# MCP review intake

The requester answers these ten questions before the review starts. Short answers are fine. Never include tokens, keys or passwords.

1. Use case: what will the agent do, in one sentence, and which decision does it support? Who uses it, how often, attended or on a schedule?
2. Systems and accounts in scope: which accounts, portals, projects or workspaces? Which are explicitly out of scope (other clients, brands, business units)?
3. Data: which categories are needed? Which personal data fields, if any? Is free text (notes, tickets, chat, reviews) needed?
4. Writes: does the task need to create, change or delete anything? Which objects and actions? Anything that sends, spends, publishes or deletes?
5. AI clients and plans: which client and plan (for example a chat app on a business plan, a coding agent, an IDE)? Where does it run: laptops, the provider's cloud, a scheduled job?
6. Servers: for each one, the vendor docs link, the endpoint or package and version, and who recommended it.
7. Identity: per-user OAuth, a service account, a system user or an API key? Who owns it?
8. Test environment: which sandbox, test portal, test ad account, test container or dev dataset can the review use? With none yet, the review is a provisional paper review and the tests become conditions.
9. Owners: who owns the system, who decides privacy questions, and who owns the connection's updates, incidents and revocation?
10. Timing: the deadline, and whether a pilot on synthetic or sandbox data would help.