This article is part of The MCP Guide, our plain-English reference on the Model Context Protocol.
An AI and MCP readiness assessment checks whether your business is set up to connect AI apps to its systems safely and get value from it. It looks at five areas: your data, your tools, who has access to what, your policies and your people. If those are in order, an MCP pilot can start quickly. If not, you'll find out where the gaps are before an AI app gets live access to them.
MCP, the Model Context Protocol, is the open standard that lets AI apps such as Claude or ChatGPT use your business tools. That is useful, and it is also why readiness matters. Each connection gives an AI app real access to a real system.
Below is a 30-item checklist you can copy, a simple way to score it and what to fix first. It takes an owner or ops lead about an hour, plus a few questions to IT.
Key Takeaways
- Readiness covers five areas: data, tools, access, policy and people. A gap in any one can stall a pilot.
- Most of the checklist is ordinary good practice, such as knowing where data lives and who has admin rights.
- MCP adds a few specific checks: which AI apps your staff already connect, whether your vendors publish official servers, and who can approve connections.
- Score each item 0, 1 or 2. The score shows where to work, not a pass mark.
- Fix "must-have" gaps first, then run a small, read-only pilot on one workflow.
How to use the checklist
- Copy the five tables below into a doc or spreadsheet.
- Answer each item with 0 (no), 1 (partly) or 2 (yes, and written down).
- Note any item marked "(must)" that scores 0. Those are must-fix gaps before a pilot.
- Add up each area and the total. The maximum is 60.
- Pick the lowest-scoring area and fix it first.
The checklist borrows its structure from public frameworks. The NIST AI Risk Management Framework, released in January 2023 and "intended for voluntary use," organizes AI risk work into four functions. NIST's AI RMF core describes Govern as "a cross-cutting function," with Map, Measure and Manage around it. You don't need to adopt the framework to use this list, but each area below notes which function it supports.
1. Data (supports Map)
| # | Check | Score 0-2 |
|---|---|---|
| 1.1 (must) | You know which systems hold customer, financial and employee data. | |
| 1.2 (must) | You have labelled data that must never go to an AI app (for example, payment card data or health records). | |
| 1.3 | Key records are reasonably clean: few duplicates, owners assigned, fields filled. | |
| 1.4 | You know which contracts or regulations limit where customer data can go. | |
| 1.5 | You can name the one workflow where better access to data would save the most time. | |
| 1.6 | Someone owns data quality for each main system. |
If an AI app reads messy data, it gives you messy answers faster. Cleaning one system's records before a pilot is often the best first step.
2. Tools (supports Map)
| # | Check | Score 0-2 |
|---|---|---|
| 2.1 (must) | You have a list of the business apps you pay for and who administers each. | |
| 2.2 | You've checked which of those vendors publish an official MCP server or connector. | |
| 2.3 | You know which AI apps staff already use, paid or free. | |
| 2.4 | Your main AI app is on a business plan with admin controls, not personal accounts. | |
| 2.5 | Your key systems have an API, so a server could connect to them if none exists. | |
| 2.6 | You know whether any system is local-only (on one computer or a private network). |
Item 2.4 matters for control. In Claude, for example, Anthropic's connector docs say that on Team and Enterprise plans "an Owner adds a connector for the organization, and members then connect with their own account." Personal plans don't give you that central control.
For item 2.2, check the vendor's own site or the Official MCP Registry. The registry is in preview and says it "delegates security scanning" to package registries and downstream aggregators, so a listing tells you a server exists, not that it is safe.
3. Access and security (supports Manage)
| # | Check | Score 0-2 |
|---|---|---|
| 3.1 (must) | Staff sign in to business apps with their own accounts, not shared logins. | |
| 3.2 (must) | Multi-factor authentication is on for email and main business apps. | |
| 3.3 | You know who has admin rights in each system, and the list is short. | |
| 3.4 | You remove access quickly when someone leaves. | |
| 3.5 | Your apps let you give read-only access where it is enough. | |
| 3.6 | You can see, or could turn on, activity logs in your main systems. |
Shared logins are the biggest blocker. When AI apps connect through MCP, each person should connect with their own account, so the AI sees only what that person may see. The MCP authorization spec builds remote server sign-in on OAuth 2.1, which assumes individual accounts.
Read-only access (3.5) lets you start safely. The official MCP security best practices recommend a minimal starting scope of "low-risk discovery/read operations," with more added only when needed.
