Loading…
April 2-3, 2026
New York, NY
View More Details & Registration

The Sched app allows you to build your schedule but is not a substitute for your event registration. You must be registered for MCP Dev Summit North America to participate in the sessions. If you have not registered but would like to join us, please go to the event registration page to purchase a registration..

IMPORTANT NOTE: Timing of sessions and room locations are subject to change.


Audience: Yes clear filter
Wednesday, April 1
 

9:00am EDT

Workshop: Architecting Agentic Engineering Loops With MCP - Tadas Antanavicius, Pulse MCP [Pre-Registration Required, Additional Fee]
Wednesday April 1, 2026 9:00am - 12:00pm EDT
The job of a software engineer is rapidly evolving. We're now beyond using AI as a Stack Overflow alternative or even as a pair programmer. Agentic engineering - the act of building and maintaining a system to reliably give coding agents the tools and context they need to complete work autonomously - is the new layer of abstraction the industry is moving toward.

Core to building these autonomous coding agents is the notion of a "closed agentic loop". To create a closed loop for your coding agent, you need to provide it (1) tools to verify work is complete, (2) tools to debug work along the way, and (3) a carefully crafted prompt that communicates a "definition of done" that pulls it all together. That empowers your agent to iterate on solutions - sometimes for hours - until it delivers to completion.

As you might imagine, MCP is often the ideal delivery mechanism for those loop-closing tools.

In this workshop, we will:
Introduce the concept of agentic engineering and the "aha" moments that can take you from pair programming with a single agent to regularly wielding 5-10 coding agents at once. 

Close a simple loop: Figma design to working, pixel-perfect UI element verified by Playwright.
Close a more complex loop: take an alert from an observability platform, reproduce the problem in a staging environment with Playwright, capture the logs, open a PR with a fix, deploy to staging, verify the fix, and close the alert - all in one prompt.

Encourage you to try building a loop on your own codebase for a real piece of work on your plate - and raise to the group what kind of hurdles you might run into while trying to do so

You'll leave with actionable next steps to make your team's codebase agentic-engineering-ready and a clear picture of what success looks like.

Pre-registration and additional fee is required. To register: add it to your MCP Dev Summit North America registration
Speakers
avatar for Tadas Antanavicius

Tadas Antanavicius

Co-Founder, PulseMCP
Tadas is one of the founders of PulseMCP, an in-depth weekly newsletter covering the MCP ecosystem that has been running since early December 2024. He is a member of the MCP steering group, where he is a maintainer of the MCP Registry as well as the MCP contributor community across... Read More →
Wednesday April 1, 2026 9:00am - 12:00pm EDT
Marquis Ballroom Salon A + B (9th Floor)
  Workshop
  • Session Slides Yes
 
Thursday, April 2
 

11:50am EDT

Building MARVIN: What Teaching a Non-Technical Marketer To Use MCP Taught Me About AI Adoption - Sterling Chin, Postman
Thursday April 2, 2026 11:50am - 12:15pm EDT
Over the 2025 holiday break, I built MARVIN, an AI assistant that connects to my email, calendar, Jira, Confluence, and meeting notes through MCP servers. The most surprising lessons came from teaching a non-technical friend in marketing to use it. Within a day, she took a task that typically required 4+ hours and completed it in 30 minutes.

In this talk, I'll share practical insights from building and deploying MCP-powered agents in real workflows:

- Architecture decisions: How I structured MCP servers for Gmail, Google Calendar, Jira, and other integrations, and where I got it wrong
- The "junior intern" pattern: Why treating AI agents like trainable assistants drives real usage
- The naming problem: Why "MCP" is a terrible name for mainstream adoption and what we should call it instead
- Curiosity over mandates: Why top-down AI adoption fails, and what ground-up adoption looks like

I'll walk through 25 minutes of hard-won lessons from building something real, watching people use it, and iterating based on what actually worked.
Speakers
avatar for Sterling Chin

Sterling Chin

Founding Developer Advocate, Inngest
Sterling Chin is a Founding Developer Advocate, where he focuses on AI-powered API development and the intersection of agents and APIs. At Postman, he lead the team that shipped 7 new products in 2.5 years including Postman's first AI Assistant, and now spends his time helping developers... Read More →
Thursday April 2, 2026 11:50am - 12:15pm EDT
Juilliard Complex (5th Floor)
  Apps and Agents, MCP Best Practices

11:50am EDT

Sponsored Session: The Self-Improving MCP Server: Agents in a Live Development Loop - Enrico Toniato, Manufact
Thursday April 2, 2026 11:50am - 12:15pm EDT
What if your AI agent could build and refine its own MCP server while you watch? We'll demonstrate a live development loop where coding agents iterate on MCP servers and UI widgets in real time . no restarts, no broken workflows. Using hot module reloading for both the protocol primitives and the UI, agents can preview and refine their output in real time.



In order to facilitate networking and business relationships at the event, you may choose to visit a third party's booth or access sponsored content. You are never required to visit third party booths or to access sponsored content. When visiting a booth or participating in sponsored activities, the third party will receive some of your registration data. This data includes your first name, last name, title, company, address, email, standard demographics questions (i.e. job function, industry), consenting to receipt and use of such data by the third-party recipients, which will be subject to their own privacy policies. 
Speakers
avatar for Enrico Toniato

Enrico Toniato

CTO, Manufact (formerly mcp-use)
CTO at Manufact (formerly mcp-use)Prev AI tech lead at IBM ResearchAchieved SoTA in Text2SQLPresented at NeurIPSRobotics @ ETH Zurich
Thursday April 2, 2026 11:50am - 12:15pm EDT
Marquis Ballroom (9th Floor)
  Apps and Agents
  • Session Slides Yes

11:50am EDT

What if MCP was Symmetric? - Jerome Swannack, Anthropic
Thursday April 2, 2026 11:50am - 12:15pm EDT
* What if MCP was Symmetric? An exploration on what would be possible if servers could call tools from clients. 
Speakers
avatar for Jerome Swannack

Jerome Swannack

Member of Technical Staff, Anthropic
New Zealander living in London, helped build MCP at Anthropic

Thursday April 2, 2026 11:50am - 12:15pm EDT
Broadway Ballroom North (6th Floor)
  Protocol in Depth

11:50am EDT

Securing MCP at Scale: From Principles To Production - Peter Smulovics, Morgan Stanley
Thursday April 2, 2026 11:50am - 12:15pm EDT
As MCP adoption accelerates across platforms, the risks of giving LLMs tool access are growing quickly. This session explores the real threat surface of MCP systems: prompt injection, tool poisoning, unsafe permissions, supply-chain “rug pulls,” cross-tool escalation, and data-exfiltration risks that arise when agents can call arbitrary tools. Building on Microsoft's recent work hardening MCP on Windows, we outline a practical reference architecture for secure deployments: signed and verified tool manifests, unique server identities, scoped capabilities, sandboxed execution, authenticated connections, governance via registries, audit logging, and runtime anomaly detection. Attendees will leave with a blueprint for running MCP in production: what to lock down, how to operate it safely, and how enterprises can integrate MCP into existing security, IAM, and compliance frameworks. This talk equips developers, architects, and security teams to build safer agentic systems and contribute to a more secure MCP ecosystem.
Speakers
avatar for Peter Smulovics

Peter Smulovics

Distinguished Engineer, Morgan Stanley
Peter Smulovics is a Distinguished Engineer at Morgan Stanley with 15+ years at the firm and 30+ in the industry. A 2× Microsoft MVP and co-creator of C#, he serves as Vice Chair of FINOS (Linux Foundation) Technical Oversight Committee and leads Open Source Readiness. He focuses... Read More →
Thursday April 2, 2026 11:50am - 12:15pm EDT
Empire Complex (7th Floor)
  Security and Operations

12:20pm EDT

MCP for Autonomous Storefronts: Building Self-Healing Agent Loops - Guilherme Rodrigues, decocms.com
Thursday April 2, 2026 12:20pm - 12:45pm EDT
Most MCP integrations power chat: an agent responds to a prompt. But MCP can power continuous loops — agents that run on schedule, find issues, and ship fixes without human prompting.

This talk covers how to build MCP servers for autonomous operations. The core pattern: Detect → Analyze → Propose → Execute → Report. Each loop queries MCP resources, processes data, and takes action based on its trust level.

I'll show three examples from e-commerce: (1) a learnings database — optimization patterns exposed as MCP resources that agents query to diagnose codebases; (2) CDN observability — requests, bandwidth, cache rates as queryable resources for finding performance issues; (3) conversion analytics — pageview and conversion data that agents correlate to propose content changes.

The key design question: when can agents act autonomously vs. require human approval? I'll present a trust framework where loops graduate from report-only → PR with review → auto-merge based on accuracy over time.

Takeaways: how to structure domain expertise as MCP resources, architecture for connecting observability to agents, and patterns for safe autonomous execution.
Speakers
avatar for Guilherme Rodrigues

Guilherme Rodrigues

CEO & Co-Founder, decocms.com
Co-founder & CEO of decocms.com, an open-source framework for building and deploying MCP-based Internal AI Platforms. Previously spent 9 years at VTEX through its NYSE IPO, where he led the first version of the Store Framework and VTEX IO Developer Platform. Based in Rio de Janeiro... Read More →
Thursday April 2, 2026 12:20pm - 12:45pm EDT
Juilliard Complex (5th Floor)
  Apps and Agents

12:20pm EDT

Evolution, Not Revolution: How MCP Is Reshaping OAuth - Aaron Parecki, Okta
Thursday April 2, 2026 12:20pm - 12:45pm EDT
The impulse to rewrite the auth stack for AI agents is strong, but we cannot design away the fundamental relationships standards protect. This session explores how MCP is reshaping OAuth—not abandoning it—to meet the ecosystem's unique challenges:

The "Unregistered Client" Problem: Traditional OAuth requires pre-registration. MCP breaks this. We’ll see how Client ID Metadata Documents (CIMD) allow agents to bring their own identities to arbitrary servers, how it improves on Dynamic Client Registration, and how to mitigate the risks of unregistered clients.

Separation of Concerns: Why your MCP server shouldn't be your Authorization Server. We’ll cover how Protected Resource Metadata (RFC 9728) enables dynamic auth server discovery, keeping agents lightweight and security boundaries clean.

Enterprise-Managed Authorization: To stop "click-through fatigue," we’ll introduce the Identity Assertion Authorization Grant. This moves consent to the enterprise policy layer, enabling secure, scalable adoption.

