# MCP Dev Summit [Day 1]

Shannon Williams, Obot AI & Jim Zemlin, Linux Foundation & David Soria Parra, Anthropic & David Nalley, AWS & James Hood, Amazon Web Services & Magna Sumasandra & Rash Tini, Uber & Sheng Liang, Obot AI & Aaron Wang, Duolingo & Adam Seligman & Zayn Turner, Workato & Diamond Bishop, Datadog & Nick Aldridge, Mousetrap & Alex Salazar, Arcade.dev & Jake Diamond Arivich, Jupyter & Kiierra Dodson, Further & Daniel Abdel Samid, Apollo & Juan Antonio Oz, Stacklok & Alharith Hussin, Alterion & Rick Nucci, Guru & Jonathan Rochelle, Lutely & Harshul Jain, Audible & Abhishek Khanna, Blueflame AI & Du'An Lightfoot, AWS & Lin Sun, Solo.io & Saurabh Yergattikar, eBay & Sanjay Vakil, DirectBooker & Jonathan Freeland, Shashank Khanna & Hillary Curran & Cecilia Liu, Docker & Diamond Bishop, Datadog & Paul Carleton, Anthropic | MCP Dev Summit 2026 | 7:14:47

Source: https://www.youtube.com/watch?v=jfd1UBEYJs0
Channel: MLOps Community, now AAIF Live (https://www.youtube.com/@AAIFLive-x1r). Summarised by MLOps Talks.
Page: https://mlopstalks.com/talks/mcp-dev-summit-day-1
Published: 2026-04-02
Tags: governance, mcp, observability, security

## TL;DR
- MCP has become a widely adopted integration protocol, and its 2026 roadmap focuses on making remote servers, long-running tasks, authorization, stateless transport, triggers, streaming, and skills work better in production.
- Enterprise deployments need a control plane that separates probabilistic agent reasoning from deterministic authorization, business rules, mutations, retries, and observability.
- Teams at Amazon, Uber, Duolingo, and elsewhere are reducing MCP friction with registries, gateways, standardized servers, agent configurations, human approval, evaluations, and progressive tool discovery.

## Summary
Day 1 presents MCP as an integration layer that is moving from rapid adoption into enterprise production. David Soria Parra describes the protocol's growth from local stdio servers to remote systems, authorization, structured outputs, tasks, extensions, and MCP Apps. His roadmap includes stateless transport, better long-running task support, enterprise authorization, triggers, streaming, and skills. Builders from Amazon, Uber, and Duolingo describe registries, gateways, standardized deployments, tool discovery, Slack agents, and approval flows. Other speakers argue that agents need a deterministic control plane around the model, with least privilege, safe retries, policy enforcement, and audit trails. Later sessions cover Jupyter AI, edge deployments, documentation retrieval, OCI packaging, and MCP security. Across the talks, the recurring practical concern is control: teams need to know which tools exist, who can use them, what an agent actually did, and how to limit damage when models make mistakes.

## Key ideas
### The Agentic AI Foundation is building neutral governance around MCP
[01:32](https://www.youtube.com/watch?v=jfd1UBEYJs0&t=92s)
The opening describes the Agentic AI Foundation as a neutral home for MCP and related projects. David Nalley says the foundation had 170 members after roughly four months, with seven working groups and about 500 participants. The groups cover problems larger than one project, including identity and trust. The foundation has also approved a project life cycle with growth, impact, and emeritus stages, so projects can be proposed, reviewed, and managed openly. Nalley asks builders and enterprise users to participate in working groups, projects, and the wider community instead of treating open source as something delivered by maintainers alone.

### MCP has moved from local integrations to enterprise systems of record
[19:42](https://www.youtube.com/watch?v=jfd1UBEYJs0&t=1182s)
David Soria Parra traces MCP from its November 2024 reference servers for PostgreSQL, SQLite, files, Git, memory, search, and fetch. SaaS integrations such as ClickHouse, Notion, and Zapier followed, then internal servers connected company data and systems such as CRM platforms, ticketing systems, wikis, warehouses, and HR tools. He says MCP is now mainly living inside corporate and enterprise environments. The protocol has expanded from stdio and local servers to remote servers, authorization, structured outputs, elicitation, tasks, extensions, and interactive MCP Apps.

### The 2026 MCP roadmap targets scale, long-running work, and enterprise authorization
[29:24](https://www.youtube.com/watch?v=jfd1UBEYJs0&t=1764s)
Parra says 2025 established that MCP was needed, while 2026 must make it suitable for production agentic systems. The current streamable HTTP transport can be difficult for large deployments because of stateful sessions. A new approach is intended to support the full specification statelessly, with work planned for the June revision. Tasks are intended to support long-running autonomous work. Enterprise authorization work includes cross-app access that can reuse a user's existing identity-provider session. Longer-term items include webhooks or triggers, native streaming, and serving domain-specific skills through MCP.

### Progressive discovery and code composition address context bloat
[37:37](https://www.youtube.com/watch?v=jfd1UBEYJs0&t=2257s)
Parra argues that context bloat is often caused by MCP clients dumping every tool into the model context. Progressive discovery, including tool search, loads tools only when needed. He shows Claude Code moving from a configuration where MCP tools occupied 22% of a 200,000-token window to a deferred approach. He also describes composing MCP calls through code: an interpreter lets a model write code that calls tools, while structured outputs make return types available for reasoning. This can connect several operations without returning to inference after every call.

