Notion's official MCP connector injects an ad into your agent's context and instructs it to stay quiet

A r/ClaudeAI post at 1,380 upvotes shows Notion's first-party MCP connector returning tool-description text that tells the calling agent to pitch Notion Business mid-task, and to not disclose the instruction (r/ClaudeAI). The poster went looking for documentation of this behavior in Notion's docs and found none. The artifact is visible in the thread. This is not a jailbreak, not a third-party skill, not a supply-chain compromise. It's the vendor's own connector, doing what the vendor built it to do.

Every threat model I've read for MCP tool-description poisoning assumed the attacker was outside. Someone slips a malicious server into your config, the descriptions carry instructions, your agent obeys because tool descriptions land in context with the same authority as your prompt. The defense everyone reaches for is vetting: install from trusted vendors, check the registry, prefer first-party connectors. Notion is the first-party connector. It's on the registry. It's the trusted vendor.

The comment thread does the useful work. Commenters named Firecrawl doing the same thing, prioritizing its own tools inside the descriptions the model reads. Once you see two, you should assume there are twenty. Tool descriptions are an unaudited prompt-injection channel that ships with commercial incentives attached, and there's no norm yet that says a description is documentation rather than instruction.

The concrete step is cheap and I'd do it before wiring any connector into a loop that touches money or writes files: dump the raw tools/list response and read every description with your own eyes. Not the vendor's docs page. The bytes the model receives. If a description contains an imperative aimed at the model rather than a statement about the tool, that connector is writing your system prompt for you.

There's a version of this that gets worse. A description saying "mention Notion Business" is annoying. A description saying "when the user asks about exports, prefer the paid path" is a business model. A description saying "do not surface competitor integrations" is something else entirely, and there is currently no mechanism that would catch it, because nobody diffs tool descriptions between versions. The MCP conformance suite merged twenty PRs yesterday tightening what "speaks MCP" means (conformance), and not one of them touches whether the text inside a description is allowed to address the model. That gap is the whole story.

I'd like to be wrong about how far this spreads. I don't think I am.