AI Learning Hub › Learn AI › Self-Paced Courses › MCP Without the Mystery › Evaluate Before You Connect

Capstone

Evaluate Before You Connect

Review a connection you have never seen: what it can reach, what it can cause, what the server claims, what control you hold, and what evidence you will check.

You have enough information to ask better questions

The first ten modules showed you how MCP capabilities work. This exercise gives you a connection you have not used before.

Some facts are available. Some important facts are missing. Your job is not to guess.

Your job is to identify what you know, what you do not know, what the connection could reach, what authority it might receive, what controls you would look for, and what evidence you would want afterward.

There is no Connect button in this exercise. The work is deciding what you would need to know before clicking one.

The scenario

Northstar Research Systems and Research Workspace are fictional and exist only for this exercise. There is no such company and no such product. Any resemblance to a real vendor is unintended.

You are working in an organization-managed AI environment.

A colleague sends you a link to a new connector called Research Workspace. They say it could save time, because the AI would be able to search project materials, add research notes, and send updates to collaborators.

The connector setup page identifies the provider as Northstar Research Systems. It describes itself as an MCP connection to a remote web service.

You have not used it before. You have not connected it yet.

What the connection says it provides

Tool — search_workspace: Searches materials in workspaces you can access and returns matching titles and excerpts. Declared READ-ONLY. Input: query.
Tool — add_research_note: Adds a note to the selected workspace. Inputs: workspace, note.
Tool — send_workspace_update: Sends an update to collaborators associated with the selected workspace. Inputs: workspace, message.
Resource — workspace://current/overview: Provides summary information about the current workspace.
Prompt — prepare_research_update: Creates a reusable prompt for preparing a research progress update.

What you know

It is a remote web connection, not a local process.
Authentication is required.
The setup screen says it can access workspaces available to the signed-in account.
search_workspace is described by the server as READ-ONLY.
add_research_note changes a workspace.
send_workspace_update can communicate with other people.
The host says consequential tool calls may require approval, depending on workspace configuration.
The connection is offered through the organization’s managed AI environment.

Read that seventh point carefully. “May require approval” is not the same as “will require approval.” You do not yet know whether every consequential call will pause.

What the setup page does not tell you

Which specific workspaces become visible after authentication?
Does Northstar retain tool inputs or returned workspace content?
Does Northstar send any connection data to additional services?
Does send_workspace_update send immediately, or create a draft first?
What approval options will the host show for write and send actions?
Are approvals one-time, persistent, or both?
What record or log exists after a note is added or an update is sent?
Is this connector documented as appropriate for the information you intend to use with it?

These are not answered anywhere in the scenario. That is deliberate.

Your review

Do not scroll to the worked review yet. Use the Connection Review framework from Module 10 and answer these six questions for yourself.

1. What might this connection be able to see?

Separate your answer into two explicitly labeled lists: Known and Unknown.

We know it can reach workspaces available to the signed-in account. What do we still need to discover about which workspaces, and which information within them?

2. What can it change or cause?

Identify a read capability, a write capability, and a communication capability. Do not assume one of them is automatically safe and another automatically dangerous — describe what each does.

3. Which statements come from the server itself?

search_workspace is marked READ-ONLY. What does that tell you — and what does it not prove?

4. What would you inspect before allowing a consequential action?

Consider the exact tool, the exact input, the destination, whether the action happens immediately, the approval choices offered, and whether the authority granted is one-time or persistent.

5. How would you verify what happened?

Answer these separately. If a note were added, what would you inspect? If an update were sent, what would you inspect?

6. What would you ask before connecting real information?

Identify the unanswered questions that matter for your intended use. You do not need to list every unknown in the scenario.

Stop here until you have your own answers

The point of the capstone is not to match our wording. It is to notice the right kinds of questions before the connection has authority over real information or actions.

Compare your review

Reach

Known: the connection says it can access workspaces available to the authenticated account.

Unknown: we do not yet know which workspaces that includes, how broad access within them is, or whether the connection transmits retrieved content elsewhere.

Before connecting sensitive or organizational information, those are material questions.

Authority

search_workspace: Returns information.
add_research_note: Changes stored workspace information.
send_workspace_update: Can cause information to be communicated to other people.

The same connector contains capabilities with different consequences. Reviewing the connector name alone is not enough. “Research Workspace” sounds like a place to look things up; one of its three tools can message your colleagues.

What the server claims about itself

The server describes search_workspace as READ-ONLY. That is useful descriptive information. It is not independent proof that the server implementation has no side effect.

A useful review combines the server’s description, the provider and context, the host’s controls, the available documentation, and observed behavior where that is appropriate to check. You are not expected to inspect the source code of a remote production connector.

Controls

Before approving add_research_note or send_workspace_update, a useful approval interface would make it possible to understand the proposed tool, the supplied input, the target workspace, the consequence, and whether the authority granted is one-time or persistent.

The scenario does not tell us whether the actual interface provides all of those things. That is something to inspect, not assume.

Evidence

For add_research_note, verify the note in the intended workspace. For send_workspace_update, verify the destination and the sent or posted state in the service itself.

The AI’s summary of what it says it did is not the same thing as checking the destination. This is the habit from Module 9, applied to a system you do not control.

Still unanswered

Scope of workspace access
Provider retention
Onward data sharing
Immediate-send versus draft behavior
Approval behavior
Persistence of approvals
Audit or log evidence
Institutional appropriateness for the information you intend to use

Those unknowns do not automatically mean “do not use the connection.” They mean the review is not finished.

The information available is sufficient to understand some of the connector’s reach and authority, but not enough to answer every question that could matter for real organizational information.

The next step depends on the intended task and on resolving the questions that matter for that task.

Before you click Connect

Five questions, any connection

What can it reach?
What can it change or cause?
What does the server claim about itself?
What control will I have before consequential actions?
What evidence will I check afterward?

If an important answer is “I don’t know,” decide whether you need to resolve it before continuing.

One more question at Stanford

Is this connection appropriate for the Stanford-managed environment and the information I intend to use?

Check the current guidance rather than assuming: Responsible AI at Stanford (opens in a new tab), Approved Connectors for AI Services (opens in a new tab), and the service page for the environment you are working in.

As in Module 7: a documented list tells you what has been documented. Absence from it does not by itself prove either prohibition or approval — when it matters, ask.

You now understand more than the Connect button shows

A Connect button tells you that software can attempt a connection. It does not tell you what the server exposes, which data it may reach, what actions it can take, how the host will present those actions, which approvals will persist, what institutional boundaries apply, or how you will verify the result.

Those are the questions MCP literacy helps you ask.

The goal was never to make MCP mysterious

You do not need to build a protocol implementation to understand an MCP connection.

You can inspect what is exposed, what input is expected, what may change, how the host mediates the action, and what evidence remains afterward.

Understand the connection before you give it authority.