Join me to secure the agent ecosystem—from discovery to governance—not by reinventing the wheel, but by making incremental improvements to the way it turns.
Speakers
avatar for Aaron Parecki

Aaron Parecki

Director of Identity Standards, Okta
Aaron Parecki is Director of Identity Standards at Okta, and active in multiple standards development organizations including IETF, OpenID Foundation, W3C, and MCP. He is an editor of OAuth 2.1 along with several other OAuth specifications, and has been influential in shaping how... Read More →
Thursday April 2, 2026 12:20pm - 12:45pm EDT
Broadway Ballroom North (6th Floor)
  Protocol in Depth

12:50pm EDT

Building Multi-Turn Agentic Workflows With MCP: Lessons From Avatar Generation at Roblox - Rohan Gangaraju & Jason Ding, Roblox
Thursday April 2, 2026 12:50pm - 1:15pm EDT
Creative assembly tasks - where agents compose pieces into coherent wholes - present unique challenges: tracking progress across turns, validating outputs, and recovering when something doesn't fit. This talk shares patterns for multi-turn workflows, illustrated through avatar generation where an agent assembles clothing into cohesive outfits.
Pattern 1: Session Memory - Track selections, failed searches, and partial progress across turns. Know what's in the cart before suggesting more.
Pattern 2: Composite Tools - Combine operations (search + fetch thumbnails) into single tools that reduce round-trips and give agents richer context.
Pattern 3: Pre-flight Validation - Check compatibility before expensive operations. Catch conflicts early (clashing items, missing pieces) rather than failing at generation.
Pattern 4: Validate-and-Retry Loops - Use VLM scoring on outputs, track best-of-N attempts, and guide agents toward improvements when quality falls short.
Avatar generation makes these patterns concrete - "getting dressed" is intuitive - but they apply broadly to document assembly, configuration builders, and any workflow composing parts into wholes.
Speakers
avatar for Rohan Gangaraju

Rohan Gangaraju

Senior Machine Learning Engineer, Roblox
Rohan Gangaraju is a Senior Machine Learning Engineer on the Economy ML team at Roblox, where he works on building recommendation systems for virtual economy and avatar marketplace. He holds a CS degree from UMass Amherst.
avatar for Jason Ding

Jason Ding

Software Engineer, Roblox
Jason Ding is a Software Engineer at Roblox, where he drives Avatar Generation efforts focused on ML powered avatar creation. He holds degrees in Electrical Engineering and Computer Science (EECS) and Business from UC Berkeley through the M.E.T. program.
Thursday April 2, 2026 12:50pm - 1:15pm EDT
Juilliard Complex (5th Floor)
  Apps and Agents

12:50pm EDT

Golem To Murderbot: Challenges With Agentic Security Delegation Via MCP - Michael Schwartz, Gluu
Thursday April 2, 2026 12:50pm - 1:15pm EDT
To implement "Zero Trust", authorization must be enforced consistently across every layer: inside the agent, in the cloud (like MCP gateways and services), and down to the database. Each layer needs its own dynamic authorization decision engine, yet those decisions must remain aligned and explainable.

As AI agents become first-class actors in enterprise systems, traditional security models start to strain. This session examines how agentic workflows challenge today’s delegation mechanisms, especially when agents act autonomously, chain operations, or cross trust boundaries. We’ll explore where OAuth works well and where it falls short.

The session argues for centralized policy management using Cedar, decoupled from application code to prevent policy drift. It will introduce emerging governance models like GovOps, which treat policies, schemas, and authorization logic as managed assets with lifecycle controls and automated compliance. Attendees will leave with a practical ideas for secure agent delegation and governing agentic systems at scale.

The discussion frame is two narratives: a 15th century myth and a 2025 Apple TV mini-series based Martha Wells' books.
Speakers
avatar for Michael Schwartz

Michael Schwartz

Founder / CEO, Gluu
Mike is the founder of cybersecurity software vendor Gluu, BD of the Linux Foundation Janssen Project, and twice a week hosts the livestream Identerati Office Hours. He is also author of "Securing the Perimeter" (Apress 2018) about open source digital identity. His podcast "Open Source... Read More →
Thursday April 2, 2026 12:50pm - 1:15pm EDT
Empire Complex (7th Floor)
  Security and Operations

12:50pm EDT

Sponsored Session: Who's Driving? Delegation and the Confused Deputy Problem for AI Agents - Vitor Balocco & Alvaro Inckot, Runlayer
Thursday April 2, 2026 12:50pm - 1:15pm EDT
When an AI agent holds your OAuth token, what stops it from acting beyond your intent? We'll cover why OAuth 2.1 alone isn't enough for agentic AI, how the industry is responding (NIST, IETF, major identity vendors), and how to implement delegation that gives agents scoped, auditable, revocable permission to act on behalf of users.
Speakers
avatar for Alvaro Inckot

Alvaro Inckot

Founding Identity Engineer, Runlayer
Founding Identity Engineer at Runlayer, where the job is making sure AI agents don't do things they shouldn't, even when they've been told they can. Background in distributed, auth, and identity systems at Intel.
avatar for Vitor Balocco

Vitor Balocco

Co-founder, Runlayer
Vitor Balocco is co-founder of Runlayer. Previously, Vitor was a Staff AI Engineer at Zapier and is a recognized MCP expert, speaking at international conferences on vulnerabilities and defense.


Thursday April 2, 2026 12:50pm - 1:15pm EDT
Marquis Ballroom (9th Floor)

2:35pm EDT

Protocol Evolution: Adapting the Model Context Protocol for SLMs and the Edge - Kierra Dotson, Further
Thursday April 2, 2026 2:35pm - 3:00pm EDT
The Model Context Protocol (MCP) was designed for robust, cloud-based LLM interactions. However, the proliferation of Small Language Models (SLMs) and their deployment on resource-constrained edge devices (e.g., IoT, mobile) introduces critical challenges to the protocol's current specification. This talk provides a deep-dive into the necessary technical adaptations for MCP to thrive at the edge. We will explore:
Context Window Optimization: Protocol-level strategies for efficient context serialization and deserialization to minimize latency and memory footprint on SLMs.
Asynchronous Context Management: How to handle intermittent connectivity and power-saving modes on edge devices through novel MCP transport and state management mechanisms.
Edge-Native Context Caching: A proposal for a lightweight, on-device context caching layer that adheres to the MCP specification while ensuring data freshness and integrity. Attendees will leave with a clear understanding of the current limitations and a roadmap for contributing to the MCP specification's evolution for the next generation of ubiquitous, context-aware edge AI.
Speakers
avatar for Kierra Dotson

Kierra Dotson

Director of AI Strategy, Further
Kierra Dotson is an AI Engineer specializing in the critical intersection of AI strategy, operations (AgentOps), and governance. With a strong background in Cloud Engineering, DevOps, and Data Architecture, she focuses on building scalable, reliable, and compliant AI systems. Kierra... Read More →
Thursday April 2, 2026 2:35pm - 3:00pm EDT
Astor Ballroom (7th Floor)
  MCP Best Practices
  • Audience Experience Level Advanced
  • Session Slides Yes

2:35pm EDT

From Scopes To Intent: Reimagining Authorization for Autonomous Agents - Andres Aguiar & Abhishek Hingnikar, Okta
Thursday April 2, 2026 2:35pm - 3:00pm EDT
The Model Context Protocol (MCP) has standardized how we connect models to data, but the security layer remains a work in progress. Currently, MCP implements authorization via standard OAuth scopes.

While this works for handling coarse-grained tool access, it presents challenges for finer grained permissions.

To solve this, we must move toward intent-based authorization—a model where agents are authorized to perform actions based on the specific context of a task, rather than a pre-approved list of capabilities.

This presentation will dissect the consequences of the current OAuth model on agent design and present ideas of how to address them. We will discuss how to implement dynamic authorization that allows agents to be helpful without being intrusive, ensuring that security scales alongside intelligence.
Speakers
AH

Abhishek Hingnikar

Product Architect, Okta
avatar for Andres Aguiar

Andres Aguiar

Director of Product @ Okta, Okta
Solving Authorization with openfga.dev | fga.dev
Thursday April 2, 2026 2:35pm - 3:00pm EDT
Empire Complex (7th Floor)
  Security and Operations

3:05pm EDT

Patterns for Building MCP-powered Agent Systems - Jiquan Ngiam, MintMCP
Thursday April 2, 2026 3:05pm - 3:30pm EDT
MCPs unlock agent data access, but that's only the first step towards building agents that can work autonomously. How do we build a complete system where multiple agents work together, maintain state across sessions, and the whole thing runs reliably every day.

I use agents that work with 10+ connections daily for both personal and work use cases: health MCPs/APIs (Strava, Apple Health), productivity tools (Calendar, Linear), business systems (Attio CRM, email), and developer tools (GitHub). This talk shares effective architectural patterns that emerged from actually using this system.

We'll cover MCP composition (Virtual MCPs) and how to orchestrate multiple agents with memory. We show how state management using Git as agent memory is effective, as it provides versioning and rollback. We treat CLAUDE.md files as behavioral memory in the same system. Finally, we cover security concerns and best practices to manage agents that have access to sensitive and/or untrusted data.
Speakers
avatar for Jiquan Ngiam

Jiquan Ngiam

Co-founder, CEO, MintMCP
Jiquan Ngiam was a senior staff researcher at Google Brain and founding team member at Coursera, where he helped build Andrew Ng's online machine learning course from the ground up. He co-authored pioneering work in multimodal deep learning at Stanford. Currently co-founder and... Read More →
Thursday April 2, 2026 3:05pm - 3:30pm EDT
Juilliard Complex (5th Floor)
  Apps and Agents

3:05pm EDT

Sponsored Session: Future-Proofing AI Agents: The Strategic Role of MCP - Don Murray, Safe Software
Thursday April 2, 2026 3:05pm - 3:30pm EDT
Enterprises are embracing generative and agentic AI as models evolve faster than ever, creating uncertainty. The Model Context Protocol (MCP) resolves this by standardizing connections between AI and underlying services. We demonstrate how the ability to both consume and build MCP services provides the flexibility to bring all your data to any AI easily.



In order to facilitate networking and business relationships at the event, you may choose to visit a third party's booth or access sponsored content. You are never required to visit third party booths or to access sponsored content. When visiting a booth or participating in sponsored activities, the third party will receive some of your registration data. This data includes your first name, last name, title, company, address, email, standard demographics questions (i.e. job function, industry), consenting to receipt and use of such data by the third-party recipients, which will be subject to their own privacy policies. 
Speakers
avatar for Don Murray

Don Murray

CEO, Co-Founder, Safe Software
Don Murray is a Canadian entrepreneur, co-founder and CEO of Safe Software, a company at the forefront of data integration. His entrepreneurial journey began in 1993 when Safe Software was launched, driven by a vision to enhance data integration technology
Thursday April 2, 2026 3:05pm - 3:30pm EDT
Marquis Ballroom (9th Floor)
  MCP Best Practices
  • Session Slides Yes

3:05pm EDT

Your #1 Docs Audience Isn't Human: Dev Ed's MCP Strategy at Apollo - Daniel Abdelsamed, Apollo GraphQL
Thursday April 2, 2026 3:05pm - 3:30pm EDT
AI agents are rapidly becoming the primary consumers of technical documentation. At Apollo GraphQL, our traffic data shows agents on pace to become our #1 traffic source, prompting a shift in how we write, structure, and serve docs. We now have two distinct audiences that read differently: AI needs patterns, not paragraphs. Connecting sentences that help humans are now wasted tokens.

