Vendor RFP checklist: the three infrastructure questions
A demo can look flawless while the production system has no plumbing. Use this checklist in the vendor meeting to tell whether you are being sold a system or a science experiment. Ask every question out loud and score the answer.
The three questions (ask these first)
Question 1 — Is it MCP-compatible?
Translation: can I keep my integrations when I change my mind about you?
- ☐ Vendor can name MCP-compatible connectors they have built or supported.
- ☐ Vendor confirms: if we switch AI vendors, the connectors we built stay usable.
- ☐ Vendor can explain (not just claim) how tool connections work under MCP.
Red flag: "We have integrations" with no mention of MCP — those are custom connections you will rebuild the day you switch.
Question 2 — Is it A2A-aware?
Translation: can your agents work with agents we did not buy from you, or are we locked in your garden?
- ☐ Vendor can explain what A2A (Agent2Agent protocol) is and whether their system speaks it.
- ☐ Vendor can describe a scenario where their agent coordinates with an external agent.
- ☐ If A2A is not yet needed for our use case, vendor acknowledges the standard and can commit to a roadmap.
Red flag: vendor presents MCP and A2A as the same thing, or cannot articulate the difference (MCP is vertical — agent to tools; A2A is horizontal — agent to agent).
Question 3 — Does it survive a crash mid-run?
Translation: what happens if the server dies while the agent is halfway through a five-step process?
- ☐ Vendor names the durable-execution layer they use (e.g., Temporal, Inngest, Restate, DBOS or equivalent).
- ☐ Vendor gives a clear, slightly bored answer: "It picks up from the last completed step; nothing duplicates."
- ☐ Vendor can describe what a crash looks like in their logs — not a manual cleanup.
Red flag: "we have retries," a blank look, or a description of someone noticing and fixing it by hand. For anything touching money or commitments, that is a liability, not a system.
The additional five questions (from Appendix A.3)
- ☐ Can you show production-realistic numbers — cost at our volume, latency under load, accuracy on our messy data — not demo numbers?
- ☐ What does this cost per month at our actual volume, all-in (seats + inference + human review)?
- ☐ What happens when it gets something wrong, and who sees the error? Is there an error log and an exception path?
- ☐ Where does our data live, and who can see it?
- ☐ What is our exit? Data export, model portability, contract-out terms?
Disqualifiers — any one of these ends the evaluation
- ☐ Cannot or will not show production-realistic numbers
- ☐ No answer on where our data lives or who can see it
- ☐ No audit trail on what the AI did and why
- ☐ Lock-in with no data export path
Scorecard
| Criterion | Weight | Score (1–3) | Notes |
|---|---|---|---|
| MCP-compatible (portable connections) | High | ||
| A2A-aware (open agent interop) | Med | ||
| Durable execution (survives a crash) | High | ||
| Production numbers shown (not demo) | High | ||
| All-in cost at our volume | High | ||
| Data residency / where it runs | High | ||
| Governance + audit logging | Med | ||
| Error visibility + HITL gates | High | ||
| Exit / portability | Med | ||
| Total |
Score 1 = unacceptable / no answer | 2 = partial / needs follow-up | 3 = clear and confident answer
A vendor who answers all three infrastructure questions crisply is selling you a system. A vendor who cannot is selling you a demo, and the gap between those two is a year of your life and a budget overrun.
Want a second set of eyes on this in your firm? The no-sell promise applies — if it isn't a fit, I'll tell you in the first ten minutes.
Book a 30-Minute Call →