1. Where is MCP in the rollout? Still exploring Testing MCP ideas or validating whether the workflow is worth deeper attention. Internal workflow MCP is being wired into internal operator or engineering tooling first. Customer-facing soon The next release exposes MCP behavior to users, customers, or external stakeholders. Already live A real workflow is already connected and the cost of a mistake is no longer hypothetical.
2. What is the exposure level? Low sensitivity Mostly local files, harmless prompts, or reversible test environments. Internal systems Private repos, internal docs, code access, or internal dashboards are involved. Secrets or production access Tokens, databases, cloud access, billing, or deployment permissions are in scope. Customer or regulated data The workflow touches customer data, compliance boundaries, or serious audit exposure.
3. How messy is the stack? One trusted server A contained MCP setup with one main connector or a very narrow permission surface. A few trusted servers Several known connectors with a mostly controlled operator workflow. Mixed third-party servers The stack already includes outside packages, external connectors, or messy trust boundaries. Broad AI platform This is bigger than one connector and now affects architecture, rollout order, or platform policy.
4. What output do you actually need? Fast self-serve signal You want the shortest free next step before involving a founder review. Shareable report artifact You need a cleaner summary than raw terminal output for a team or buyer conversation. Go or no-go decision You want a fast human judgment before rollout gets riskier or more public. Broader risk order The bigger problem is architecture, rollout order, or how MCP fits into the wider product.
5. How fast does a decision need to happen? No hard date yet You are mapping risk before a concrete rollout window exists. This quarter There is a real roadmap, launch, or internal deadline attached to this setup. This month The workflow matters now and the team cannot leave the risk ambiguous for long. This week A decision needs to happen immediately because rollout pressure is already present.