Notion built Scruff to prepare security investigations before an analyst decides how to respond. An alert entering a database triggers the AI agentAn AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.Full definition →, which consults investigation instructions organized by alert type and retrieves information from external security tools through MCPThe Model Context Protocol — an open standard that lets any AI assistant plug into any tool or data source without custom integration code.Full definition → connections. Its findings give the human responder context windowThe maximum amount of text a model can consider at once — its working memory for the current conversation or task.Full definition → for deciding whether an alert represents a threat. In its January 2026 account, Notion reports saving more than six hours of investigation busywork per week across its security response team. The post also notes that the Custom Agents and MCP integrations it relied on were not yet publicly available.
Terms in this piece · Glossary
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
MCP — The Model Context Protocol — an open standard that lets any AI assistant plug into any tool or data source without custom integration code.
context window — The maximum amount of text a model can consider at once — its working memory for the current conversation or task.
