MCP Dev Summit Bengaluru showed the protocol moving from early server demos toward production infrastructure. The sessions covered tool design, context budgets, gateways, registries, identity, authorization, Kubernetes, UI, voice and multilingual systems - all with the same underlying question: what has to change when agents start using tools in real environments?
Ecosystem context
Angie Jones - Opening Remarks
Speaker: Angie Jones, VP Developer Experience, Agentic AI Foundation
Worth noting: The release candidate discussed in the opening moves MCP toward stateless operation, deprecates several early features, and introduces a clearer feature lifecycle, so servers and SDKs need compatibility checks.
Quote: "It became easier to operate. It became more focused and it became easier to evolve."
David Nalley - MCP and the case for shared standards
Speaker: David Nalley, Director of Developer Experience, Amazon Web Services
Worth noting: MCP's rapid spread was less about new tool-calling concepts and more about shared agreement on a standard way for agents to connect to tools.
Quote: "But it was the first place where the industry had come together and said, 'Hey, this makes sense. Let's all do this.'"
The Missing Middle: The Shared Infrastructure MCP Needs Before It Hits a Million Servers
Speaker: Hrittik Roy, vCluster
Worth noting: The next hard part for MCP is shared infrastructure around discovery, identity, tracing, trust, cost and governance, not only the protocol.
Quote: "Kubernetes didn't win on containers, it won because of the entire ecosystem."
From UX to MX: Designing Software for Machines
Speaker: Sam Partee, Founder & CTO, Arcade
Worth noting: Wrapping an existing OpenAPI spec and exposing each endpoint as an MCP tool gives agents too many chances to fail; tools should map to the task and intent, with delegated authorization scoped to the action.
Quote: "Tools are not APIs."
Building Trustworthy Agentic AI on India's Digital Public Infrastructure
Speaker: Arjun Venkatraman, Gates Foundation; Jagadish Babu, EkStep; Neha Jagadeesh, Eka Care
Worth noting: Domain-specific MCPs can improve healthcare tasks, but evaluation has to confirm the model uses the tool response rather than falling back to memory.
Quote: "This jump from 83% to 99.7% is the difference between a prescription and an incident."
Architecting Internet-Scale Agent Skills with Managed MCP
Speaker: Prashanth Subrahmanyam, Lead for Google Cloud DevRel in JAPAC, Google
Worth noting: Internet-scale MCP needs stateless request handling because long-lived stateful connections make load balancers carry affinity and most initialization events never become active tool calls.
Quote: "Only about 2% of the initialization events that have occurred actually translate to active tool usage."
Extending Goose: Building an AI Teammate for Open Source
Speaker: Abhijay Jain, Maintainer, Contributor & Grant Recipient, AAIF Goose
Worth noting: Goose recipes package instructions, model choice, parameters and extensions into repeatable workflows, and the next step is making that useful across teams rather than only one developer.
Quote: "Why can Goose help me but not my entire team?"
From Shadow IT To Scale: The MCP Adoption Journey
Speaker: Shannon Williams, Obot AI
Worth noting: Enterprise adoption tends to move from shadow MCPs and local agent tooling to governed gateways, IDP-backed access control and audited transactions.
Quote: "They found out about an MCP that was in their environment because of a breach, right?"
Protocol, transport, and compatibility
From SSE To Streamable HTTP: What Actually Changed in MCP's Transport Layer and Why You Should Care
Speaker: Animesh Pathak, Harness Inc
Worth noting: SSE itself is not dead; the deprecated piece is the old two-endpoint HTTP plus SSE transport pattern that depended on sticky sessions.
Quote: "In streamable HTTP, we still use SSE events. What deprecated was the format of using HTTP and SSE together."
MCP Schema Evolution: Versioning Tool Contracts Without Breaking Agents
Speaker: Yogesh Sardana, Cloud Engineering Leader & Researcher
Worth noting: Schema changes can fail silently, so MCP tools need explicit version metadata, additive-only minor changes, deprecation windows and client-server capability negotiation.
