MCP Dev Summit Mumbai 2026

AI Agents are getting smarter with each passing day. But, their interfaces? Not so much.

But, what if there is a way to turn the AI chat from a place where you converse into a place where you can actually work?

MCP Apps offer a solution to go beyond the text and standardize how MCP servers can deliver rich, bidirectional UI components like dashboards, forms, interactive visualizations & more. These components are rendered securely and natively within AI hosts, enabling agents to interact with users via rich interactive interfaces.

In this session, attendees will learn:
- Core architectural patterns from real MCP Apps development
- How to handle sandboxed host–server communication, manage state synchronization, stream real-time updates, handle async tasks, & add multiplayer collaboration
- How to leverage context and persist memory across conversations
- How to avoid some common pitfalls and utilize debugging workflows and tools
- How to add authentication & deploy a remote MCP Server providing MCP Apps

We will walk through a complete, production-style Sales Analytics MCP Apps and perform a code deep-dive to showcase the effective foundational patterns while building MCP Apps.

56,000+ MCP servers are listed across mcp.so, Smithery, Glama, and PulseMCP. But how do you know which ones actually work?

I independently mapped 4 major MCP directories and tested 65+ servers across Research, Code, and Finance categories. The results expose a critical trust gap.

Each directory measures something different — none measure what matters most:
- mcp.so (19.5K servers): Zero quality signals
- Smithery (4.4K): Tracks uptime, not output quality
- Glama (21K): Grades code quality, not correctness
- PulseMCP (11K): Tracks popularity only

Key findings I'll share:

1. Quality collapse at scale — Developer Tools has 8,800 servers but only ~12 are consistently good (0.1% quality rate)

2. The Finance/Payments desert — 74 Finance servers out of 19,557 (0.4%). Fewer than 8 support agent-to-agent payments across 14 protocols I analyzed

3. A practical framework for MCP server trust — beyond code grades to actual output quality assessment

This is independent research, not a product pitch. Full dataset and methodology shared openly.

Attendees leave with the first cross-directory quality analysis of the MCP ecosystem and a framework for evaluating servers.

OAuth-based authentication is becoming the default foundation for MCP-enabled systems. However, while authentication is standardized, authorization across agent boundaries remains unresolved.

In multi-agent MCP pipelines, orchestrators delegate tasks to sub-agents that act using the user’s authority. This creates a classic confused deputy problem: a sub-agent executes with valid credentials, but under the influence of untrusted inputs such as prompt injections or malicious tool manifests. As a result, it can access or exfiltrate data beyond the user’s original intent.

This talk demonstrates how privilege propagation, not authentication failure, is the core risk.

I will present a three-layer enforcement model:

1) Token attenuation using RFC 8693 to restrict sub-agent privileges at delegation time
2) Policy enforcement using Open Policy Agent to treat every tool call as untrusted input
3) Structured audit trails to ensure post-incident analysis

Live demo: the same MCP pipeline executed twice, first with default delegation (resulting in silent data exfiltration via prompt injection), and then with all three controls applied, where the attack is blocked, logged, and auditable.

There is a fundamental contradiction at the heart of production deployments for the Model Context Protocol (MCP). Conceptually, MCP sessions are stateful: they establish connections, negotiate capabilities, and persist context. However, modern deployment environments—like Kubernetes horizontal scaling, serverless functions, and AWS Bedrock AgentCore—are inherently stateless.

The current ecosystem advice is simply to "externalize your state," but there is no standardized infrastructure for doing this natively within MCP. Developers are forced to build ad hoc memory management using custom Redis wrappers or brittle in-memory dictionaries.

This session introduces the State Sidecar pattern: a dedicated MCP server whose sole responsibility is to store, manage, and retrieve agent workflow state. Instead of building custom database connectors, any agent can call the sidecar via standard MCP tool calls to persist intermediate results, track task progress, and maintain context summaries.

Most developers encounter MCP as a way to give chat assistants better tools. This talk blows that ceiling off.
Using two open-source projects, Appium MCP and AppClaw, we'll show how MCP becomes the backbone of a fully autonomous agent that controls real Android and iOS devices without a human in the loop. The agent perceives a live UI tree, reasons about what to do next, calls MCP tools to act, observes the result, and loops handling stuck states, recovering from failures, and decomposing multi-app goals on its own.
We'll go deep on the architecture decisions that make this work in production: how dynamic tool discovery lets the agent adapt to new capabilities at runtime without code changes; how parsing raw UiAutomator2/XCUITest XML into compact representations makes mobile UI fit inside an LLM context window; why dual vision (DOM-first with screenshot fallback) beats either strategy alone; and how stuck detection transforms a fragile demo into a reliable engineering tool.
Attendees will leave with a concrete mental model for building agentic systems on MCP and an understanding of why the protocol matters far beyond tool-calling alone.
https://github.com/appium/appium-mcp

The default AI stack today ships user data to a cloud endpoint and hopes for the best. But regulations like GDPR, India's DPDP Act, and sector-specific mandates (healthcare, finance, defense) increasingly demand that sensitive data never leave the device or jurisdiction. This talk presents a working architecture that squares the circle: run frontier-class SLMs (Phi-3 Mini, Gemma 2B) locally via Meta's ExecuTorch runtime on Android, while using Anthropic's Model Context Protocol (MCP) as the orchestration layer that decides what runs where, which tools the model can access, and what data governance policies are enforced — all without a single byte of PII hitting an external server.