Make your agents check Measured Cloud before querying data

Goal

AI agents (Claude, Copilot, your own) increasingly query data directly. With the MCP server connected, an agent can ask Measured Cloud first: is this table safe and fit for AI use? Measured Cloud answers from what it already knows about the table (its data-quality health, how recently its checks ran, and the sensitive columns its profiles found), so the agent knows whether to go ahead, what to leave out, or when to stop.

Prereqs

• An MCP client connected to the Measured Cloud MCP server, with a dqk_… API key or a service-account key. Any role that can read the data asset can ask; the agent never needs to write anything.
• The tables your agents use, registered as data assets. The answer is most useful once each one has been profiled and has rules that run.

What the agent gets back

The tool is mc_asset_ai_readiness. The agent passes a table name (sales.orders, orders, or the data asset's own name) or a data asset's id, and gets:

Field	Meaning
verdict	ready: go ahead. caution: read the reasons first. not_ready: don't use it for AI. unknown: Measured Cloud has no profile or checks for it yet.
reasons	Why, in plain words, for example "It holds PII data (email, phone): mask or leave out those columns before an AI model sees them."
checks.quality	The share of the table's checks that passed in the last 30 days. Below 80 % is not_ready; below 95 % is caution.
checks.freshness	When its checks last ran. Not in the last 7 days is caution.
checks.sensitivity	The sensitive columns its latest profile found: categories you accepted (PII, PHI, PCI, Credentials, Financial) and the columns holding them, plus suggestions nobody has reviewed. Either makes it caution.
checks.certification	The table's AI-ready certification. Certified passes; not certified is caution, with the reasons; never evaluated reads not_evaluated.
checks.protection	Masking and access protections. Not evaluated yet: it reads not_evaluated.

The answer is metadata only: it never includes a value from the table. Each call is recorded in the organization's audit log (Settings → Audit log) as asset.ai_readiness_checked, with the key or service account that asked and the verdict, so your security team can see which agents check which tables.

Steps

1. Connect the agent to the MCP server with its own key. A service account per agent makes the audit log show each agent by name.

2. Add the rule to the agent's instructions. For example, in its system prompt:

   Before you query a table, or pass data from one to another tool or model,
   call mc_asset_ai_readiness with the table's name.
   
   - "ready": go ahead.
   - "caution": go ahead only within the reasons. Never select or pass on the
     columns listed under checks.sensitivity.columns; tell the user what you
     left out and why.
   - "not_ready": don't use the table. Tell the user the reasons and suggest
     they ask the table's owner.
   - "unknown": tell the user Measured Cloud has no information about the
     table, and ask before using it.
   
   Quote the reasons to the user in plain words. Don't call the tool again for
   the same table within one conversation.

3. Try it. Ask the agent for something from a table, for example "Summarise last month's orders by region". It should call mc_asset_ai_readiness first, then follow the verdict.

Verify

• The agent's tool calls show mc_asset_ai_readiness before any query.
• Settings → Audit log lists asset.ai_readiness_checked events for the tables the agent asked about, with the agent's key.
• On a table with accepted PII columns, the agent says it left those columns out.

Troubleshooting

Symptom	Fix
"No data asset matches"	The table isn't a data asset yet, or the agent's key can't see its workspace. Add it as a data asset, or pass the asset id from mc_asset_list.
"N data assets match"	The same table name exists in several schemas or workspaces. Pass schema.table, a workspace_id, or the asset id.
The verdict is always unknown	The table has never been profiled and has no checks. Profile it and add rules.
Sensitive columns show as unreviewed	Review them on the data asset's Table Health card: accept or dismiss each suggestion.