Quote: "Not a loud crash, not a 500 sort of error. Just wrong data and it's quietly all the way downstream."
MCP Resources Are Already a Knowledge Graph - You Are Just Not Reading the Headers
Speaker: Kesigan Anbalagan, Comcast
Worth noting: For structured documentation, MCP resources can behave like a graph with stable URIs, typed links and version metadata, avoiding some baseline RAG failure modes.
Quote: "Fails transparently, not silently."
Beyond Tools and Resources: A Deep Dive into MCP Sampling for Agentic Features
Speaker: Kevin Vaz, SmartBear
Worth noting: Sampling lets a server ask the host client to run the LLM, but limited client support and deprecation risk make it a feature to handle cautiously.
Quote: "What sampling does is it lets you borrow the LLM that the host application provides"
Building Interactive Tools With MCP Elicitation
Speaker: Ashwin Hariharan, Redis
Worth noting: Elicitation gives tools a typed way to pause and ask the user for missing information instead of forcing another model extraction pass.
Quote: "A protocol that can do anything will not do much in practice, right?"
Extending MCP: Writing Custom Protocol Extensions Without Breaking Compatibility
Speaker: Saurabh Mishra, Optum / UnitedHealth Group
Worth noting: Custom MCP extensions should be gated by capability negotiation and fallback paths so unsupported clients continue on the standard protocol.
Quote: "A well designed extension ecosystem accelerates innovation while preserving stability."
Tool design and context efficiency
Improving Reliability in MCP Applications Through Tool Design
Speaker: Yashasvi Misra, Everpure Inc.
Worth noting: Vague tools produce vague behaviour; clearer names, descriptions, schemas and failure contracts improve routing and make missing information visible.
Quote: "Even if the tool ran, the user lost."
Intelligence Placement Patterns for MCP-Connected Agent Systems
Speaker: Giri Venkatesan, Solace
Worth noting: MCP leaves the meaning of returned data to the system designer, so interpretation can sit with each agent, in a shared state layer, or behind a decision service.
Quote: "MCP is a tool contract, nothing more. Intelligence placement is the architectural decision it does not make for you."
Putting MCP on a Diet: A Proxy for Tool Scoping and Context Compression
Speaker: Prathamesh Saraf, TrueFoundry
Worth noting: A proxy that exposes only search, schema lookup and execution can keep large tool catalogs out of the agent context until needed.
Quote: "You already have paid this tax, okay? But you just didn't see the bill"
From Alert To Revert: One MCP 500+ Tools for Production Triage and Real-world DevOps
Speaker: Avinash Kumar Lodhi, Coursehero
Worth noting: Large tool estates need an aggregation layer; indexing tools behind a small set of meta-tools keeps context stable as more servers are added.
Quote: "You can add as many MCPs as you want, and your context remains the same, about 1,500 tokens."
Context-Aware MCP Servers for Small Language Models
Speaker: Vivek Mankar, Anto Ajay Raj John, Stuti Sinha, Reeva Nanda, Nethra Khandige, Pradipta Ghosh, IBM
Worth noting: Small models need context-aware server-side tool selection because showing them every tool schema can overwhelm the context window and reduce tool-call accuracy.
Quote: "These two things don't fit together out of the box"
InstaMCP: Instant MCP-ification of Enterprise APIs
Speaker: Rupal Sharma and Ujjal Sharma, Nutanix
Worth noting: Enterprise APIs should often be converted into workflow-level tools, not one tool per endpoint, because agents operate from intent rather than deterministic client paths.
Quote: "These APIs were written for clients that used to follow a deterministic path. But agents work with reasoning and intent."
Cloud-engineer-mcp: Implementing the Gateway Pattern for Multi-Cloud MCP Orchestration
Speaker: Aniruddha Biyani, Prophecy
Worth noting: A multi-cloud gateway can avoid huge tool catalogs by selecting only the tools relevant to the current conversation and keeping root-level access away from the model.
Quote: "Don't give root access to your LLMs."
