MCP servers can put ads in your agent's context. Strip them at the seam.
Run agents? ACP lets you see, control, and price every tool call they make — allow/ask/deny policy, per-session cost, and a full audit log for Claude Code, Cursor, Codex, and OpenClaw, in one command:
curl -sf https://agenticcontrolplane.com/install.sh | bashGetting started → · see your first governed call → · free up to 5 agents · prefer fully on-device? add --local
You review your system prompt. You review your tool definitions. Nobody reviews the tool response — it flows straight from a third-party server into your agent’s context, and the model reads it with the same authority as everything else there.
That makes tool responses the unlocked back door into an agent’s context. Prompt injection is the adversarial version: an instruction planted in a web page or an MCP result that the model treats as something to act on. But there’s now a commercial version of the same move — SDKs an MCP server author can install to monetize their server by appending a sponsored line or a bordered ad card to every tool result. The format is documented in the SDK; the ad arrives inside the response your agent was going to read anyway.
Both ride the same pipe. An ad in a tool result and an instruction in a tool result are the same class of problem: third-party text entering the context with tool-result authority. The disclosed ad is the benign end of the spectrum. The undisclosed instruction is the other end. If you can filter one at the seam, you can see — and filter — the other.
Where the filter sits
ACP already sits inline on that pipe in two places: the model proxy rewrites tool_result content before it reaches the model (both the Anthropic and OpenAI request shapes), and the MCP gateway scans tool output on the way back to the client. The same content-pattern machinery that masks PII there now understands a second category: sponsored content.
The behavior differs by category, deliberately:
- PII matches are masked the way they always were — and the matched text never leaves the redaction pass. It’s your data.
- Sponsored matches have the whole match replaced with a placeholder:
[sponsored content removed by ACP].
The placeholder is deliberately loud. The agent — and anyone reading the transcript — sees that something was removed and by what. A stripped ad must never be a silent hole in the context; silent edits to what a model reads are their own failure mode, and we refuse to add one while removing another.
Every removal is on the record
Each request’s audit row carries what was redacted from its tool results — the pattern types and the match count. So this isn’t just filtering; it’s measurement. You can see, per workspace, which tools’ results are carrying sponsored content and how often. On our own workspaces we go further and record each stripped match as an observation — which network, which tool, what the creative said — so when we report on ad injection it will be from data, not anecdotes.
Your agent can read that record about itself, too: the audit rows, including redactions, are part of the self-optimize MCP surface every workspace exposes to its own agents.
Turning it on
One toggle: Policies → Patterns → “Block sponsored content” in the console. It installs a pinned, versioned filter list — the network-specific patterns are extracted from the ad SDKs’ own published packages, so the filter matches the format the SDK documents. The list version is stamped where you can see it, so a stale bundle is diagnosable from the audit trail rather than a mystery.
You can also define your own patterns on the same tab: any custom pattern whose type is sponsored or starts with sponsored- gets the placeholder treatment; everything else keeps the PII mask. With no patterns defined, nothing changes — the built-in PII pass behaves exactly as before.
Why the choke point
You can’t audit the code of every MCP server your agents touch, and you can’t re-review it on every version bump. What you can do is control the one pipe every response flows through before it becomes model input. That’s the same argument as policy on the tool call itself, applied to the return path: decide what goes out, and decide what comes back.
The ad networks picked their injection point well. It’s also exactly where a control plane sits.