MCP Dev Summit Mumbai 2026

**Space Limited - First Come, First Served.  Please bring a fully charged laptop to the workshop**

Enterprise adoption of the Model Context Protocol is accelerating — but the path from "MCP works on my laptop" to "MCP running securely across our organization" is windy and challenging.
Building MCP servers isn't particularly hard. The real challenges are OAuth, identity sprawl, and the governance requirements your security team will eventually land on your desk.
MCP servers should focus on tools, resources, and prompts — not rebuilding OAuth infrastructure from scratch every time. A dedicated identity and governance control plane absorbs that complexity once, rather than forcing every server to solve it independently.
In this workshop, we will:
1. Demonstrate how to integrated MCP servers with identity management tools
2. Show how to tailor MCP authorization by groups and policies.
3. Work through real governance scenarios by filtering MCP calls for PII or code injection.
4. Demonstrate how MCP traffic can be captured via an MCP gateway and used for compliance, monitoring and observability.

You'll leave with a clear picture of the architectural decisions ahead of you, and a better sense of what your security team is going to ask for before they sign off on scaling MCP adoption.

**Space Limited - First Come, First Served.  Please bring a fully charged laptop to the workshop**

As agentic systems evolve from single-step tasks to orchestrated workflows, maintaining structured, evolving context becomes a core engineering challenge. While Retrieval-Augmented Generation (RAG) improves access to information, most implementations treat the knowledge source as a static, read-only repository, making it difficult to capture relationships, causality, and decision history across sessions.

This hands-on workshop focuses on operationalising a context engine using MCP—showing how to build a system where agents can read, write, and reason over shared structured context.

Participants will work through a guided implementation to:

* Design a minimal context graph schema for a real-world workflow.
* Ingest and normalise data into a structured representation.
* Expose the context layer via MCP servers.
* Enable agents to query and update context through MCP tools.
* Persist reasoning state across sessions and agent boundaries.

By the end of the session, attendees will have built a working foundation for a context engine and understand how to evolve it into a shared context layer for multi-agent orchestration.

We design MCPs assuming idempotency, apply the same action twice nothing changes, reconcile repeatedly, and state is declarative.

But in reality, most MCP actions are only partially idempotent, because beneath the abstraction external systems mutate independently, side effects escape the control plane, ordering of operations matters, and “same input” doesn’t always mean “same result”. At scale, MCPs rely on many things like reconciliation loops, declarative APIs, retry-based execution.

We’ll unpack how MCPs unintentionally, violate idempotency through hidden side effects, depend on ordering guarantees that don’t exist, produce divergent states under retries, mask unsafe operations behind “safe” abstractions. This isn’t a talk about retries or Kubernetes patterns. There are no controller frameworks, just a deeper examination of why MCPs aren’t as safe as we assume, and how to design them with fewer hidden risks.

Because the most dangerous systems aren’t the ones that fail.
They’re the ones you believe are safe to retry.

The dominant observability pattern for AI agents today is layered agents: sidecars, daemon sets, exporters. Each adds blast radius.

This talk proposes flipping the model, using eBPF for zero-agent kernel telemetry, exposing it via MCP, and letting the LLM itself do the orchestration across tool calls.

I'll demo a concrete multi-tool MCP interaction: an LLM receives "why is this service slow?", autonomously calls get_recent_process_execs, correlates with get_active_connections, and follows up with get_high_syscall_latency, forming a causal chain from kernel truth to natural language diagnosis. No pre-scripted runbook. No human in the loop.

The talk goes deep on failure modes specific to this architecture: tool-call loops triggered by ambiguous latency signals, hallucination risk when eBPF data is sparse, and retry/fallback strategies when kernel probes detach under load.

We'll also cover how to design MCP tool responses that constrain LLM reasoning toward actionable conclusions, not just open-ended exploration.

Attendees leave understanding how to architect kernel-aware agentic systems that are genuinely production-safe.

In multi-step agent workflows, correctness isn't just about what the system returns, it's about how it got there.
An agent can claim "approval verified" without actually calling the approval service. The response looks valid, logs appear complete, and schema checks pass yet a critical step was skipped. This is process hallucination.
In financial and compliance workflows, skipping a required step isn't a bug, it's a violation.
Current testing approaches focus on outputs, not execution paths. As a result, these failures remain invisible until they cause real damage.
This talk introduces a Step Verification Layer, a deterministic check that validates whether required actions were actually executed, not just claimed.
By defining allowed sequences of actions and verifying execution against them, teams can detect skipped steps, invalid transitions, and silent process failures before they reach production.
A valid execution trace is not the same as a correct one. This talk is about verifying the difference.

The Model Context Protocol (MCP) is rapidly becoming the standard for connecting LLMs to data sources and tools. However, as organizations move from local experimentation to global production, the default JSON-RPC over HTTP transport hits a "scale ceiling."

gRPC is already establish as a go to library for transport for enterprise services as it provide high throughput and better performance using protobuf and HTTP/2. gRPC has Service Mesh Integration, Observability, Enterprise security and many more features, which can be leveraged by the MCP Server and Clients.

This session show case a demo of using MCP with gRPC transport.

Securely database connections in MCP based Agentic applications has become a critical challenge. Traditional approaches for connectivity introduce risks such as prompt injection, over-permissioned access, and lack of observability.

This talk introduces the Model Context Protocol (MCP) Toolbox for Databases, an open-source framework that standardizes how AI agents interact with data systems. By treating database access as a structured, reusable, and secure set of tools, developers can enable agents to perform meaningful operations while maintaining strict control over data exposure. Toolbox secures your agentic workflows for resources or tool executions
by acting as an OAuth 2.1 Resource Server that validates JWT Bearer tokens from your OIDC provider.

Through a real-world case study, we will demonstrate how to build an intelligent agent that combines semantic vector search with transactional workflows like inventory updates and cart management, all powered through a unified MCP configuration.

So join us to learn how MCP enables scalable, high-performance agentic architectures using efficient connection pooling, without compromising on security, observability, or control.

Multi-agent MCP systems work beautifully in staging. They fail in production. We learned this the hard way: three agents, nine tools, accuracy that quietly degraded under real load, and a job that blew past its token budget before anyone noticed.

We weren't alone. Google DeepMind and MIT's December 2025 paper "Towards a Science of Scaling Agent Systems" measured up to 17× error amplification in naive multi-agent setups and found coordination yields negative returns past a saturation threshold. Separate work (MAFBench, 2025) shows framework design choices alone can cut planning accuracy by 30% and collapse coordination success from over 90% to under 30%. Most MCP deployments hit this wall and misdiagnose it as a model problem.

This talk walks through three failure modes - Infinite Loop, False Consensus, Silent Fallback with message traces, token costs, and detection times. We then introduce the "topology contract": a lightweight JSON schema embedded in MCP server metadata, compatible with the 2026 Server Cards roadmap. Additive to the spec, zero protocol changes.

Attendees leave with a reproducible benchmark suite and a schema they can adopt in an afternoon.