Running MCP Fully Local: Private, Offline-Capable Agents With Ollama and Open Models
Speaker: Harish Kotra, Forge Alumnus
Worth noting: Local agents with open models depend heavily on precise tool design, examples, bounded schemas and output sanitization.
Quote: "It's like using a Ferrari to go buy groceries, right?"
The MCP Has No Clothes: What Most Benchmarks Miss About Real MCP Servers
Speaker: Arnav Balyan, Concierge AI
Worth noting: Benchmarking MCP servers needs to account for tool count, dependencies, token use and execution time; no one exposure pattern wins across every server.
Quote: "There's an inverse relationship between the tokens and the time to complete."
Managing Token Usage in MCP Servers Using Code Mode
Speaker: Bhumika Satpathy, Google
Worth noting: Code mode trades some execution time for lower token use by letting the LLM write sandboxed code against search and execute primitives rather than loading hundreds of tool schemas.
Quote: "Not all agents are coding agents."
Why Agents Make Different Decisions With the Same Tools
Speaker: Jyoti Bisht, Harness; Animesh Pathak, Harness; Aditya Oberai, Appwrite
Worth noting: Agent behaviour can drift even when tools look unchanged, so teams need fingerprints, baseline scenarios and drift thresholds before shipping.
Quote: "We don't ship our code or software without tests. Why should we ship agents without any behavioral guarantees?"
Security and authorization
OWASP MCP Top 10: A Practical Security Guide for MCP Builders
Speaker: Sankalp Sandeep Paranjpe, Big4 Consulting Firm; Dheeraj Choudhary, AWS
Worth noting: MCP security risks compound: shadow servers, weak auth, static keys, scope creep, tool poisoning and missing audit can become one attack chain.
Quote: "Everything happened and there is no log for you to identify what was the root cause."
Who Let the Agent In? Securing MCP Servers in Production
Speaker: Prachi Jamdade, Gravitee
Worth noting: Agent security needs fine-grained authorization that understands delegation from user to agent to server to tool, not only static API keys or roles.
Quote: "None of this flow has any security controls by default."
MCP in Production: OAuth, Session Isolation, and Audit Trails for Remote Servers
Speaker: Rajan Sharma, Ispace INC
Worth noting: Moving remote MCP servers to production means treating identity, authority, session isolation and audit as separate design problems.
Quote: "Hardcoded assumptions work in the demo."
MCPeek Into Your Server's Secrets
Speaker: Akash Sathish, Sahaj Software
Worth noting: MCP-aware static analysis can catch tool-level injection and taint-flow risks before runtime security layers ever see the server.
Quote: "The build should fail before even the vulnerability ships, rather than focusing or waiting till runtime."
Ambient Identity: Just-in-Time Authorization Patterns for the Model Context Protocol
Speaker: Ayesha Dissanayaka, WSO2
Worth noting: Background agents need just-in-time authorization flows that can ask the user through a trusted channel without relying on long-lived over-scoped tokens.
Quote: "Your agent doesn't have to start stalling when you are not looking."
Auditing MCP Tool Calls at the Kernel Level: eBPF as a Trust Boundary Enforcer
Speaker: Harini Anand, IBM
Worth noting: Kernel-level auditing with eBPF can observe process behaviour and block unauthorized syscalls outside the MCP server's own logs.
Quote: "You can't ask the suspect to write its own police report, right?"
When Agents Get SSH Keys: Securing Distributed AI Fleet With MCP
Speaker: Mradul Dubey, ApraLabs
Worth noting: Distributed agent fleets should assume compromise and keep secrets out of the context window, using short-lived scoped tokens and making unsafe actions unavailable by design.
Quote: "If you're designing your system assuming that the agent will behave you don't really have security you just have hope."
Why Our AI Agent Couldn't Scale Without MCP - and How We Built It
Speaker: Para Hitesh and Mohit Jichkar, Red Hat
Worth noting: Auth context should travel in the transport layer, not as model-controllable tool parameters.