As the sole documentation engineer at Apollo, I’ve spent the past year building MCP tooling for our docs. This talk covers what worked, what failed, how we tested, and what surprised us.

I’ll walk through the evolution from serving AI full pages to chunked retrieval strategies that balance completeness with token usage. You’ll see how we used AI tooling to restructure docs for AI readability and exposed them as MCP tools agents are compelled to use.

To measure progress, we built an evaluation suite: a sandboxed runner that executes end-user prompts against our MCP server, builds an application, seals the output, then passes it to a second model for scoring against a reference solution and rubric. I’ll demo this live and share how it produced stable metrics in a non-deterministic AI world.
Speakers
avatar for Daniel Abdelsamed

Daniel Abdelsamed

Staff Software Engineer, Apollo GraphQL
Daniel Abdelsamed is a Staff Software Engineer at Apollo, where he has spent the last four years architecting and scaling the company’s documentation platforms. With nearly a decade of experience in TypeScript and application design, he focuses on building durable, developer-friendly... Read More →
Thursday April 2, 2026 3:05pm - 3:30pm EDT
Astor Ballroom (7th Floor)
  MCP Best Practices

3:35pm EDT

Declarative MCP Servers for Secure, Specialized AI Agents - Josh Reini & Reetika Roy, Snowflake
Thursday April 2, 2026 3:35pm - 4:00pm EDT
Tool sprawl is a common failure mode for enterprise agents: the more tools an agent can reach, the less predictable it becomes—driving hallucinations, higher token costs, and larger security blast radius. Scaling agents safely requires specialization enforced by capability boundaries, not just better prompts.

This talk explores MCP best practices through a managed implementation where MCP servers are declared as explicit collections of tools and treated as governed objects. Specialization comes from two independent boundaries: (1) the MCP server definition limits the tool surface an agent can even access, and (2) RBAC still applies inside that server—so a user can only invoke tools they’re authorized to use, even if they can access the server that contains them.

Together, these boundaries reduce sprawl while improving operability: agents become easier to reason about, costs drop because fewer tools are in play, and least privilege is enforced with practical, role-aligned granularity.
Speakers
avatar for Josh Reini

Josh Reini

Developer Advocate, Snowflake
Josh is a developer advocate for Snowflake, previously at TruEra (recently acquired by Snowflake). He is also a maintainer of open-source TruLens, a library to systematically track and evaluate LLM based applications.

Josh has delivered tech talks and workshops to thousands of developers at events including PyData, Global AI Conference, NYC Dev Day, LLMs and the Generative AI Revolution, AI developer meetups including AI Camp and Unstructured SF Meetup... Read More →
avatar for Reetika Roy

Reetika Roy

Staff Software Engineer, Snowflake
Staff Software Engineer, Snowflake
Thursday April 2, 2026 3:35pm - 4:00pm EDT
Juilliard Complex (5th Floor)
  Apps and Agents

3:35pm EDT

Code Mode Is Best Served in the Shell - Jan Curn, Apify
Thursday April 2, 2026 3:35pm - 4:00pm EDT
MCP adoption is growing, but most agent integrations still treat tools as a prompt-time API, burning context tokens on tool definitions, re-copying intermediate results, and losing accuracy along the way. This improper use also leads to unfair criticism of MCP itself.

To address this problem, Cloudflare proposed MCP “code mode”: instead of prompt-time JSON tool calls, the model generates small programs that call tools via an API and run in a sandbox. This dramatically reduces overhead while improving accuracy in chained tool use. An alternative approach recently implemented by Cursor and Anthropic uses dynamic tool discovery to load only the relevant tools into context.

In this talk, we’ll introduce 𝚖𝚌𝚙𝚌 (https://github.com/apify/mcpc), a new open-source universal CLI client for MCP that brings both code mode and dynamic tool discovery to where they shine: the terminal. With persistent sessions, JSON output for scripting, and an MCP proxy for sandboxing, mcpc is an invaluable tool for AI engineers. We’ll live-demo a practical workflow that invokes multiple MCP servers in parallel, filters and transforms results locally, and then turns the interaction into reusable scripts.
Speakers
avatar for Jan Curn

Jan Curn

Founder & CEO, Apify
Jan Curn is the founder and CEO of Apify (https://apify.com), the world's largest marketplace of web data extraction and automation tools, powering (not only) AI agents with up-to-date data. He has a lifelong passion for software engineering, which earned him an MSc and a PhD in computer... Read More →
Thursday April 2, 2026 3:35pm - 4:00pm EDT
Broadway Ballroom South (6th Floor)
  MCP Best Practices

3:35pm EDT

My MCP Server Code Works, but the Agent Fails: The Case for MCP-specific Evaluations - Calum Murray & Wesley Chun, Red Hat
Thursday April 2, 2026 3:35pm - 4:00pm EDT
You can write a perfect MCP server (clean code, typed schemas, 100% code coverage), yet agent interactions still fail. This is the probabilistic gap: your server is deterministic, but its user (the agent) is stochastic.

Standard “Agent Evals” are often the wrong tool to fix this. They judge the final outcome (was the answer good?), not the process. They struggle to provide useful insights into how the agent understands and uses your MCP server, instead focusing on providing insights into the agent itself.

In this session, we introduce mcpchecker, an open source framework for MCP server evaluations. We will show how to build integration tests specifically for the agent-MCP server interface, allowing you to isolate and debug these interactions.

Stop guessing why agents fail. Learn to test your server’s semantic interface and prove that agents can actually understand it.
Speakers
avatar for Calum Murray

Calum Murray

Software Engineer, Red Hat
I am a Software Engineer at Red Hat, where I work on Applied AI projects with a focus on MCP and Agents. I also work on Serverless with the Knative community.

I am a CNCF ambassador, where I present about new and exciting technologies in the AI/Serverless as well as mentor new contributors... Read More →
avatar for Wesley Chun

Wesley Chun

Technical Program Manager - AI, Red Hat
WESLEY CHUN, MSCS, is a Google Developer Expert (GDE) in Google Cloud (GCP) & Google Workspace (GWS), author of Prentice Hall's bestselling "Core Python" series (corepython.com), co-author of "Python Web Development with Django", and has written for Linux Journal & CNET. He's currently... Read More →
Thursday April 2, 2026 3:35pm - 4:00pm EDT
Marquis Ballroom (9th Floor)
  MCP Best Practices

3:35pm EDT

OCI Images as MCP Packaging: Supply Chain Security for AI Tools - Juan Antonio Osorio, Stacklok
Thursday April 2, 2026 3:35pm - 4:00pm EDT
So you found an MCP server on npm that does exactly what you need. You run npx and... now what? One reason people skip security verification for MCP servers is that it's genuinely hard to know what you're actually running. The package works, so why question it?

Here's the thing: MCP servers are getting access to your files, your APIs, your credentials. We should probably know what's in them before we hand over the keys.

In this talk, we'll dig into using OCI containers as the packaging standard for MCP servers - not because containers are trendy, but because they unlock supply chain security constructs that npm and PyPI simply don't have. We'll walk through building repackaging pipelines that verify source packages, run MCP-specific security scans, and produce attestations with Sigstore. Real pipelines, real commands, real output.

Note that this won't solve every trust problem - but it gets us a lot closer to "I know what I'm running" than the current state of affairs.
Speakers
avatar for Juan A. Osorio

Juan A. Osorio

Principal Engineer, Stacklok
Juan Antonio "Ozz" Osorio is a Mexican software engineer living in Finland. His background spans security for OpenStack, Kubernetes, and bare metal environments. Currently at Stacklok, he founded the ToolHive project and has been building MCP infrastructure, including supply chain... Read More →
Thursday April 2, 2026 3:35pm - 4:00pm EDT
Astor Ballroom (7th Floor)
  MCP Best Practices

3:35pm EDT

Clients? Servers? Agents? The Beautiful Asymmetry of the MCP Spec - Rohit Ganguly, Descope
Thursday April 2, 2026 3:35pm - 4:00pm EDT
Since its inception, we've talked about MCP from the perspective of Clients and Servers. This session focuses on an interesting paradigm taking advantage of the intentional asymmetry of the MCP spec - what if a Client was also a Server? What happens when we break out of a singular client-server pair and into multiple? What can this idea tell us about the future of MCP?

This session will cover the concept of an "MCP Agent" - a Client that is also a Server. We'll construct a system design for this MCP Agent to other servers and MCP agents and touch on several key considerations including auth and scalability.

Participants are expected to have an introductory knowledge of MCP, the mechanics of how Clients and Servers interact with each other, and a general interest in agent-to-agent communication!
Speakers
avatar for Rohit Ganguly

Rohit Ganguly

AI Product Manager, Descope
Rohit is an AI Product Manager at Descope, where he leads the MCP Auth and Agentic Identity efforts. Previously, he worked in Microsoft's Developer Division across products like the Azure SDKs and VS Code before launching the Azure MCP Server.
Thursday April 2, 2026 3:35pm - 4:00pm EDT
Broadway Ballroom North (6th Floor)
  Protocol in Depth

3:35pm EDT

Shadow MCP: Finding the MCPs Nobody Approved - Aidan Sochowski & Alexander Frazer, Runlayer
Thursday April 2, 2026 3:35pm - 4:00pm EDT
Shadow IT is back - but this time it's AI-powered. Employees are configuring MCP servers directly in Cursor, Claude Desktop, and VS Code, creating a blind spot that traditional security tools miss. These shadow MCPs operate outside centralized control, enabling data exfiltration, supply chain attacks, and compliance violations.

This talk exposes the shadow MCP problem and presents a comprehensive detection and response framework:

- Why shadow MCPs are uniquely dangerous (AI amplifies access, automates actions, no audit trail)
- Discovery techniques: IDE config scanning, MDM integration, network detection patterns
- Classification: distinguishing managed vs shadow servers across device fleets
- Response playbooks: triage, investigation, remediation by risk level

I'll share real vulnerability examples from official MCPs (GitHub, Asana, Supabase, Postmark) and demonstrate automated detection through IDE hooks (Cursor, Claude Code) and MDM platforms (SimpleMDM, Jamf).

Attendees will leave with practical techniques for gaining visibility into shadow MCP usage and a framework for bringing unauthorized integrations under organizational control.
Speakers
AS

Aidan Sochowski

Senior Product Engineer, Runlayer
Aidan is a founding product engineer at Runlayer. Previously he's worked
at Glean on scalable connector and crawler infrastructure and at YouTube
on recommendations serving infrastructure

... Read More →
avatar for Alexander Frazer

Alexander Frazer

Founding Security Engineer, Runlayer
Alexander Frazer is a Founding Security Engineer at Runlayer, specializing in generative AI and cybersecurity. With 15+ years of experience, he focuses on AI security challenges and MCP implementations. Previously he has led creation and evaluation of AI-driven security triage systems... Read More →
Thursday April 2, 2026 3:35pm - 4:00pm EDT
Empire Complex (7th Floor)
  Security and Operations

4:30pm EDT

When MCP Isn’t Enough: Product Decisions Behind Scalable Agent Systems - Cansu Berkem, Datadog
Thursday April 2, 2026 4:30pm - 4:55pm EDT
MCP is a strong foundation for building AI agents, enabling fast iteration, clear boundaries, and safer early deployments. But as agents move from prototypes to products customers rely on, product teams begin to hit limits around reliability, user experience, observability, and long-running workflows.

