What can an MCP server fill in the NIS2 walkthrough, and what not?

Which items does the assistant fill in?

All but two. In 12.3 there is nothing to fill in: you read the item and finish it yourself. At 7.3 it fills in nothing, because a management review recorded there puts the item before management.

In the other 19 items it answers questions, fills lists, rates risks and writes policy drafts. The sections below show what exactly, item by item.

It has no tool for these steps: finishing an item, putting it on the waiting list, recording that the company decided not to do it, inviting someone. Only an assistant that can send a file itself, such as Claude Code, uploads a file as evidence.

Which rules hold for every item?

An assistant writes only into items that are open or on the waiting list. If it works on an item on the waiting list, it picks it up again, as the app does.

An item that is finished, decided against or signed is changed by a person in the app. If a signed item rests on a list, the server refuses any change to that list and names the items affected.

The server refuses an empty answer, so that no assistant erases what someone wrote. A field it leaves out stays as it is. It never deletes a supplier, an asset or a training.

If a person holds the Reviewer or Legal reviewer access role, their assistant only reads. Everyone else fills in items in the categories assigned to them, an admin in all of them.

Which questions and lists does it answer?

Fields are the single questions of an item. In 12.2 an assistant answers the account reference and the date of registration, in 3.3 whether you can sign in to the portal and report.

In 3.1 it records who leads in an emergency, the emergency number, how you reach each other when email and the network are down, and whom the person leading calls next. Then there are 11.2 (tools for phone, video and chat), 6.3 (address for vulnerability reports) and 12.4 (attack detection system, last evidence sent to the BSI).

It fills lists in 1.1 and 8.2, who was trained when, and in 5.1, your suppliers. It adds rows and corrects existing ones.

For a supplier linked through its own account, it cannot change the statements the supplier made itself.

What does it fill in for assets and risks?

In 2.2 it ticks on four lists what your company has, adds entries of its own and records who provides what. Our article on building an asset inventory with AI shows how in detail.

In 2.1 it can adopt the risk assessment method the walkthrough proposes. In 2.3 it rates software, technology and suppliers: how often something could happen and how badly it would hit, with a short note if wanted.

The risk map only shows the result.

What does it record for contracts, sign-ins and backups?

In 5.2 it records for each supplier whether the contract settles security and whether it provides for incident notification. In 11.1 it records for each sign-in whether it takes a second factor, and which one.

In 4.4 it notes for each backup system how often it backs up and on which day a restore last worked. In 4.2 it marks which processes must keep running without IT, with a line on how.

Each row is saved as it sends it. That is why the server tells it to read what is there first.

How does it write policies and the crypto list?

Six items write a document: 3.1, 2.4, 9.1, 10.1, 6.3 and 4.2. An assistant picks which sections of the template apply to your company and writes what else holds there.

What is saved is a draft, which management approves at 7.3. No assistant rewrites a document management has already approved, because a changed text loses the approval. That happens in the app.

In 9.1 it takes over the proposed list of accepted methods and can adapt it. When it changes the list, it sends the whole list: a method it leaves out is no longer on it. So read the list in the app before you finish 9.1.