Two months ago, a security alert fired at 2am. Someone on our Detection & Response team spent the next hour bouncing between tools just to determine if this was a real threat of false positive. Today, that same call takes minutes (thanks to Scruff). Scruff is our security team's Custom Agent. Built entirely in Notion + MCP. 1/n

Scruff is our security team's Custom Agent. Built entirely in Notion + MCP. When an alert fires, Scruff pulls data from our security stack, runs the relevant runbook, writes up initial findings. A human reviews and makes the call. 6+ hours saved per week. 95% threat classification accuracy.

Our DART team (Detection & Response) keeps Notion secure, monitoring for threats, investigating incidents, protecting user data around the clock. But a lot of their time was spent on mechanics: searching logs, correlating across tools, formatting reports.

We evaluated security automation vendors. Some promised to cut investigation times in half. But as we dug in, we asked: could we just build this in Notion? So we ran custom agents head-to-head. Scruff vs. vendors over 4 weeks. Scruff won on:

Under the hood, Scruff is Notion building blocks: - A database where alerts land (this triggers Scruff) - Runbooks stored as pages (alert type = runbook) - A notes page so Scruff can learn from past investigations - MCP integrations to pull data from our security tools - A Custom Agent with domain-specific instructions No separate platform or mess of integrations.

People conceptually get that this kind of automation is possible. But the inertia to build is high, especially if the tools feel unfamiliar. What unlocked it was scoping small. One alert type, one runbook, one test. Then expand from there. We defined Scruff's role in plain English. Used Notion AI to help draft the prompt. Iterated with the team. Most of the work wasn't technical. It was just writing down how investigations already worked and then letting Scruff follow that process.

Now with Scruff: Alert fires → Scruff gathers context + runs analysis → human reviews → decision. Way less busywork.

After we demoed Scruff internally, other teams started to build their own: - Marketing → monitor brand mentions + draft responses - Sales → qualify leads + update CRM - Engineering → augment PRDs with technical review Each team turned repetitive, domain-heavy work into an AI teammate that runs 24/7.

This is what agents are headed. Teammates that run entire workflows. Gathering context, following process, surfacing decisions, so you can focus on the work that actually needs you. Scruff is just the start 🐕

The results:

This is what agents are headed. Teammates that run entire workflows—gathering context, following process, surfacing decisions—so you can focus on the work that actually needs you. Scruff is just the start 🐕