In this talk, I’ll share a product leader’s perspective on how MCP-based agent systems evolve in production. We’ll explore the product signals that indicate when MCP-only approaches start to constrain outcomes, and how teams can extend MCP-driven systems to meet higher expectations around trust, clarity, and control. Attendees will leave with a practical framework for scaling MCP-based agents from experimentation to dependable products.
Speakers
avatar for Cansu Berkem

Cansu Berkem

Director of Product Management, Datadog
Cansu Berkem is a Director of Product Management at Datadog, leading AI and Service Management platforms, and the product leader behind Bits AI, a generative AI copilot focused on building trusted, agentic AI systems in production. She has 15+ years of experience building AI, data... Read More →
Thursday April 2, 2026 4:30pm - 4:55pm EDT
Juilliard Complex (5th Floor)
  Apps and Agents
  • Audience Experience Level Beginner
  • Session Slides Yes

4:30pm EDT

Bridging Kernel Space and AI: Building an MCP Server for Linux Scheduler Observability - Daniel Hodges, Meta
Thursday April 2, 2026 4:30pm - 4:55pm EDT
The Model Context Protocol enables AI assistants to interface with external tools and data sources, but most examples focus on high-level APIs and databases. This talk explores building a production MCP server that exposes low-level Linux kernel observability data to AI assistants, enabling natural language debugging of complex systems.

`scxtop` is an observability tool for Linux's new sched_ext extensible scheduler framework (https://github.com/sched-ext/scx/tree/main/tools/scxtop). By implementing MCP, it allows developers to ask questions like "Why is my application experiencing high scheduling latency?" and receive AI-driven analysis that correlates kernel tracing data, hardware topology, performance counters, and scheduler internals.
Speakers
avatar for Daniel Hodges

Daniel Hodges

Software Engineer, Meta
Daniel Hodges is a software engineer on the Linux team at Meta. He has previous worked in areas such a observability, profiling, and application performance testing.
Thursday April 2, 2026 4:30pm - 4:55pm EDT
Astor Ballroom (7th Floor)
  MCP Best Practices
  • Audience Experience Level Advanced
  • Session Slides Yes

4:30pm EDT

If You Can Secure It Here, You Can Secure It Anywhere - Milan Williams & Katrina Liu, Semgrep
Thursday April 2, 2026 4:30pm - 4:55pm EDT
Here's the thing about being a security company: you can't ship a vulnerable MCP server. For us, getting pwned isn’t just embarrassing - it gets us on the front page of Hacker News. Our customers trust us to protect them from nation-state attackers, well-funded adversaries (and the odd teenager attacking for lolz.)

At the same time, the MCP ecosystem is still maturing. Hardening standards for sophisticated attackers don't exist yet. And with high-profile supply chain attacks now targeting agents, attackers are actively exploiting the trust developers place in their toolchains. Last year, a flaw in mcp-remote turned into a remote code execution nightmare, exposing over 400,000 developers. That's the reality we're building in.


When it came to our MCP server, we built it using the same rigor we use to protect the world's largest companies. This talk covers the threat model we designed against, gaps in MCP's current design that required workarounds, and ultimately how we built an MCP server trusted by enterprise customers, and hardened against even the most novel attacks. If we can secure it here, you can secure it anywhere.
Speakers
avatar for Milan Williams

Milan Williams

Senior Product Manager, Semgrep
I build security products. I'm a Senior Product Manager at Semgrep, a high-growth cybersecurity startup. I lead the teams responsible for Semgrep Code (SAST) and Secrets detection products.

I recently graduated from Harvard University with degrees in Computer Science and Physics. In my free time, you can find me geeking about the latest in security / developer tooling, running in San Francisco's Golden Gate Park, or enjoying local theater... Read More →
avatar for Katrina Liu

Katrina Liu

Software Engineer, Semgrep
Katrina is a software engineer at Semgrep. She is on the Semgrep Analysis Foundations Team, the team that owns and maintains the core static analysis functionality of the Semgrep tool. She is currently working on Semgrep's MCP server.
Thursday April 2, 2026 4:30pm - 4:55pm EDT
Empire Complex (7th Floor)
  Security and Operations

5:00pm EDT

Combine Skills and MCP To Close the Context Gap - Pedro Rodrigues, Supabase
Thursday April 2, 2026 5:00pm - 5:25pm EDT
As AI agents become more capable, their biggest limitation is no longer reasoning — it’s context. Without access to procedural knowledge and domain-specific understanding, agents struggle to perform real work reliably. In this talk, we’ll explore how Skills address this gap by giving agents on-demand access to company-, team-, and user-specific context.

We’ll look at how Skills can be combined with MCP servers to build safer, more reliable agents, and walk through a real-world example of managing a Postgres database. Using evals, we’ll compare agent performance with and without Postgres-specific Skills, showing how MCP enables secure database access while dramatically improving outcomes.
Speakers
avatar for Pedro Rodrigues

Pedro Rodrigues

AI Tooling Engineer, Supabase
I’m an AI Tooling Engineer at Supabase, part of the team maintaining all AI initiatives including our MCP server, AI assistant, and Skills. I’ve been involved with the MCP protocol since its early days, contributing to its SDKs and projects like Skybridge. I’ve spoken at MCP... Read More →
Thursday April 2, 2026 5:00pm - 5:25pm EDT
Broadway Ballroom South (6th Floor)
  MCP Best Practices

5:00pm EDT

MCP Meets Java: Engineering the MCP Java SDK - Dariusz Jędrzejczyk, Broadcom
Thursday April 2, 2026 5:00pm - 5:25pm EDT
Implementing the Model Context Protocol (MCP) in Java poses a challenge: mapping a fast-evolving specification onto a language that favors strict type safety and stability. This session explores the evolution of the official MCP Java SDK, moving beyond naive implementation to address the "hectic" reality of a shifting protocol while providing an enterprise-grade AI enabler.

We’ll discuss the transition from early bidirectional transports to recent Streamable HTTP with sessions and stateless patterns. You’ll learn how Java’s type system led to a "correct-by-construction" approach, ensuring invalid states are unrepresentable, rather than just throwing runtime errors. We will cover Java-specific security considerations, including pluggable authorization hooks designed for a fragmented security ecosystem.

Finally, we’ll share lessons on balancing abstraction with pragmatism: how we decoupled JSON serialization for pluggability and managed the friction between Java’s synchronous heritage and MCP’s asynchronous nature. Whether you're building AI-enabled apps or designing cross-language SDKs, this talk provides a blueprint for robust MCP adoption.
Speakers
avatar for Dariusz Jędrzejczyk

Dariusz Jędrzejczyk

Principal Software Engineer, Broadcom
Member of the Spring Team. MCP Java SDK maintainer. Maintainer of Project Reactor. Contributes to Spring portfolio projects. Passionate about developer productivity, distributed systems, concurrency, system design, and networking. Dariusz has commercial experience in Platform Engineering... Read More →
Thursday April 2, 2026 5:00pm - 5:25pm EDT
Astor Ballroom (7th Floor)
  MCP Best Practices
  • Audience Experience Level Any
  • Session Slides Yes

5:00pm EDT

Building a Workflow Engine on MCP: Orchestrating Processes With Tasks - Donnie Adams, Obot AI
Thursday April 2, 2026 5:00pm - 5:25pm EDT
What if your workflow engine wasn't just a consumer of MCP servers, but was itself built entirely on the MCP protocol? This talk explores a novel architecture that uses MCP's newest primitives to create a production-ready workflow orchestration system.
We'll demonstrate how MCP's task framework provides natural workflow step management, while sampling enables intelligent decision-making at each stage. You'll see how dynamic tool definition works at both workflow and step levels, allowing workflows to adapt their capabilities on the fly. We'll also cover practical challenges like handling OAuth authentication flows mid-execution and coordinating multiple MCP servers within a single workflow.
Through a real-world case study you'll see how MCP's composability transforms workflow design. Rather than building yet another workflow engine that happens to use MCP tools, we'll show how treating MCP as the foundation protocol unlocks new patterns for distributed, intelligent automation.
Attendees will leave with a deeper understanding of the MCP specification and how the capabilities can be composed to create production-ready workflow applications.
Speakers
avatar for Donnie Adams

Donnie Adams

Software Architect, Obot AI
Donnie Adams is a Software Architect at Obot AI, where he builds enterprise MCP infrastructure including the Obot MCP Gateway and agent orchestration systems. His work focuses on MCP gateway architecture, OAuth integration, and distributed AI systems. He specializes in building production-grade... Read More →
Thursday April 2, 2026 5:00pm - 5:25pm EDT
Broadway Ballroom North (6th Floor)
  Protocol in Depth

5:00pm EDT

Towards Building Safe & Secure Agentic AI - Dawn Song, UC Berkeley; UC Berkeley Center for Responsible Decentralized Intelligence & Matt White, Linux Foundation/PyTorch Foundation
Thursday April 2, 2026 5:00pm - 5:25pm EDT
Recent advancements in agentic AI have unlocked powerful new capabilities, however, they also introduce fundamentally new security risks. In this talk, I present a system-level view of the security landscape of agentic AI, drawing on a comprehensive systematization of attacks and defenses across modern agent architectures.

I show how increasing agent flexibility along different dimensions expands attack surfaces and enables threats such as prompt injection, memory poisoning, unsafe data flows, credential leakage, and unauthorized execution. Using real-world incidents and CVE analyses, I illustrate how agents can be manipulated through external content, compromised tools, or poisoned internal components.

The talk also provides a systematic overview of end-to-end automatic red teaming and risk assessment for agentic AI systems as well as a defense-in-depth framework for building secure agentic systems, spanning runtime guardrails, access control, information-flow tracking, privilege separation, and secure-by-design architectures, helping practitioners assess risk, close security gaps, and deploy agents safely at scale.
Speakers
avatar for Dawn Song

Dawn Song

Professor, Computer Science @ UC Berkeley and Director of Berkeley RDI (Berkeley Center for Responsible Decentralized Intelligence), UC Berkeley; UC Berkeley Center for Responsible Decentralized Intelligence
Dawn Song is a UC Berkeley CS Professor & Berkeley RDI Co-Director. She is the recipient of the MacArthur, Guggenheim, ACM, IEEE, and Sloan Fellowship, Schmidt Sciences AI2050 Senior Fellowship, NSF CAREER Award, MIT Technology Review TR-35 Award, ACM SIGSAC Outstanding Innovation... Read More →
avatar for Matt White

Matt White

Global CTO of AI, Linux Foundation
Matt White is the Executive Director of the PyTorch Foundation and GM of AI at the Linux Foundation. He is also the Director of the Generative AI Commons. Matt has nearly 30 years of experience in applied research and standards in AI and data in telecom, media and gaming industries... Read More →
Thursday April 2, 2026 5:00pm - 5:25pm EDT
Empire Complex (7th Floor)
  Security and Operations
  • Audience Experience Level Any
  • Session Slides Yes

5:30pm EDT

Operating MCP in the Enterprise: From Protocol To Production - Amar Deep Singh, GM Financial & Neelabh Tripathi, Cisco Systems
Thursday April 2, 2026 5:30pm - 5:55pm EDT
Model Context Protocol (MCP) enables standardized AI agents, but real adoption depends on how MCP servers operate in production—not just how the protocol is defined.