### Enterprise teams are treating MCP servers, skills, and agents as managed configurations
[45:50](https://www.youtube.com/watch?v=jfd1UBEYJs0&t=2750s)
James Hood says Amazon uses MCP as its most popular way to connect agents to internal systems and services. Amazon created a registry so builders can discover and share local and remote servers, then expanded it to store skills, context files, and other AI capabilities as agent configurations. The registry lets security teams classify tools against the risks of private data, untrusted content, and external communication. Uber describes a similar gateway and registry that generate tools from more than 10,000 service definitions, apply scanning and privacy controls, and expose selected tools to no-code agents, SDKs, and coding agents.

### Control planes should enforce deterministic rules around probabilistic agents
[1:33:30](https://www.youtube.com/watch?v=jfd1UBEYJs0&t=5610s)
Adam Seligman and Zayn Turner separate an agent into a reasoning layer and a control plane. The model handles intent and decisions probabilistically, while the control plane handles authentication, authorization, business rules, mutations, retries, recovery contracts, and observability deterministically. They recommend governed operations, deterministic writes, intent-based tools, bounded access, safe retries, recovery contracts, and structural observability. Alex Salazar makes a related argument for an actions runtime that intersects the agent's permissions with the user's permissions on every request. The runtime should curate tools, enforce policy, and record what happened outside the agent's own control.

### MCP packaging and evaluation need their own engineering discipline
[6:00:00](https://www.youtube.com/watch?v=jfd1UBEYJs0&t=21600s)
Several sessions focus on operating MCP safely and measuring whether it works. Daniel Abdel Samid describes Apollo's documentation MCP, which replaces repeated search-and-read calls with a research tool that retrieves exact semantic chunks and reduces token use. Its evaluation setup uses an execution agent and an isolated scoring agent with a binary rubric. Juan Antonio Oz recommends packaging MCP servers as OCI images instead of running npx directly, then attaching software bills of materials, signatures, and build attestations. The packaging does not solve tool poisoning or every agent threat, but it gives teams a portable artifact they can scan, verify, and govern.

### MCP needs adaptations for edge devices with small models and unreliable networks
[5:25:50](https://www.youtube.com/watch?v=jfd1UBEYJs0&t=19550s)
Kiierra Dodson argues that cloud-oriented MCP assumptions fail on constrained devices. Edge systems may have small context windows, limited bandwidth, intermittent connectivity, and expensive compute. She proposes binary MCP using Protocol Buffers to reduce wire size, semantic compression and relevance filtering for tool schemas, MQTT with local persistence for store-and-forward delivery, session identifiers and sequence numbers for reconnects, and content-addressable caching for slowly changing resources. For high-volume inputs such as video, she proposes local resource discovery so raw streams bypass MCP while MCP remains the decision and action layer.

## Notable quotes
- David Soria Parra: "In my mind today MCP is the integration protocol." (28:29)
- Daniel Abdel Samid: "Context is courtesy." (6:05:55)
- Zayn Turner: "The control plane needs to be correct every single time because in business there are consequences." (1:37:27)
- Alex Salazar: "The agent can hallucinate all it wants about robbing a bank. The only time anybody cares is when it pulls a gun." (2:57:26)
- Juan Antonio Oz: "If you're running npx directly, you shouldn't." (6:36:39)

## Tools & references mentioned
- Model Context Protocol
- MCP
- Agentic AI Foundation
- Linux Foundation
- Anthropic
- OpenAI
- Block
- AWS
- Amazon Web Services
- Uber
- Obot AI
- Duolingo
- Workato
- Datadog
- Jupyter AI
- Jupyter Lab
- Apollo
- ToolHive
- Stacklok
- Arcade.dev
- OCI images
- Docker
- Protocol Buffers
- MQTT
- Claude Code
- Cursor
- Codex
- Gemini
- Temporal
- LangChain
- LangGraph
- Salesforce
- Snowflake
- Slack
- GitHub
- Linear
- Notion
- Zapier
- PostgreSQL
- SQLite
- Blender
- Ableton
- OpenClaw
- NemoClaw
- Cosign
- Sigstore
- SLSA
- Grype
- Syft

## Who should watch
- You are building several MCP servers or agents and need a registry, gateway, approval flow, or evaluation process before wider internal use.
- Your team is deciding whether MCP, skills, CLIs, or APIs should be the main integration surface and wants concrete trade-offs around context, security, and composability.
- You are responsible for production agent access to business systems, especially where user permissions, audit trails, long-running tasks, or unreliable networks matter.

## Related talks

- [What We Learned from Dozens of Enterprise MCP Deployments](https://mlopstalks.com/talks/what-we-learned-from-dozens-of-enterprise-mcp-deployments) (Jiquan Ngiam, MintMCP, 26:13)
- [Enterprise-ready MCP](https://mlopstalks.com/talks/enterprise-ready-mcp) (Jiquan Ngiam, MintMCP, 28:36)
- [MCP Security: What Happens When Your Agents Talk to Everything?](https://mlopstalks.com/talks/mcp-security-what-happens-when-your-agents-talk-to-everything) (, 24:26)
- [MCP is not going to change everything (yet)](https://mlopstalks.com/talks/mcp-is-not-going-to-change-everything-yet) (Sam Partee, Arcade AI & Rahul Parundekar, AI Hero, 1:04:43)
- [Responsible Autonomy: Building Governance Frameworks for AI That Act in the Real World via MCP](https://mlopstalks.com/talks/responsible-autonomy-building-governance-frameworks-for-ai-that-act-in-the-real) (Saurabh Mishra, Optum, 27:55)