MCP Dev Summit North America

ChatGPT apps aren't websites or mobile apps. They're a new primitive - lightweight tools invoked within a conversation, surfacing minimal UI to move the user forward.

Websites are destinations. Mobile apps are rich installed experiences with device access. ChatGPT apps are in-flow utilities - joining tasks already in progress. You don't own the screen or control the journey. The model decides when to invoke you.

Wrong mental model = wrong architecture.

Drawing on first-hand experience shipping ChatGPT apps for enterprise clients, we'll cover the principles separating apps that work from those that don't:

- Scoping around single, sharp intent vs building a platform inside a chat
- Where conversational interfaces add genuine value - and where you're fighting the medium
- Leveraging context and memory instead of requiring users to re-establish state
- Using ChatGPT as infrastructure vs distribution
- Testing and iterating when the model controls invocation

We'll walk through concrete implementation examples and lessons learned.

MCP is a strong foundation for building AI agents, enabling fast iteration, clear boundaries, and safer early deployments. But as agents move from prototypes to products customers rely on, product teams begin to hit limits around reliability, user experience, observability, and long-running workflows.

In this talk, I’ll share a product leader’s perspective on how MCP-based agent systems evolve in production. We’ll explore the product signals that indicate when MCP-only approaches start to constrain outcomes, and how teams can extend MCP-driven systems to meet higher expectations around trust, clarity, and control. Attendees will leave with a practical framework for scaling MCP-based agents from experimentation to dependable products.

You approve one sudo command (Ubuntu's default timeout is 15 minutes), so now your agent can `rm -rf /` your entire machine without asking again. You could run in a sandbox, but even there, `gh` can add a public SSH key to your account, or leak a token into the context window.

These aren't hypotheticals. Agents have deleted production databases and wiped drives using interfaces designed for humans, not autonomous AI. CLIs optimize for human ergonomics; APIs optimize for programmatic flexibility. Neither provides what agents need: structural safety boundaries, workflow context, graceful error recovery and auditable actions.

MCP can solve virtually all of these. This talk explores what breaks when agents use CLIs and APIs, and how MCP addresses these failures through protocol-level security, structured tool definitions, workflow guidance, consent flows, and registries.

We'll see why MCP offers the only sane path forward for safe agentic AI, and how it enables enterprise governance that unlocks mass corporate adoption. We'll also discuss gaps that still need addressing. You'll leave knowing exactly why "just use CLIs" is dangerous advice—and what to do instead.