This session provides a high-level, practitioner perspective on running MCP in enterprise environments. It covers how MCP servers fit into existing platforms, with a focus on observability, security, distributed tracking of agent behavior, and resiliency. Rather than diving deep into implementation details, the talk shares lessons learned from real deployments and common pitfalls teams face when moving MCP from experimentation to production.
Speakers
avatar for Amar Deep Singh

Amar Deep Singh

AVP IT Architecture (Head of Enterprise Reusable Services & Tech Standards)), GM Financial
Amar Deep Singh is a distinguished software architect and author with extensive experience in microservices and cloud computing. He is the author of "Building and Delivering Microservices on AWS," a comprehensive guide that explores software architecture patterns and the deployment... Read More →
avatar for Neelabh Tripathi

Neelabh Tripathi

Engineering Architect, Cisco Systems
Neelabh Tripathi is a seasoned IT professional with over 18 years of expertise in cloud computing, enterprise architecture, and microservices. He has worked with some of the world’s leading organizations, where he played pivotal roles in driving digital transformation and innov... Read More →
Thursday April 2, 2026 5:30pm - 5:55pm EDT
Juilliard Complex (5th Floor)
  Apps and Agents

5:30pm EDT

Rules Are Not Suggestions: A History of MCP Non-Compliance - Sterling Dreyer, Arcade.dev
Thursday April 2, 2026 5:30pm - 5:55pm EDT
Less than 20% of remote MCP servers fully comply with the MCP Specification.
MCP adoption took off quickly, but full compliance didn't follow at the same pace. Today, partial implementations are common across both clients and servers, and the reasons go beyond just a fast-moving spec.
In this session, we'll walk you through:
-The first version of the MCP Specification and what it was designed for
-How MCP evolved to keep up with the quickly evolving AI ecosystem
-How clients and servers deviate from the spec and why developers choose not to comply
-What we can do to shrink the gap between design and implementation
This isn't a story about bad developers or tight deadlines. It's about how bending the rules has become part of how agents get built.
Speakers
avatar for Sterling Dreyer

Sterling Dreyer

Founding Engineer, Arcade.dev
Sterling is a founding engineer at Arcade.dev, focused on backend and infrastructure. Before Arcade, he was the second engineer at Featureform, a feature store platform acquired by Redis.
Thursday April 2, 2026 5:30pm - 5:55pm EDT
Astor Ballroom (7th Floor)
  MCP Best Practices
  • Audience Experience Level Any
  • Session Slides Yes

5:30pm EDT

URL Elicitation Deep Dive: Third-party OAuth Solved (and More!) - Nate Barbettini, Arcade.dev
Thursday April 2, 2026 5:30pm - 5:55pm EDT
The Nov 2025 release of MCP introduced a new client capability: URL Elicitation. This capability is game-changing for MCP servers that interact with external systems. But don't just take our word for it... Hear it straight from the author of the spec!

In this talk, Nate (lead author of URL Elicitation) will break down the "what" and "why" of this new addition to the protocol. You'll learn about:
- Why it's a mistake to reuse or "pass through" OAuth tokens from one server to another
- The confused deputy problem and other common pitfalls to watch out for
- How URL Elicitation unlocks a secure way for MCP servers to call external services that use OAuth or API keys, require payments, or gather sensitive information
- The correct security patterns for any remote MCP server project today

No need to be a security expert to attend! Nate will break down the problems and solutions in clear, relatable language, and provide crucial guidance for anyone building MCP servers in 2026 and beyond.
Speakers
avatar for Nate Barbettini

Nate Barbettini

Founding Engineer, Arcade.dev
Nate Barbettini is a leading voice in security and AI. At Arcade.dev, he's building the MCP runtime that helps enterprises deploy multi-user AI agents that take actions across any system. As an active MCP contributor, Nate is focused on security-critical work, authoring URL Elicitation... Read More →
Thursday April 2, 2026 5:30pm - 5:55pm EDT
Broadway Ballroom North (6th Floor)
  Protocol in Depth
 
Friday, April 3
 

11:30am EDT

RPC > MCP: Turning a Decade of APIs Into Agentic Tools - Ze'ev Klapow, HubSpot
Friday April 3, 2026 11:30am - 11:55am EDT
At HubSpot, we recognized that any RPC with a schema is already a tool definition, so we built our AI tooling infrastructure on top of our existing RPC framework instead of starting from scratch. Engineering teams can now expose any API to internal agents, public MCP clients, and customer-facing AI products with just two annotations, enabling rapid development and tool reuse across all of our AI systems. This talk covers the architecture, the tradeoffs, and how this approach let us ship agentic capabilities faster than we ever expected.
Speakers
avatar for Ze'ev Klapow

Ze'ev Klapow

Distinguished Software Engineer, HubSpot
Ze'ev Klapow is a Principal Software Engineer at HubSpot, where he has spent 13 years building infrastructure. He currently leads efforts to bring AI tooling to HubSpot engineers and designed the unified agent infrastructure that powers both internal and customer-facing AI produc... Read More →
slides pdf
Friday April 3, 2026 11:30am - 11:55am EDT
Juilliard Complex (5th Floor)
  Apps and Agents
  • Audience Experience Level Any
  • Session Slides Yes

11:30am EDT

Code Mode Without the Code - Bob Dickinson, TeamSpark
Friday April 3, 2026 11:30am - 11:55am EDT
Major AI players (Cloudflare, Anthropic, Docker) advocate "Code Mode" - having LLMs generate wrapper MCP servers to orchestrate tools, drastically reducing context usage. However, executing LLM-generated code introduces security risks and compliance challenges.

mcpGraph provides Code Mode benefits without code execution risks. It's a YAML-based DSL for declarative MCP tool orchestration using directed graphs. Tools are defined as graphs with MCP nodes, JSONata transforms, and JSON Logic conditionals, all inspectable and auditable, and exposed to agents as MCP tools themselves.

We'll cover and demo three MCP servers: mcpGraph (the core engine), mcpGraphToolkit (agent development tools for building/testing/deploying graphs, with associated agent skills), and mcpGraphUX (visual inspection and debugging).

This approach delivers Code Mode efficiency while maintaining security, observability, and compliance—no arbitrary code execution required.

mcpGraph is open source and available at: https://github.com/TeamSparkAI/mcpGraph

The presentation will be largely based on this document (and referenced videos): https://github.com/TeamSparkAI/mcpGraph/blob/main/docs/no-code-code-mode.md
Speakers
avatar for Bob Dickinson

Bob Dickinson

Founder, TeamSpark
Serial founder, CTO at scale, and always a hands-on builder. Creator of MCP Tool Vault and the open source projects tsAgent and mcpGraph. Maintainer of MCP Registry and MCP Inspector. Background in security, including as CTO of OneLogin and Censys.
Friday April 3, 2026 11:30am - 11:55am EDT
Astor Ballroom (7th Floor)
  MCP Best Practices

11:30am EDT

Human in the Loop, Agent in the Flow - Harald Kirschner & Connor Peet, Microsoft
Friday April 3, 2026 11:30am - 11:55am EDT
The AI hype cycle promised full automation. Reality delivered hallucinations and agents that guess when they should ask. The MCP spec offers a different vision—humans in control through rich, interactive collaboration rather than micromanaging every step.

This talk explores how recent MCP primitives transform the protocol from text-in-text-out tool-calling into interactive human-agent workflows. We'll cover elicitations that let servers ask clarifying questions with structured forms, async tasks that pause for human decisions and resume seamlessly, and MCP Apps that render interactive UIs—charts, dashboards, confirmations—in sandboxed iframes. Each makes feedback loops faster and agent interactions richer.

Using VS Code's implementation as reference, we'll demonstrate patterns for adaptive autonomy, progressive input gathering, and bidirectional workflows where servers drive the conversation. You'll leave with concrete patterns for building MCP integrations that treat collaboration as a feature, not a fallback.
Speakers
avatar for Harald Kirschner

Harald Kirschner

Principal PM, Microsoft
Harald Kirschner is a Principal Product Manager at Microsoft, building AI coding experiences in VS Code and GitHub Copilot for 40+ million developers. Before Microsoft, he led Firefox DevTools at Mozilla and helped ship Firefox Quantum. His engineering roots (MooTools, early web... Read More →
avatar for Connor Peet

Connor Peet

Principal Software Engineer, Microsoft
Connor is a principal software engineer working on VS Code since 2019.
Friday April 3, 2026 11:30am - 11:55am EDT
Broadway Ballroom South (6th Floor)
  MCP Best Practices

12:00pm EDT

From One MCP Server To an Ecosystem: When MCP Stops Being a Server and Becomes a Platform - Vaibhav Tupe, Equinix
Friday April 3, 2026 12:00pm - 12:25pm EDT
As MCP adoption grows, teams quickly discover that scaling from a single MCP server to a multi-server ecosystem introduces new architectural, operational, and governance challenges. Patterns that work for standalone MCP implementations often break down when MCP becomes a shared platform capability across multiple domains, teams, and clients.

In this talk, we share practical lessons from building and operating an MCP server ecosystem at infrastructure scale at Equinix. What began as a single MCP server evolved into multiple coordinated MCP servers spanning networking and infrastructure domains, each with distinct tools, lifecycles, and operational constraints.

Attendees will learn:
1. How MCP architecture changes when scaling from one server to an ecosystem
2. Design patterns to avoid tight coupling and fragmentation across MCP servers
3. Practical approaches to tool discovery, versioning, and backward compatibility
4. Operational lessons for reliability, rate limiting, and failure isolation
5. Governance best practices for ownership, change management, and ecosystem growth
Speakers
avatar for Vaibhav Tupe

Vaibhav Tupe

Tech Lead - Principal Engineer, Equinix
Vaibhav Tupe is a distinguished Technology Advisory Board Member and Engineering Leader specializing in cybersecurity, cloud, and AI-ready data center infrastructure. With over 13 years of experience, he currently serves as a Technology Leader at Equinix USA, where he drives high-performance... Read More →
Friday April 3, 2026 12:00pm - 12:25pm EDT
Juilliard Complex (5th Floor)
  Apps and Agents

12:00pm EDT

Distributing MCP Servers With OCI To Power Agent Skills - Bobby House, Docker
Friday April 3, 2026 12:00pm - 12:25pm EDT
While it is now considered a best practice for agent skills to leverage MCP servers, there is still no widely accepted approach for how those MCP servers should be distributed, versioned, and shared as dependencies.

This talk presents a practical pattern for using OCI artifacts as a distribution mechanism for MCP servers and configurations that agent skills depend on, enabling reproducible, shareable, and composable agent capabilities.

