MCP server discovery questionnaire Mission Control | Managed Intelligence Provider Leave blank An AI assistant is only as useful as the systems and data it can reach. An MCP (Model Context Protocol) server is that connection: it lets your AI assistant look things up and take actions in your systems through a controlled set of "tools", with a full record of each request, response and tool call. Answer what you can; "not sure" is a useful answer. Do not enter passwords, API keys, tokens or other secrets in this form. We'll arrange a secure channel for anything sensitive. Your details Company name * Your name * Email * 1. Organization and project overview This section sets the business context: why the project exists and who decides. 1.1Number of active users (approximate) 1.2Which locations or regions will use this service? US Outside US 1.3Who is the technical contact?Name, title and email 1.4What business problem or outcome is driving this project, and how will you measure success? 1.5Who is the executive sponsor and final decision-maker? 1.6Target go-live date or deadline 1.7Total project budgetSeparate from the monthly infrastructure budget in 7.6 2. AI provider and how people use it The AI provider and the apps your people use determine how the MCP server connects and signs users in. 2.1Which AI provider(s) do you use today? Anthropic Claude OpenAI Microsoft Copilot Google Gemini Self-hosted model 2.2Which plan or license tier are you on? Consumer Team Enterprise API only Not sure 2.3Does your AI plan support connecting custom MCP servers today? Yes No Not sure 2.4Does your AI provider account have data-retention or "no training on our data" settings already agreed? Yes No Not sure 2.5Who administers the AI provider account, and can they add connectors for your users? 3. Scope, tasks and pain points This is the most important section: these answers determine the complexity and scalability of the project. 3.1Should the AI only read and summarize information at first, or also create, update or delete records? Read and summarize only Read first, add changes later Create and update Create, update and delete 3.2Are there questions people ask that span several systems at once?For example, a customer's orders, tickets and invoices together 3.3Do you need reports, files or documents generated (PDF, Excel, Word)? 3.4Should the AI send messages or notifications (email, Teams, Slack, SMS)? 3.5Are there scheduled or recurring tasks you want run without a person asking? 3.6What are your top 3 to 5 use cases, ranked?For each, who does it today and roughly how long does it take? 3.7For any actions that create, change or send something, which ones require a person to approve before they run? 4. Systems inventory List every system the AI might need to read from or act in, and who controls it. "Vendor" means a SaaS product the vendor runs (Salesforce, Microsoft 365); "internal" means something your team built or hosts. Consider email and calendar, file storage, CRM, ERP and accounting, ticketing and helpdesk, HR and payroll, project management, e-commerce, telephony, data warehouse, and custom line-of-business apps. System 1 System name What it's used for Vendor or internalVendorInternal Where it runsCloudData centerOn-premises Known API?YesNoUnsure Access method Read only or read/writeRead onlyRead/write Add another system 4.1For vendor systems: does your plan include API access, and are there API call limits or extra costs? 4.2Do any vendor contracts restrict connecting third-party or AI tools to your data? 4.3For internal systems: who maintains them, and can that team make changes if needed? 4.4Are any systems scheduled to be replaced? 4.5Is there a system that acts as the "source of truth" where data overlaps?For example, customer records in both CRM and ERP 4.6Do you already have an integration or middleware platform (for example Power Automate, Zapier, MuleSoft, Boomi)? 4.7Does each system keep audit logs that will show actions taken through the AI separately from actions the user took directly? 5. Sign-in, permissions and security The AI should never see more than the person using it is allowed to see. These answers decide how we enforce that. 5.1Which identity provider do your people sign in with? Microsoft Entra ID Okta Google Workspace Other 5.2Is single sign-on and multi-factor authentication required for this service? Yes No Not sure 5.3Should each user's own permissions in each system apply, or will one shared service account be used? Each user's own permissions Shared service account Not sure 5.4Should access to individual tools be limited by role or group?For example, only finance can use invoice tools 5.5Where should credentials and secrets be stored (Azure Key Vault, AWS Secrets Manager, HashiCorp Vault, other)? How often must they be rotated?Location and policy only. Never the secrets themselves. 5.6Do you require a security review, penetration test or vendor risk questionnaire before go-live? Yes No Not sure 5.7Are there network rules: must the server be reachable only from your network, a VPN, or specific IP addresses? 5.8How should we protect against the AI being tricked by content inside documents or emails into taking unwanted actions? Any existing policy? 5.9Who must be notified, and how quickly, if a security incident involves this service? 5.10Should destructive actions (delete, bulk update, sending to external recipients) be blocked entirely, or allowed only with confirmation? Blocked entirely Allowed with confirmation Depends on the action 5.11Should we enforce rate or volume limits per user or per tool to limit damage from a compromised account or runaway automation? Yes No Not sure 5.12How should access be revoked when an employee leaves? Is offboarding tied to your identity provider automatically? 5.13Will users connect third-party MCP servers or connectors alongside ours? If so, who approves them? 5.14How long must request and tool-call logs be kept, and who is allowed to view them? 6. Compliance, privacy and data location Regulations you follow shape what data the AI may see, where logs live, and how long they are kept. 6.1Which regulations or frameworks apply? HIPAA PCI DSS SOC 2 ISO 27001 GDPR CCPA CMMC FINRA None 6.2What types of sensitive data sit in the systems listed? Customer personal data Health Payment card Employee Financial Legal 6.3Is any data off-limits to the AI entirely?List systems, tables, fields or document folders 6.4Must data and logs stay in a specific country or region? 6.5Do you have an AI use policy or acceptable-use policy we should follow?Paste a link, or tell us and we'll arrange a secure way to receive it 6.6Will contracts need a data processing agreement or business associate agreement? DPA BAA Both Neither Not sure 6.7Do customers or partners have contractual limits on how their data is processed by AI? 6.8Do you need the ability to delete a specific person's data from logs on request? Yes No Not sure 7. Hosting and infrastructure Where the server runs affects cost, security review and who maintains it. 7.1Where should the MCP server run? Hosted and managed by us Your Azure Your AWS Your Google Cloud Your own servers Not sure 7.2Do you have container or Kubernetes standards we must follow? 7.3Is there an existing monitoring tool we should report into (Azure Monitor, Datadog, New Relic, other)? 7.4Do you require backup and disaster recovery for the server and its logs? Target recovery time? 7.5Do you need separate development, test and production copies of the server? Yes No Not sure 7.6Is there a monthly infrastructure budget ceiling we should design within? 8. Support and ongoing operations After launch, systems change and new needs appear. These answers define who keeps the service running and how. 8.1Who owns ongoing maintenance after launch (vendor API changes, new tools, new systems), and should that be covered under your managed services agreement or billed separately? 8.2What support response time do you expect if the service is unavailable? 8.3How will users be trained, and who will announce the rollout internally? 8.4How often should we review usage, cost and security with you after go-live? Helpful to share Don't upload these here. Tick what you have and we'll set up a secure channel. Documents available API documentation or database schema for internal systems Examples of the reports or answers people need today Send questionnaire
