MCP Dev Summit North America

AI Agents at Uber may need to navigate a massive ecosystem of 1000s of services, handle sensitive data, and execute critical business logic. To enable this, we are moving towards an agentic future which leverages a unified Model Context Protocol (MCP) infrastructure to access real-time services.

We will share the architectural lessons learned from deploying MCP at an enterprise scale. We will dive into three key technical pillars of our strategy:

1. Protobuf-Driven MCP Servers: How we leverage existing services and protocol buffers to automatically generate MCP servers, providing safe and instant access to 1000s of microservices.
2. Derived Tools and Description Overrides: Why static tool definitions aren't enough for complex workflows. We’ll demonstrate how we allow developers to override and refine MCP tool descriptions via "derived tools," ensuring agents have the specific context needed for particular workflows.
3. Evaluate quality: How we evaluate quality of MCP tools, leveraged in our no-code Agent Builder, which is a tool that democratizes agent building at Uber.

With the rapid expansion of available MCP servers, we need ways to manage our MCP workloads dynamically. Agents can help us configure agents! This talk explores a set of _primordial_ MCP tools that enable agents to discover, configure, and activate MCP servers at runtime. Rather than focusing on deferred tool loading or context reduction, we examine how agents can discover relevant servers from community registries or private catalogs, elicit configuration from users, and activate tools in the current session. We also examine the use of elicitation URLs as a key building block for constructing portable, reusable MCP configurations.

With EU AI Act enforcement beginning this year, teams deploying MCP need to understand what regulators will actually look for in production systems.

This talk is a practical guide for builders and IT teams deploying MCP at scale without dodging compliance. We’ll break down the concrete requirements emerging from regulation, including audit logs, traceability, access controls, and oversight mechanisms, and show how they map directly to MCP-based architectures.

We’ll cover how compliance applies across the systems MCP touches, from internal tools and data sources to the emerging MCP Apps ecosystem, where consumer-facing workflows introduce new expectations around transparency, consent, and accountability as AI increasingly mediates how brands and consumers interact.

Attendees will leave with a clear picture of what it takes to deploy MCP that works in production and holds up under regulatory scrutiny.

Implementing the Model Context Protocol (MCP) in Java poses a challenge: mapping a fast-evolving specification onto a language that favors strict type safety and stability. This session explores the evolution of the official MCP Java SDK, moving beyond naive implementation to address the "hectic" reality of a shifting protocol while providing an enterprise-grade AI enabler.

We’ll discuss the transition from early bidirectional transports to recent Streamable HTTP with sessions and stateless patterns. You’ll learn how Java’s type system led to a "correct-by-construction" approach, ensuring invalid states are unrepresentable, rather than just throwing runtime errors. We will cover Java-specific security considerations, including pluggable authorization hooks designed for a fragmented security ecosystem.

Finally, we’ll share lessons on balancing abstraction with pragmatism: how we decoupled JSON serialization for pluggability and managed the friction between Java’s synchronous heritage and MCP’s asynchronous nature. Whether you're building AI-enabled apps or designing cross-language SDKs, this talk provides a blueprint for robust MCP adoption.

Recent advancements in agentic AI have unlocked powerful new capabilities, however, they also introduce fundamentally new security risks. In this talk, I present a system-level view of the security landscape of agentic AI, drawing on a comprehensive systematization of attacks and defenses across modern agent architectures.

I show how increasing agent flexibility along different dimensions expands attack surfaces and enables threats such as prompt injection, memory poisoning, unsafe data flows, credential leakage, and unauthorized execution. Using real-world incidents and CVE analyses, I illustrate how agents can be manipulated through external content, compromised tools, or poisoned internal components.

The talk also provides a systematic overview of end-to-end automatic red teaming and risk assessment for agentic AI systems as well as a defense-in-depth framework for building secure agentic systems, spanning runtime guardrails, access control, information-flow tracking, privilege separation, and secure-by-design architectures, helping practitioners assess risk, close security gaps, and deploy agents safely at scale.

Less than 20% of remote MCP servers fully comply with the MCP Specification.
MCP adoption took off quickly, but full compliance didn't follow at the same pace. Today, partial implementations are common across both clients and servers, and the reasons go beyond just a fast-moving spec.
In this session, we'll walk you through:
-The first version of the MCP Specification and what it was designed for
-How MCP evolved to keep up with the quickly evolving AI ecosystem
-How clients and servers deviate from the spec and why developers choose not to comply
-What we can do to shrink the gap between design and implementation
This isn't a story about bad developers or tight deadlines. It's about how bending the rules has become part of how agents get built.