We’ll walk through creating an agent skill that can build and run an MCP project as a containerized service, then publish supporting artifacts such as the MCP server’s configuration.

Rather than bundling dependencies directly, the agent skill references an OCI artifact by OCI ref, pulls it at runtime, and activates the required MCP servers automatically. This ensures that when prompts expect specific MCP servers to be available, they already are.

By treating OCI as a universal distribution layer for agent tooling metadata and configurations, this approach makes agent skills easier to share, reproduce, and evolve across teams and environments.
Speakers
avatar for Bobby House

Bobby House

Sr Software Engineer, Docker
Bobby House is a senior software engineer at Docker that enjoys building products for engineers. His recent work centers on integrating MCP into enterprise environments by enabling organizations to publish and manage private catalogs of MCP servers as OCI artifacts.
Friday April 3, 2026 12:00pm - 12:25pm EDT
Broadway Ballroom South (6th Floor)
  MCP Best Practices

12:00pm EDT

MCP Live: Streaming Context To AI Agents - Harshit Kohli, Amazon Web Services
Friday April 3, 2026 12:00pm - 12:25pm EDT
Most MCP servers work like snapshots - ask for context, get a response, done. But what happens when your code changes while the AI is working? Or system metrics spike during deployment? Your agent has stale data.

I've been building streaming MCP servers that push live updates to AI agents. Think file watchers notifying code changes, system monitors streaming metrics, or database triggers sending updates as they happen.

I'll walk through building a live log monitoring MCP server from scratch. We'll extend the basic MCP protocol to handle streaming data using WebSockets, implement event subscriptions, and keep agents synchronized with rapidly changing data.

The demo shows an AI agent monitoring application logs in real-time, detecting anomalies and suggesting fixes as errors occur - not minutes later when someone checks the logs.

This isn't theoretical - I'm using similar patterns in production for DevOps monitoring and trading systems. I'll share the code, discuss gotchas, and show how streaming MCP opens up new use cases.

You'll leave with practical patterns for building reactive MCP servers that keep your AI agents always current.
Speakers
avatar for Harshit Kohli

Harshit Kohli

Sr Technical Account Manager, Amazon Web Services
GenAI/Data Driven individual who has 15+ years of experience. Proven experience with AWS Data Analytics/GenAI services, Cloudera Hadoop, Hortonworks Hadoop and Mapr Hadoop. Achieved customer wins over Amazon Q , Bedrock, Amazon Managed Kafka, Amazon Data Firehose, Kinesis Streams... Read More →
Friday April 3, 2026 12:00pm - 12:25pm EDT
Astor Ballroom (7th Floor)
  MCP Best Practices

12:00pm EDT

Path to V2 for MCP SDKs - Max Isbey, Anthropic
Friday April 3, 2026 12:00pm - 12:25pm EDT

Speakers
avatar for Max Isbey

Max Isbey

Member of Technical Staff, Anthropic
Software Engineer from New Zealand, previously worked at Rocket Lab designing and maintaining telemetry and command systems for rockets and satellites. Now relocated to London and working at Anthropic primarily focused on maintaining the MCP Python SDK.
Friday April 3, 2026 12:00pm - 12:25pm EDT
Broadway Ballroom North (6th Floor)
  Protocol in Depth
  • Audience Experience Level Any
  • Session Slides Yes

12:00pm EDT

Threat Modeling Authorization in MCP - Sarah Cecchetti, OpenID Foundation
Friday April 3, 2026 12:00pm - 12:25pm EDT
This session will describe the work of the AI Threat Modeling working group within the OpenID Foundation. Security considerations in OAuth were a concern before MCP, and MCP's use of OAuth raises additional concerns including malicious elicitation and code execution requests. I will describe MCP attacks which enable attackers to exfiltrate sensitive data, compromise password-protected accounts, and gain remote control of local machines.
Speakers
avatar for Sarah Cecchetti

Sarah Cecchetti

Chair of AI Threat Modeling Working Group, OpenID Foundation
By day, Sarah is Director of Product Management for Semperis, a Series C startup. She also chairs the AI threat modeling group in the OpenID Foundation. Prior to that she spent five years at AWS where she led the open-sourcing of Cedar. She co-founded IDPro and co-authored NIST SP... Read More →
Friday April 3, 2026 12:00pm - 12:25pm EDT
Empire Complex (7th Floor)
  Security and Operations
  • Audience Experience Level Beginner
  • Session Slides Yes

12:30pm EDT

Challenges in Delivering Unstructured Content Efficiently Over MCP - Kailas Krivanka & Fernando Cerenza, Box
Friday April 3, 2026 12:30pm - 12:55pm EDT
Delivering unstructured file content over MCP introduces various challenges in performance, efficiency, and security. We will explore the questions that arise when building an MCP server for content management and some of the approaches that can be used to tackle them. As enterprise environments require a more conservative security posture, we’ll also break down strategies for mitigating data exfiltration risks and prompt injection attacks through granular, configurable guardrails.

  • Why large content operations can fail: latency, data corruption
  • Techniques for managing context efficiently and minimizing LLM token usage
  • The benefits of programmatic tool calling for MCP tool composability
  • Tradeoffs between MCP and CLI for content operations
  • Handling safety risks when untrusted content becomes a data exfiltration vector
  • Balancing functionality and security when designing tool guardrails

By starting from first principles and reviewing specific examples attendees will leave with techniques for building MCP servers that process unstructured content efficiently and securely in enterprise environments.

Speakers
avatar for Fernando Cerenza

Fernando Cerenza

Senior Director of Product Management, Box
Fernando Cerenza leads Box’s partner integration ecosystem, where he oversees a vast network of over 1,500 application integrations. He is currently spearheading Box’s AI-focused initiatives, driving development on MCP and A2A to enable advanced agentic AI outcomes and seamless... Read More →
avatar for Kailas Krivanka

Kailas Krivanka

Software Engineer, Box
Kailas Krivanka is a software engineer with expertise in API design, software architecture, and distributed systems. He has worked at Box for 4 years, building scalable systems and solving complex technical challenges including launching the Box MCP server. With experience across... Read More →
Friday April 3, 2026 12:30pm - 12:55pm EDT
Juilliard Complex (5th Floor)
  Apps and Agents
  • Audience Experience Level Beginner
  • Session Slides Yes

12:30pm EDT

The Anatomy of a Meltdown: A Deep-Dive into MCP via Selective Sabotage - Joey Stout, Spacelift
Friday April 3, 2026 12:30pm - 12:55pm EDT
Most technical talks feel like a one-way street: I talk, you listen, and maybe you ask a question at the end if we have time. But the Model Context Protocol (MCP) isn't about one-way communication; it's about creating a living connection between a "brain" (the LLM) and the "world" (your data and tools).

To prove this, we aren't going to look at static slides. Instead, we are going to use a Live Audience Agent.

At the start of the talk, a QR code will go up on the screen. Anyone in the room can scan it and access a simple web interface. You can send in "Live Vibe Checks"—short text snippets, emoji reactions, or "Heckles"—that feed directly into a database. My MCP server is the bridge. It connects my LLM assistant to that live database of your thoughts.

This is a high-stakes demo. If the protocol works, the AI will be my co-speaker, responding to the room's energy in real-time. If I break the protocol, which I plan to do, repeatedly, the AI will lose its connection to you. We're going to perform "Selective Sabotage" to see exactly which parts of the MCP spec keep the lights on.
Speakers
avatar for Joey Stout

Joey Stout

Solutions Architect, Spacelift
Joey Stout is a Solutions Architect at Spacelift.io, CKA-certified, and creator of manifests.io. He specializes in Kubernetes, OpenTofu, and GitOps—and goes by The Outdoor Programmer.

Friday April 3, 2026 12:30pm - 12:55pm EDT
Broadway Ballroom North (6th Floor)
  Protocol in Depth
  • Audience Experience Level Any
  • Session Slides Yes

12:30pm EDT

Mix-Up Attacks in MCP: Multi-Issuer Confusion and Mitigations - Emily Lauber, Microsoft
Friday April 3, 2026 12:30pm - 12:55pm EDT
MCP deployments increasingly involve multiple authorization servers / identity providers across tools, registries, gateways, and enterprise environments. That flexibility introduces a classic but under-discussed class of failures: mix up attacks. A mix-up attack is where a client or intermediary confuses which issuer/authorization server it’s interacting with and misroutes sign-in artifacts, such as tokens, to the wrong party, potentially a malicious one.

This talk gives a clear threat model for mix-up in MCP-style topologies (client↔server↔auth server), then focuses on practical mitigations being discussed in the Auth Mix-Up Attack Prevention WG. I’ll also cover what’s realistic to adopt today in SDKs and servers versus what should be standardized in the MCP Core spec or another standard like OAuth.
Speakers
avatar for Emily Lauber

Emily Lauber

Senior Product Manager, Microsoft
Emily Lauber is a Senior Product Manager at Microsoft focused on identity, authentication, and developer platforms. She works at the intersection of cloud security, browser-based auth, and standards, helping shape how modern apps and agents securely authenticate and access resources... Read More →
Friday April 3, 2026 12:30pm - 12:55pm EDT
Empire Complex (7th Floor)
  Security and Operations

2:25pm EDT

Progressive Tool Discovery: Using MCP Notifications To Manage Context at Scale - Billy Hickman & Lilia Abaibourova, Amazon
Friday April 3, 2026 2:25pm - 2:50pm EDT
As MCP adoption grows, a challenge emerges: how do you expose 100’s of tools from a single server without overwhelming agent context windows? This talk introduces an MCP tool discovery mechanism we’ve built that dynamically loads tools. The platform works with a single discovery meta-tool on initialization, server-side state management to track agent context, and leveraging streamed MCP’s notifications/tools/list_changed to push relevant tool sets mid-session. Agents declare their problem context (incident response, monitoring etc) and receive only the tools they need, when they need them. Attendees will learn how this pattern keeps context windows lean while maintaining access to a broad tool ecosystem, with real examples showing how a single MCP server can serve diverse agent use cases without tool overload.
Speakers
avatar for Billy Hickman

Billy Hickman

Sr SDE, Amazon, Prime Video
Sr SDE from Amazon Prime Video. 10+ years experience building highly available, scalable distributed systems.
avatar for Lilia Abaibourova

Lilia Abaibourova

Principal Product Manager, Prime Video, Amazon
Lilia Abaibourova is a product and engineering leader with 15 years of experience building and scaling developer platforms and AI-first tools at Amazon, Peloton, HBO, and Microsoft. At Amazon, she leads AI enablement for Prime Video engineers, delivering agentic assistants for design... Read More →
Friday April 3, 2026 2:25pm - 2:50pm EDT
Juilliard Complex (5th Floor)
  Apps and Agents
  • Audience Experience Level Advanced
  • Session Slides Yes

2:25pm EDT

From Cypher to Conversation: MCP at WestJet - Anton Lysov, WestJet
Friday April 3, 2026 2:25pm - 2:50pm EDT
At WestJet, our flight schedule is modeled in a Neo4j graph database - airports, routes, aircrafts, seasonal schedules. The data is rich, but accessing it required Cypher expertise most stakeholders don't have.

