 - Authorization Server Metadata
• RFC7591 - Dynamic Client Registration

Worth adding that I would love to get this integration working. Let's see what Notion says on the related ticket.