Quote: "Don't let the LLM decide the user."
"Allowed To" Is Not Enough: Access Control That Understands What Your Agent Is Actually Doing
Speaker: Tejas Ladhani and Chandrashekar Haleupparahalli, Motorola Solutions
Worth noting: Access control for agents has to check the user's intent, not only whether the agent is technically allowed to call a tool.
Quote: "The M in the LLM stands for model for a reason. It's not the mind."
Production, scaling, and resilience
When MCP Meets Reality: Performance, Latency, and the Hidden Cost of AI Orchestration in Enterprises
Speaker: Partha Sarthy, Applied Materials
Worth noting: Sequential tool calls can multiply latency, so latency-sensitive operations should parallelise independent calls and keep MCP out of the router forwarding path.
Quote: "In latency sensitive environments, every tool has a cost."
Designing a Control Plane for Agentic Systems Using MCP
Speaker: Malepati Bala Siva Sai Akhil, Couchbase
Worth noting: A control plane can make agent workflows safer by recording compensation actions, using idempotency keys, handling retries and failing closed.
Quote: "Fail closed if something goes wrong or something is not clear. Don't go forward."
MCP Servers on Kubernetes: Deployment Patterns, Scaling, and What Breaks
Speaker: Kunal Das, Cast AI
Worth noting: MCP servers on Kubernetes need different operational defaults from web services because sessions, memory and bursty traffic make ordinary autoscaling and draining unsafe.
Quote: "MCP servers don't behave like web services"
MCP + Kubernetes: Building a Self-Healing AI Platform (Not Just Pipelines)
Speaker: Raghu Reddy, Calix; Esakki Raj E, Cisco
Worth noting: Self-healing AI platforms need readiness signals that include eval verdicts, not only HTTP health checks.
Quote: "A readiness probe says 200 okay. It cannot catch hallucinated JSON"
The Invincible MCP Server: Building Crash-Proof AI Tools With Durable Execution
Speaker: Shubham Londhe, Temporal
Worth noting: Durable execution makes MCP tools more resilient by checkpointing long-running work so crashes, timeouts or delayed human input do not wipe the workflow.
Quote: "It's just a process that can fail, and processes can fail a lot."
Sponsored Session: You Built an MCP Server - Now What? The Path from Prototype to Production
Speaker: Jatin Mehrotra and Varsha Das, AWS
Worth noting: Prototype-to-production work usually starts after the server exists: transport, OAuth, policy and observability decide whether it can run safely.
Quote: "Writing the server is the easiest part."
From MCP Discovery To Execution: Building a Governed Marketplace & Gateway for Agentic Systems
Speaker: Rahul Ganesh Partheeban, Freshworks
Worth noting: A governed MCP marketplace needs both discovery and execution controls, with a gateway handling session context, tenancy, routing, rate limits, retries and timeouts.
Quote: "We need a platform for enterprise scale agents to use and experience the business tools."
Agents Don't Fail, Environments Do: Lessons From Production MCP Deployments in Telecom
Speaker: Divya Vijay, NetoAI
Worth noting: Production agent failures often come from environment and tool-surface design, especially flat tool catalogs that do not encode workflow order.
Quote: "Concatenations don't fail loudly, they produce confident wrong answers."
The Stdio Deadlock Nobody Warned Us About: OS-Level Process Management for MCP
Speaker: Yuvraj Pradhan and Archana Kumari, MIT ADT University
Worth noting: Stdio transports can deadlock when stderr is not drained, because the process stays alive while the kernel buffer blocks the writer.
Quote: "Writers are blocked on the full pipe."
Apps, UI, and model-visible data
Voice-First MCP: Real-Time Tool Calling Through a Spoken Interface
Speaker: Samyuktha Mohan Alagiri, IBM
Worth noting: Voice-first MCP needs cancellation, verbalization and recovery layers because spoken interaction makes latency, side effects and silence visible to the user immediately.
Quote: "Voice is not a UI layer. It's a new MCP contract."