I built an MCP server to change that. By creating a proxy layer connecting Claude to our Neo4j database, I enabled non-technical colleagues to query complex flight relationships using natural language. No Cypher. No waiting for developers. Just questions and answers.

This talk covers the journey from idea to working pilot: why I chose MCP, how I architected a proxy server wrapping the Neo4j MCP server, and what I learned deploying it internally. I'll give a live demo showing how analysts can explore our flight network conversationally.

This isn't a top-down initiative. It's about individual ownership - recognizing potential in data your team already maintains and using MCP to unlock value for people who couldn't access it before.
Whether you're exploring MCP for enterprise data or graph databases, this talk offers a practical, beginner-friendly blueprint.
Speakers
avatar for Anton Lysov

Anton Lysov

Software Developer, WestJet
Anton Lysov is a Software Developer at WestJet, working on backend systems that power westjet.com, mobile apps, and services used by teams across the organization. Before WestJet, he was one of the first hires at Rafflebox, helping build a platform that raised over $500M CAD for nonprofits... Read More →
slides pdf
Friday April 3, 2026 2:25pm - 2:50pm EDT
Astor Ballroom (7th Floor)
  MCP Best Practices
  • Audience Experience Level Beginner
  • Session Slides Yes

2:25pm EDT

The Tool Abstraction Problem: Lessons Learned Building 1000+ MCP Tools - Sam Partee, Arcade.dev
Friday April 3, 2026 2:25pm - 2:50pm EDT
Before MCP, Arcade was building tools for LLM agents. We've shipped over 1,000 tools—first as native Arcade tools with our own protocol and eventually adopting MCP. The main lesson: the hard part isn't writing the code, it's finding the right abstraction.

Most MCP tools today are thin wrappers around APIs. `GET /users/{id}` becomes `get_user(id)`. But this creates a mismatch—LLMs reason about tasks ("find the customer who complained last week"), not endpoints. The question is: where should tools sit on the abstraction spectrum?

**Too low-level:** The agent needs to chain together many calls. Each step is a chance to fail, and the model has to maintain context across all of them. You're asking the LLM to be a programmer at runtime.

**Too high-level:** You end up enumerating every possible task as its own tool. This defeats the point of having a general-purpose agent and your tool schema balloons, eating context and degrading selection accuracy.


In this talk:

- The common pitfalls we see in MCP tool design
- Our design philosophy for optimized tools
- Multiple real-world use cases and the tools that work for them
- Outlook on future tool development
Speakers
avatar for Sam Partee

Sam Partee

CTO and Co-founder, Arcade.dev
Sam is the CTO and co-founder of Arcade.dev. Before starting Arcade, Sam lead the led the applied AI team at Redis responsible for the vector database offering. He is a avid OSS developer and has contributed on projects like Langchain, LlamaIndex, Chapel, DeterminedAI, and others... Read More →
Friday April 3, 2026 2:25pm - 2:50pm EDT
Broadway Ballroom South (6th Floor)
  MCP Best Practices
  • Audience Experience Level Advanced
  • Session Slides Yes

2:55pm EDT

The MCP Gateway Pattern: Aggregation, Composition, and Beyond - Juan Antonio Osorio, Stacklok
Friday April 3, 2026 2:55pm - 3:20pm EDT
Here's a scenario that might sound familiar: you've got ten MCP servers, which means ten client connections, ten auth flows, and ten different places where things can break. One reason teams end up in this mess is that each MCP server solves a real problem - so you add another one, and another, and suddenly you've got MCP sprawl.

Enter the MCP Gateway pattern.

In this talk, we'll walk through an architecture that aggregates multiple MCP backends behind a single unified interface. We'll cover the fun problems this creates - what happens when two backends expose tools with the same name? and show how declarative workflow composition lets you orchestrate multi-step operations across backends without writing custom wrapper code.

We'll demo a gateway unifying several backends and executing a workflow defined entirely in YAML. No magic, just patterns you can apply to your own infrastructure.

With this in mind, you'll leave with practical approaches to taming MCP sprawl while keeping your security policies consistent across the board.
Speakers
avatar for Juan A. Osorio

Juan A. Osorio

Principal Engineer, Stacklok
Juan Antonio "Ozz" Osorio is a Mexican software engineer living in Finland. His background spans security for OpenStack, Kubernetes, and bare metal environments. Currently at Stacklok, he founded the ToolHive project and has been building MCP infrastructure, including supply chain... Read More →
Friday April 3, 2026 2:55pm - 3:20pm EDT
Broadway Ballroom South (6th Floor)
  MCP Best Practices
  • Audience Experience Level Advanced
  • Session Slides Yes

2:55pm EDT

Interceptors for MCP: A Production-Tested Standard for Agentic Middleware - Kurt Degiorgio & Cannis Chan, Bloomberg
Friday April 3, 2026 2:55pm - 3:20pm EDT
MCP standardized how agents connect to tools and context, but enterprise deployments need control between the model and the data. Today, MCP lacks a standard way to apply these controls, leading to a fragmented landscape of bespoke sidecars and proxies that shifts the M×N integration problem from the data layer to the middleware layer.
This session is a Protocol-in-Depth walkthrough of SEP-1763 (Interceptors), which proposes a protocol-native framework to intercept, validate, and transform messages across the MCP lifecycle, elevating middleware to a first-class capability alongside core MCP concepts. We will cover the concrete protocol semantics implementers need to align on: capability negotiation, hook points and invocation models, deterministic ordering/composition, enforcement semantics, error handling and observability.
We motivate the proposal with Bloomberg’s production experience in adopting interceptors to build agents in a regulated financial environment, sharing lessons on what must be standardized for interoperability. To ground the design, we map the proposed semantics to AWS Bedrock AgentCore Gateway Interceptors and OpenAI Guardrails’ staged validation guidance.
Speakers
avatar for Kurt Degiorgio

Kurt Degiorgio

Senior Engineer, Bloomberg
Kurt Degiorgio is a Senior Engineer at Bloomberg, working on building platforms for Generative AI. With 14 years of experience, his background includes Monzo, Diffblue and GFI Software (of TeamViewer fame), covering a wide technical spectrum—from developing network drivers to building... Read More →
avatar for Cannis Chan

Cannis Chan

Technical Product Manager, Bloomberg
Cannis Chan is a Technical Product Manager in the Office of the CTO at Bloomberg, building infrastructure platforms for AI products. With 10 years in B2B and Enterprise (AutogenAI, Deutsche Bank, Ondat/Akamai), she specializes in navigating complex products through pre- and post-product... Read More →
Friday April 3, 2026 2:55pm - 3:20pm EDT
Broadway Ballroom North (6th Floor)
  Protocol in Depth

2:55pm EDT

The Boring Attack That Will Actually Get You - Craig Jellick, Obot AI
Friday April 3, 2026 2:55pm - 3:20pm EDT
The MCP security conversation focuses heavily on prompt injection, tool abuse, and session hijacking. These matter. But if you're running a registry of MCP servers, your most likely breach won't be complicated. It will be a compromised server you trusted too quickly.

Supply chain attacks aren't new, and neither are the defenses. But the speed of MCP adoption has outpaced basic hygiene: validation, provenance, versioning, and review processes that mature package ecosystems learned the hard way.

This talk argues that before you harden against novel agent-based attacks, you need to treat your MCP registry like critical infrastructure. We'll cover practical approaches to vetting servers, establishing trust boundaries, detecting drift, and building review workflows that scale.

Prompt injection is a real threat. But the server you added last week without review is a more immediate one.
Speakers
avatar for Craig J

Craig J

VP of Engineering, Obot AI
Craig Jellick is VP of Engineering and co-founder of Obot AI, where they are building an agent platform that helps teams of all technical levels create software, automate work, and ship real tools using AI. Previously, he was a founding engineer and Director of Engineering at Rancher... Read More →
Friday April 3, 2026 2:55pm - 3:20pm EDT
Empire Complex (7th Floor)
  Security and Operations
  • Audience Experience Level Any
  • Session Slides Yes

3:25pm EDT

From 60 Minutes To 60 Seconds: Production MCP Workflows for Healthcare Billing - Andrew Espira, Kustode
Friday April 3, 2026 3:25pm - 3:50pm EDT
Healthcare providers lose 30-60 minutes per insurance claim error, with the industry wasting $250B+ annually on administrative overhead. At Kustode, we built a multi-tenant RCM platform processing thousands of daily EDI transactions (837P claims, 835 remittances, 270/271 eligibility). While we automated the EDI pipes, intelligent workflow orchestration—denial management, prior authorization, claim intervention—remained manual until we integrated MCP.
You'll learn:
- Integrating MCP into existing production systems vs. greenfield builds
- Multi-tenant MCP architecture with PHI isolation and compliance
- Orchestrating long-running workflows (45+ day denial cycles) with state management
- Real workflows: automated denial resolution, prior auth orchestration, intelligent claim intervention
- Security patterns for MCP in regulated environments
- Production metrics: time savings, denial reduction, deployment challenges
- When MCP beats traditional API orchestration
This talk shares production lessons from deploying MCP workflows in a HIPAA-compliant healthcare platform
Speakers
avatar for Andrew Espira

Andrew Espira

Founding Engineer, Kustode
Andrew Espira is a Site Reliability Engineer with over seven years of experience in DevOps, Infrastructure, and Site Reliability Engineering. He specializes in optimizing large-scale system environments, cloud infrastructure, and distributed systems. Andrew is passionate about cloud-native... Read More →
Friday April 3, 2026 3:25pm - 3:50pm EDT
Juilliard Complex (5th Floor)
  Apps and Agents
  • Audience Experience Level Any
  • Session Slides Yes

3:25pm EDT

Beyond the Sandbox: Security at the Host Layer - Lorenzo Verna & Pietro Valfrè, Denied
Friday April 3, 2026 3:25pm - 3:50pm EDT
Security in the MCP ecosystem has primarily followed a "Henhouse Model": building a perimeter to manage who enters with which keys. While we’ve become adept at granting agents the access they need to be productive, a new challenge is emerging. Because agents often operate with the user’s broad privileges, it is no longer just about managing entry; it is about ensuring that an agent's actions remain consistently aligned with the user’s intent.

While sandboxing is vital for isolation, it cannot "undo" the real world. When an agent uses an MCP tool to send an email, modify a calendar, or trigger a financial API, it steps through a "one-way door." Unlike local code, these actions lack a git revert.

