Notion Official Model Context Protocol Connector Injects Ads into AI Agents
Reports reveal Notion's official Model Context Protocol connector inserts promotional text into context sent to connected AI agents. This unexpected injection consumes prompt tokens and risks distorting downstream agent tool execution. Developers should inspect tool payload responses before piping them into Claude Code or Cursor.
Impact: Medium
Why it matters
Inspect incoming MCP tool payloads in Claude Code and Cursor to prevent third-party promotional content from polluting your agent context.
TL;DR
- 01Third-party MCP connectors may include unwanted promotional text inside tool responses.
- 02Injected vendor content inflates prompt token usage and pollutes agent working memory.
- 03Sanitize and inspect external MCP server outputs before passing them to agent models.
Model Context Protocol Payload Auditing
Developers integrating Notion's official Model Context Protocol (MCP) connector reported unexpected promotional text injected directly into AI agent context streams. Because client platforms like Claude Code and Cursor parse tool responses directly into the active prompt buffer, injected vendor text silently consumes token context and increases inference costs.
External tool providers inserting unsolicited content undermine agent reliability and create indirect prompt injection risks. Engineering teams relying on external MCP integrations should log incoming payloads, filter non-essential metadata, and restrict tool output schemas before feeding responses back into agentic reasoning loops.
✓ When to use
- Connecting productivity workspaces to AI coding agents via Model Context Protocol.
- Auditing context contamination and token waste in multi-tool agent environments.
What to do today
- Enable verbose logging for MCP server tool calls in Claude Code or Cursor to inspect raw payloads.
- Implement an MCP middleware or proxy to strip unverified text and metadata from tool results.
- Pin or self-host open-source Notion MCP implementations to maintain control over returned context.
Sources