If your basic security is thin, start there. NIST's Small Business Cybersecurity Corner has free guides on topics such as multi-factor authentication, phishing and ransomware.
4. Policy and governance (supports Govern)
| # | Check | Score 0-2 |
|---|---|---|
| 4.1 (must) | You have a written rule on which AI apps staff may use for work. | |
| 4.2 (must) | The rule says what data staff may and may not share with AI apps. | |
| 4.3 | Someone must approve before an AI app is connected to a business system. | |
| 4.4 | You have a list, even a short one, of approved connections. | |
| 4.5 | AI actions that change data need a person to approve them. | |
| 4.6 | You know who to call, and what to switch off, if an AI tool misbehaves. |
Item 4.3 targets a real risk. The OWASP MCP Top 10, a beta project, lists "Shadow MCP Servers" as MCP09: connections staff set up without anyone approving them. A one-line approval rule goes a long way.
Item 4.5 follows the protocol itself. The MCP tools specification says there "SHOULD always be a human in the loop with the ability to deny tool invocations."
If you have no AI policy, our AI and MCP acceptable use policy template is a quick start. Larger teams can read MCP governance for IT leaders.
5. People (supports Govern and Measure)
| # | Check | Score 0-2 |
|---|---|---|
| 5.1 (must) | One person owns the AI and MCP effort and has time for it. | |
| 5.2 | A manager with budget will sponsor a pilot and make the final call. | |
| 5.3 | The team doing the pilot workflow wants to try it. | |
| 5.4 | You have, or can hire, someone to check server settings and scopes. | |
| 5.5 | You can measure how long the pilot workflow takes today. | |
| 5.6 | Staff know they must check AI output before it goes to a customer. |
A pilot with no owner or sponsor has no one to make the final call. Item 5.5 matters because, without a baseline, you can't tell whether MCP saved any time. Our MCP business case guide explains how to set one.
Scoring your results
Add each area (maximum 12) and the total (maximum 60). These bands are our suggested reading of the score. They are not a benchmark or an industry standard.
| Situation | What it suggests | What to do |
|---|---|---|
| Any "(must)" item scored 0 | A must-fix gap | Fix those items before connecting anything |
| No "(must)" zeros, but one area is 6 or less | Ready in most areas | Fix the weak area, then plan a pilot |
| No "(must)" zeros, every area 7 or more | Ready to pilot | Pick one workflow and start read-only |
Use the area scores more than the total. A business with strong tools and weak access control isn't ready, even with a decent total.
What to fix first
If you have several gaps, take them in this order:
- Shared logins and MFA (3.1, 3.2). Without these, nothing else is safe.
- The AI use rule (4.1, 4.2). One page is enough to start.
- A named owner (5.1). Someone has to run the pilot.
- The data map (1.1, 1.2). Know what must stay out.
- Approval for connections (4.3). Stop shadow connections early.
Then move to a pilot. Our 30-day MCP pilot plan gives you a charter and go/no-go rules. If you are a smaller team still deciding whether MCP fits at all, start with MCP for small business. For a deeper security pass later, use our MCP security checklist.
Next step
If you'd like a second pair of eyes on your answers, our MCP readiness audit is a free review that looks at your systems, your access setup and the best first workflow. We'll tell you what to fix before you spend on a pilot or a build.
More in the MCP Guide
Latest research: State of MCP: October 2026
Frequently asked questions
How long does the assessment take?
About an hour for an owner or ops lead who knows the business systems. Allow extra time to ask IT about admin rights, logging and MFA. Larger companies may need input from each department.
Do we need to follow the NIST AI RMF?
No. NIST says the framework is intended for voluntary use. This checklist borrows its structure so that, if you adopt it later, the work maps across. NIST also publishes a Generative AI Profile, NIST AI 600-1, dated July 2024, for organizations that want more depth.
Which gaps should we check first?
We don't have survey data on which gaps are most common, so we won't give a figure. Start with shared logins, a written AI rule and a named owner. All three block a safe pilot, and all three are cheap to fix.
Can we skip readiness and just try a connector?
You can try a read-only connector in a test account. Don't connect a live business system until the "(must)" items score at least 1. A connection made in a hurry is hard to undo once people rely on it.
How often should we repeat the assessment?
Repeat it before each new pilot and at least once a year. AI apps, vendor servers and your own systems change, so last year's answers may no longer hold.