We believe the most sustainable path forward is to move the primary authorization boundary to the Host. In this session, we propose an architectural approach that shifts outbound security to the application layer. By centering protection where context is richest, we can simplify server development and provide a more reliable way to manage the unpredictable nature of autonomous workflows.
Speakers
avatar for Lorenzo Verna

Lorenzo Verna

Co-founder and CPO, Denied
Lorenzo Verna (Math & CS) is Co-Founder & CPO at Denied.dev. A former CTO and founder with 3 startups and 2 exits, he has 15+ years building and scaling software products and AI platforms. His current work focuses on securing agentic systems, including MCP tool execution and policy... Read More →
avatar for Pietro Valfrè

Pietro Valfrè

CEO & Co.founder at Denied, Denied
Pietro, CEO and Co-founder of Denied, previously served as the first employee of a mid-size Italian venture studio. During his time there, he ultimately headed R&D and contributed to the successful development of several ventures. Having thoroughly explored the field of Auth, he is... Read More →
Friday April 3, 2026 3:25pm - 3:50pm EDT
Empire Complex (7th Floor)
  Security and Operations

4:20pm EDT

From Chaos To Clarity: How MCP Transforms Incident Response - Sebastian Villanelo & Rocío Bayon, PagerDuty
Friday April 3, 2026 4:20pm - 4:45pm EDT
Imagine being on-call at 3 AM: alerts fire, you scramble between the incident, monitoring dashboards, Slack, runbooks, and ticketing systems. Each tool switch drains cognitive capacity during your highest-stress moments.

Current reality: On-call engineers navigate 5-10 tools under pressure. Managers manually coordinate team responses. Stakeholders interrupt for updates. Result: burnout, delayed resolution, human error.

MCP-powered future: Natural language handles coordination, knowledge retrieval, and status updates. Responders focus on solving problems, not navigating tools. Managers orchestrate responses conversationally. Stakeholders self-serve information.

Attendees learn production patterns for building MCP servers that reduce human fatigue in critical operations: safety mechanisms for high-stakes automation, balancing AI assistance with human oversight, context preservation across operations, and testing strategies for mission-critical workflows.
Speakers
avatar for Sebastian Villanelo

Sebastian Villanelo

Forward Deployment Engineer, PagerDuty
Develop custom reports that help each customer identify and monitor the metrics most relevant to their operations. Gather technical and functional requirements, working closely with the product team to translate customer needs into concrete improvements.
avatar for Rocío Bayon

Rocío Bayon

Product Manager, Forward Deployed Engineering, PagerDuty
Originally from Argentina and based in Chile, I'm a Product Manager on the Forward Deployed Engineering (FDE) team at PagerDuty. With a background in Mechanical Engineering and Business Analytics, I live at the intersection of technology, data, and real-world customer implementations... Read More →
Friday April 3, 2026 4:20pm - 4:45pm EDT
Astor Ballroom (7th Floor)
  Security and Operations

4:20pm EDT

Securing the MCP Ecosystem: Production Patterns for Transparency and Trust - Lisa Tagliaferri & Trevor Dunlap, Chainguard
Friday April 3, 2026 4:20pm - 4:45pm EDT
Model Context Protocol servers are increasingly granted access to critical infrastructure from observability systems and databases to code repositories. This access introduces new supply chain security challenges for teams operating MCP servers in real-world environments.

In this talk, we share lessons learned from Chainguard’s experience building MCP infrastructure for production. Starting with mcp-grafana, our first hardened MCP server, we reduced known CVEs to 0 at publish time while shrinking image size by 65%. We developed repeatable security patterns for MCP delivery, including automated rebuilds, attack surface minimization, SBOM generation, and SLSA provenance.

We then applied these same patterns to a different use case: a documentation MCP serving over 1,500 container image guides, enabling secure access through AI assistants. These implementations demonstrate how consistent supply chain controls can support both infrastructure-integrated and content-focused MCP servers.

Attendees will learn practical approaches to threat modeling MCP servers. We’ll also share our challenges and failures, along with open-source workflows the community can adopt across the MCP ecosystem.
Speakers
avatar for Lisa Tagliaferri

Lisa Tagliaferri

Senior Directory, Developer Enablement, Chainguard
Lisa Tagliaferri is Senior Director of Developer Enablement at Chainguard and a maintainer of Sigstore’s documentation. The author of “How To Code in Python” and a Linux Foundation course developer, Lisa focuses on helping developers and maintainers adopt CNCF and OpenSSF tooling... Read More →
avatar for Trevor Dunlap

Trevor Dunlap

Senior Software Engineer, Chainguard
Trevor Dunlap is a senior software engineer at Chainguard. He holds a Ph.D. in Computer Science with a focus on automating the enhancement of vulnerability data. Trevor is an advocate for open source software security and enjoys competing on Kaggle.

Friday April 3, 2026 4:20pm - 4:45pm EDT
Empire Complex (7th Floor)
  Security and Operations
  • Audience Experience Level Any
  • Session Slides Yes

4:50pm EDT

Enterprise-Ready MCP: Security Patterns and the "4-Legged" Identity Challenge - Paulina Xu, Agentic Fabriq
Friday April 3, 2026 4:50pm - 5:15pm EDT
As MCP evolves from local developer workflows to shared, remote infrastructure, new security & identity challenges emerge. Patterns that work for single-user, local MCP setups often break down when MCP servers become gateways serving thousands of users, agents, and tools. This session explores the architectural patterns required to deploy MCP securely in enterprise environments. We’ll examine common failure modes such as data overexposure, unsafe bulk operations, topic-based disclosure, and weak audit controls, and map them to practical MCP-level mitigations including least-privilege access, tool-level guardrails, and privacy-aware logging. A focus of the talk is the “4-Legged” Identity Challenge: when a user interacts with a web app, which calls an agent, which then calls a remote MCP server. This model is not natively handled by standard OAuth flows. We’ll cover approaches such as token exchange, pre-provisioned trust, and interactive authorization, and discuss how emerging MCP capabilities like protected resource metadata support scalable identity discovery. Attendees will leave with a blueprint for moving from local MCP development to secure, production-ready MCP deployments.
Speakers
avatar for Paulina Xu

Paulina Xu

CEO, Agentic Fabriq
Paulina Xu is the CEO of Agentic Fabriq, where she is building a centralized hub for agent identity, OAuth-based authentication, permissioning, and auditability, enabling organizations to safely manage what agents can access and do across tools, applications, and teams. Prior to founding... Read More →
Friday April 3, 2026 4:50pm - 5:15pm EDT
Empire Complex (7th Floor)
  Security and Operations

4:50pm EDT

Kubernetes-Native Agent Discovery: A Unified Registry for MCP Servers and Skills - Carlos Santana, AWS
Friday April 3, 2026 4:50pm - 5:15pm EDT
As AI agents become integral to cloud-native architectures, they need a standardized way to discover capabilities available within Kubernetes clusters. Currently, agents must be pre-configured with MCP server endpoints and skill definitions, creating brittleness in dynamic environments where services scale and evolve continuously.
This talk introduces a Kubernetes-native discovery service: a cluster-scoped registry that exposes both MCP servers and Skills through a unified API. By leveraging Kubernetes primitives like CRDs and proven service discovery patterns, we can make agent capabilities first-class citizens in any cluster.
Attendees will learn how to implement a dynamic registry enabling agents to query available MCP servers by capability, discover registered Skills with their metadata, and handle lifecycle changes gracefully. We'll demonstrate a working implementation showing agents dynamically assembling their toolset based on cluster state.
The registry treats MCP servers and Skills as complementary discovery targets. Whether you're running agents in production or just exploring MCP adoption, this talk provides a blueprint for building discoverable agent infrastructure.
Speakers
avatar for Carlos Santana

Carlos Santana

Sr. Kubernetes Specialist SA, AWS
Senior Specialist Solutions Architect at AWS leading Container solutions in the Worldwide Application Modernization (AppMod). He is experienced in distributed cloud application architecture, emerging technologies, open source, serverless, devops. kubernetes, gitops. He is CNCF Ambassador... Read More →
Friday April 3, 2026 4:50pm - 5:15pm EDT
Astor Ballroom (7th Floor)
  Security and Operations
  • Audience Experience Level Advanced
  • Session Slides Yes

5:20pm EDT

Reflections on Context Engineering Via MCP Servers - Till Döhmen, MotherDuck
Friday April 3, 2026 5:20pm - 5:45pm EDT
Effective context engineering via MCP servers requires understanding how host agents weave the server's responses into their context as conversations unfold.

Context flows through more channels than tool definitions alone: initial instructions, the tool set itself (explicit tools vs. generic execution tools), tool names and parameters, descriptions, response content, structure and length, error feedback, "skill-loading" tools, resources, and sub-agent delegation.

Each mechanism involves trade-offs. Eager loading of context risks bloat; lazy loading adds tool calls. Rich tool responses help agents self-correct but consume tokens. Sub-agents compartmentalize complexity, but limited client support for elicitation creates friction.

Getting this balance right means staying conscious of how much context you're injecting, when, and at what cost (e.g. in # of tool calls to achieve a goal)—a balancing act that's hard without a clear picture of what's happening inside the host agent's context window.

This talk aims at providing a framework for thinking about these decisions—grounded in concrete examples from building the MotherDuck MCP Server.
Speakers
avatar for Till Döhmen

Till Döhmen

AI Lead, MotherDuck
Till Döhmen is AI Lead at MotherDuck, where he focuses on building agentic experiences for data analytics. He designed and built the MotherDuck MCP Server, enabling AI agents to query and analyze data through Claude, Cursor, and other MCP clients. Till is also a final-year PhD candidate... Read More →
Friday April 3, 2026 5:20pm - 5:45pm EDT
Broadway Ballroom South (6th Floor)
  MCP Best Practices

5:20pm EDT

Context Middleware for MCP: From Enterprise Needs To Protocol Extension - Peder Holdgaard Pedersen, Saxo Bank
Friday April 3, 2026 5:20pm - 5:45pm EDT
Many MCP servers aren't public - they're internal enterprise deployments where security, compliance, and safety aren't optional. Yet MCP currently lacks standardized middleware patterns, forcing teams into shared libraries and bespoke solutions that recreate the NxM problem.

Context middleware lets us intercept, inspect, and transform MCP traffic at trust boundaries. Just as tools were key to end-user MCP adoption, standardized middleware can unlock it for regulated industries: PII redaction, audit logging, prompt injection defense, hallucination detection - all without vendor lock-in or security gaps.

For the emerging gateway and proxy ecosystem, this opens new market opportunities: standardized integration points that transform MCP infrastructure into a composable, enterprise-grade platform.

This talk presents a working implementation as used at a major financial institution, including demos of attack prevention and real-world findings. You'll leave understanding the architecture, the extension, the trust boundary considerations, and how to start building context-aware middleware today.
Speakers
avatar for Peder Holdgaaard Pedersen

Peder Holdgaaard Pedersen

Principal Developer, Saxo Bank
Peder architects AI systems and spearheads AI adoption at Saxo Bank as Principal Developer. He is a contributor to the C# MCP SDK and an MCP maintainer for the Financial Services Interest Group. He specializes in integrating cutting-edge AI capabilities with bespoke assistants and... Read More →
Friday April 3, 2026 5:20pm - 5:45pm EDT
Empire Complex (7th Floor)
  Security and Operations
 
  • Filter By Date
  • Filter By Venue
  • Filter By Type
  • Audience Experience Level
  • Session Slides
  • Timezone

Share Modal

Share this link via

Or copy link

Filter sessions
Apply filters to sessions.