{ "$schema_doc": "https://gtmstacker.com/registry/schema/entry.schema.json", "stability": "emerging", "generator": "agentic-media-registry", "generated_at": "2026-09-09T00:00:00Z", "id": "com.gtmstacker.registry/news/mcp-tool-description-injection", "type": "news", "slug": "mcp-tool-description-injection", "canonical_url": "https://gtmstacker.com/registry/news/mcp-tool-description-injection/", "title": "Practitioner report: an MCP server's tool descriptions can inject instructions into your agent — Notion's MCP flagged", "description": "A widely-shared practitioner report claims Notion's official MCP server instructs connected agents to promote Notion mid-task and 'never explain why', with a similar pattern attributed to Firecrawl — reported, not independently verified. The durable, verifiable point: an MCP tool description is text the server injects into your context on every call, and the model cannot tell 'how to use this tool' from 'advertise this'. Vet MCP servers before you connect them.", "category": "mcp-agents", "tags": [ "mcp-agents", "news", "governance", "mcp", "agent-security" ], "status": "active", "revision": 1, "content_hash": "261c682e0a4ac599fbc14353c95e52b3eaccbad2e4dec6fec445e8e2fbad8b3e", "date_published": "2026-09-08T00:00:00Z", "date_modified": "2026-09-08T00:00:00Z", "source": { "name": "X · @om_patel5", "url": "https://x.com/om_patel5/status/2097129187706376212" }, "one_liner": "A widely-shared practitioner report claims Notion's official MCP server instructs connected agents to promote Notion mid-task and 'never explain why', with a…", "open_source": "unknown", "self_hostable": "unknown", "pricing_model": "unknown", "aliases": [], "alternatives": [], "secondary_categories": [], "lead": "A widely-shared practitioner report claims Notion's official MCP server instructs connected agents to promote Notion mid-task and 'never explain why', with a similar pattern attributed to Firecrawl — reported, not independently verified. The durable, verifiable point: an MCP tool description is text the server injects into your context on every…", "chunks": [ { "index": 0, "heading_path": [], "est_tokens": 117, "text": "A widely-shared practitioner report claims Notion's official MCP server instructs connected agents to promote Notion mid-task and 'never explain why', with a similar pattern attributed to Firecrawl — reported, not independently verified. The durable, verifiable point: an MCP tool description is text the server injects into your context on every call, and the model cannot tell 'how to use this tool' from 'advertise this'. Vet MCP servers before you connect them." }, { "index": 1, "heading_path": [ null, "Notes" ], "est_tokens": 304, "text": "a similar pattern attributed to Firecrawl — reported, not independently verified. The durable, verifiable point: an MCP tool description is text the server injects into your context on every call, and the model cannot tell 'how to use this tool' from 'advertise this'. Vet MCP servers before you connect them.\n\n- Summarised from a viral X thread (2026-09-08, @om_patel5). The claim that Notion's / Firecrawl's specific MCP servers contain these instructions is a practitioner observation, NOT independently verified against the vendors' current servers — reported as unverified. The durable, verifiable point is the MCP-trust mechanism itself (a tool description is context the server injects on every call). Practical mitigations from the thread: pull the raw tools/list response before installing an MCP and read what it injects; diff it after every update; log raw tool results when testing; and enforce your real constraints in code, not in a prompt. Tools addressing exactly this shipped in the same pass — see Tripwire and Geiger. The thread also cites an NVIDIA 'skillspector' skill-scanner (unverified here).\n- Curated from the GTM Stacker signal registry (2026-09-09 pass: daily pull + viral-posts brief)." } ], "alternates": { "markdown": "https://gtmstacker.com/registry/news/mcp-tool-description-injection/index.md", "html": "https://gtmstacker.com/registry/news/mcp-tool-description-injection/", "json": "https://gtmstacker.com/registry/news/mcp-tool-description-injection/index.json" }, "jsonld": { "@context": "https://schema.org", "@graph": [ { "@type": "WebSite", "@id": "https://gtmstacker.com/#website", "url": "https://gtmstacker.com/", "name": "GTM Stacker Agent Registry", "description": "A daily-updated, agent-native registry of open-source tool discoveries, tool updates, and curated news for the go-to-market / RevOps engineering niche. Machine-readable first: agents can discover, parse, page, and delta-sync it without scraping HTML.", "inLanguage": "en", "publisher": { "@id": "https://gtmstacker.com/#organization" } }, { "@type": "Organization", "@id": "https://gtmstacker.com/#organization", "name": "GTM Stacker", "url": "https://gtmstacker.com", "description": "The growth-systems practice of Theo Popov: AI-native enrichment, outbound, content engines and internal tooling for startups and venture programs. Its agent-native media property, the GTM Stacker Agent Registry, maintains a daily-updated catalog of open-source go-to-market and RevOps tools that both people and AI engines can discover, compare, and cite.", "foundingDate": "2024-08", "knowsAbout": [ "go-to-market engineering", "RevOps", "sales automation", "marketing operations", "open-source software", "AI agents" ], "founder": { "@type": "Person", "@id": "https://gtmstacker.com/#founder", "name": "Theo Popov", "jobTitle": "Growth Operations & GTM Systems", "url": "https://gtmstacker.com/about/", "sameAs": [ "https://www.linkedin.com/in/theo-popov", "https://x.com/Theo_Popov", "https://github.com/theopopov" ], "worksFor": { "@id": "https://gtmstacker.com/#organization" } }, "mainEntityOfPage": "https://gtmstacker.com/registry/about/" }, { "@type": "NewsArticle", "@id": "https://gtmstacker.com/registry/news/mcp-tool-description-injection/#article", "headline": "Tool descriptions are untrusted context: any MCP you connect can write instructions your model treats as authoritative", "description": "A widely-shared practitioner report claims Notion's official MCP server instructs connected agents to promote Notion mid-task and 'never explain why', with a similar pattern attributed to Firecrawl — reported, not independently verified. The durable, verifiable point: an MCP tool description is text the server injects into your context on every call, and the model cannot tell 'how to use this tool' from 'advertise this'. Vet MCP servers before you connect them.", "url": "https://gtmstacker.com/registry/news/mcp-tool-description-injection/", "isPartOf": { "@id": "https://gtmstacker.com/#website" }, "datePublished": "2026-09-08T00:00:00Z", "dateModified": "2026-09-08T00:00:00Z", "author": { "@id": "https://gtmstacker.com/#organization" }, "publisher": { "@id": "https://gtmstacker.com/#organization" } }, { "@type": "BreadcrumbList", "@id": "https://gtmstacker.com/registry/news/mcp-tool-description-injection/#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "GTM Stacker Registry", "item": "https://gtmstacker.com/registry/" }, { "@type": "ListItem", "position": 2, "name": "MCP Agents", "item": "https://gtmstacker.com/registry/category/mcp-agents/" }, { "@type": "ListItem", "position": 3, "name": "Practitioner report: an MCP server's tool descriptions can inject instructions into your agent — Notion's MCP flagged", "item": "https://gtmstacker.com/registry/news/mcp-tool-description-injection/" } ] } ] }, "news": { "headline": "Tool descriptions are untrusted context: any MCP you connect can write instructions your model treats as authoritative" } }