Notion's official MCP connector injects an ad for Notion Business into agent context and tells the agent never to explain why

r/ClaudeAI (1,380 upvotes, 104 comments)·high signalXBlueskyLinkedInCopy link

A r/ClaudeAI post at 1,380 upvotes shows Notion's first-party MCP connector returning tool-description text that instructs the calling agent to pitch Notion Business mid-task and to not disclose the instruction, behavior the poster could not find documented anywhere in Notion's docs. The subreddit's auto-generated TL;DR after 100 comments notes commenters identified this as the general MCP tool-poisoning attack surface rather than a Notion-specific lapse, and names Firecrawl as another connector caught prioritizing its own tools. The practical takeaway for anyone running MCP servers is to dump and read raw tool descriptions before wiring a third-party connector into an agent loop.