From Intent To Production: MCP Gateway Patterns for Regulated Banking
Speaker: Hariskumar Panakkal, Wipro
Worth noting: Regulated banking patterns can keep PII out of the model by storing sensitive values in agent state and exposing only field names to the LLM.
Quote: "You don't want the LLM to see what that data is. They only need to know what elements are available."
Beyond Tool Calls: Unlocking Interactive, Token-Smart Agents with MCP Apps
Speaker: Suraj B, HDFC Bank
Worth noting: MCP Apps can move sensitive deterministic work into the UI so the model sees intent and tool structure without seeing unnecessary PII.
Quote: "Let the UI hold what the model does not need to see"
Building Rich AI-Native UI for Agentic Interactions Using MCP Apps
Speaker: Ashita Prasad, AWS
Worth noting: MCP Apps can return interactive UI inside a sandboxed iframe, giving agents richer interfaces than text-only responses.
Quote: "Text is not a good or ideal interface for visualization."
Multilingual MCP: Making Tool Calling Work for the Next Billion Users
Speaker: Samyuktha Mohan Alagiri, IBM
Worth noting: Multilingual tool calling needs manifest and routing changes, not only a better model, because tool descriptions, entity handling and output templates all carry language assumptions.
Quote: "Multilingual is not a model problem, it's a protocol problem."
Why We Built a CLI Instead of an MCP Server for Jupyter Notebooks - and What We Learned
Speaker: Piyush Jain, AWS
Worth noting: For Jupyter notebooks, a CLI plus a compact skills file may be better than an MCP server when notebook JSON would waste too many tokens.
Quote: "The output format matters more than the protocol itself."
Agentic systems and anti-patterns
One MCP Server, Five Languages, Zero Containers
Speaker: Bharath Nallapeta, Mirantis Inc.
Worth noting: WebAssembly components can package multi-language MCP servers and policy code into one binary without containers or a service mesh.
Quote: "The interpreter itself is packaged into your binary, which is the trick, right?"
Skills Are Not MCP Servers: When To Use Which (and How To Make Them Work Together)
Speaker: Animesh Pathak and Jyoti Bisht, Harness Inc
Worth noting: Skills and MCP servers serve different roles: skills encode workflow judgement, while servers execute live actions against systems.
Quote: "The skills own the workflow and MCP owns the execution."
Why Your Database MCP Should Never Talk To Your Database
Speaker: Gowtham Raj Elangovan, Comcast
Worth noting: Database MCPs should route through a proxy and query service rather than connecting directly to the database, so policy, query construction and PII controls stay outside the model.
Quote: "They're not guardrails, they're just instructions."
Where MCP Ends and A2A Begins: and Why That Seam Is Breaking Your Agents
Speaker: Arushi Garg, Adobe; MV Shiva, Google
Worth noting: The hardest failures can happen at the seam between MCP and A2A, where tracing, token delegation, schema mapping and cancellation need an explicit bridge.
Quote: "The seam is the system."
SEO for Agents: Designing MCP Endpoints That Let Agents Evaluate Each Other Before Transacting
Speaker: Manav Agarwal, Dream11
Worth noting: Agents evaluate services through evidence such as accuracy, sample size, freshness and track record before transacting, so MCP endpoints need machine-readable proof.
Quote: "Agents don't read, they audit."
Agentic DX: Bringing Your IDP Into the IDE
Speaker: Adnan Vahora and Rinkal Mav, Motorola Solutions
Worth noting: Developer portal adoption can improve when the portal capabilities are exposed inside the IDE, but agent handoffs still need explicit approval and agreed governance rules.
Quote: "You cannot blame AI when things go wrong"
MCP Anti-Patterns: Mistakes Made While Building Agentic Systems for the Enterprise
Speaker: Abhishek Pandit and Satyam Soni, NitroStack
Worth noting: Enterprise MCP mistakes often repeat old platform failures: monolith servers, tool sprawl, late security and output-only testing.
Quote: "You cannot test the output, you should test the journey."
Share
Author
