MCP Integration Evaluation and Specification
MCP (Model Context Protocol) is the emerging standard for giving AI agents access to tools, data, and services. For AI PMs, MCP is both an opportunity and a decision: which tools does your AI need, should you build MCP servers or use existing ones, and what requirements must an MCP integration meet before it's safe to give an agent access to it?
---
Context
What MCP is (PM-level explanation):MCP is a protocol that lets an AI model call external tools — databases, APIs, file systems, services — in a standardised way. An MCP server exposes capabilities (tools, resources, prompts) that an AI client can discover and use.
The three MCP capability types:| Type | What it is | Example |
|---|---|---|
| Tools | Functions the AI can call | search_database(query), send_email(to, subject, body) |
| Resources | Read-only data the AI can access | customer_record/{id}, knowledge_base/docs |
| Prompts | Pre-built prompt templates the AI can invoke | summarize_meeting_notes, generate_report |
---
Step 1 — Define the capability requirements
Map each system the agent needs: read/write access, trust level (internal vs. third-party), and risk if misused.
Step 2 — Evaluate build vs. use existing MCP servers
For each system, check if existing MCP servers meet criteria: correct tools exposed, actively maintained, documented security, principle of least privilege, acceptable cost. Score ≥ 4/5 → use existing; < 4 → build.
Step 3 — Specify MCP tool requirements
Per tool: name, description, system, action type, risk classification, input/output schemas, error responses, agent access rules, and rate limits.
Step 4 — Define MCP server trust and security requirements
Authentication, data handling, tool isolation, prompt injection protection, and third-party server vetting checklist. Assign trust levels: Trusted (internal), Verified (vetted third-party), or Untrusted (never use in production).
Step 5 — Define the integration specification for engineering
Client configuration, tool allow-list (explicit — not "the agent uses what it needs"), tool descriptions for the model, system prompt additions, and testing requirements including prompt injection testing.