MCP Dev Summit Toronto 2026

Registration

Registration · Oct 5, 2026 · 07:30–17:30 local time; timezone inferred

Keynote: Welcome

Keynote · Oct 5, 2026 · 09:30–09:40 local time; timezone inferred

• Angie Jones

Keynote: Den Delimarsky

Keynote · Editorial classification · Oct 5, 2026 · 09:40–09:55 local time; timezone inferred

• Den Delimarsky

Keynote: Den Delimarsky, Lead Maintainer, MCP, Anthropic

Keynote · Oct 5, 2026 · 09:40–09:55 local time; timezone inferred

• Den Delimarsky

Keynote Session to be Announced

Keynote · Oct 5, 2026 · 09:55–10:05 local time; timezone inferred

One Year of MCP in the Enterprise: Registry, Workflows, Agents, and Remote Hosting

Keynote · Oct 5, 2026 · 10:10–10:25 local time; timezone inferred

Let us show you what a full enterprise MCP practice looks like end to end, built at TELUS over the past year. The tour: IRIS, an n8n-based AI operations agent exposed as an MCP server — with a Slackbot front end — that routes real operational requests; n8n workflows that call MCP tools to automate the boring parts of running a platform; a shared "ai-dev" registry that catalogs the MCPs most useful across the org, so teams discover and reuse instead of rebuilding the same connector multiple times; and finally remote MCP hosting on Gizmos, our last-mile platform built on Cloudflare Workers — plus the OAuth wall every enterprise slams into. Dynamic Client Registration is the usual answer, and the usual disappointment; we'll cover why we went with Client ID Metadata Documents instead, and the tradeoffs behind that call. No product pitch — reusable patterns for any stack. You'll leave with a map of the whole enterprise MCP stack — registry, workflow automation, agent front ends, remote hosting — the failure modes we hit, and where the spec and tooling are still rough.

• Dana Harrison
• Kevin Ng

Break

Break · Editorial classification · Oct 5, 2026 · 10:26–10:50 local time; timezone inferred

From CRD to Tool Call — Lifecycle, Gateway, and Catalog Patterns for MCP on Kubernetes

Not classified · Oct 5, 2026 · 11:00–11:25 local time; timezone inferred

MCP servers are proliferating, but the infrastructure to deploy, discover, and route to them on Kubernetes remains fragmented especially for enterprise AI platforms where multiple teams need self-service access to curated tools, governed by policy and isolated by tenant. This talk presents three building blocks that together form a complete MCP server lifecycle on Kubernetes, drawn from our experience building a multi-tenant MCP ecosystem on an enterprise AI platform. Lifecycle: A declarative CRD for MCP servers giving platform teams a single resource to manage deployment, health validation, and safe rollouts Gateway: Approaches to tool aggregation, JSON-RPC-aware routing, and auth enforcement between clients and upstream servers. Catalog: Patterns for making servers discoverable, from lightweight Kubernetes-native approaches to dedicated registries and how catalogs feed into both lifecycle and gateway. Integration: The hardest problems live at the boundaries. We'll ground these in lessons from wiring these components together across multiple tenants and personas, sharing patterns that worked, friction points that didn't, and what the ecosystem needs to standardize next.

• Calum Murray
• Jaideep Rao

From Prompt to Production Dashboard: Agentic AI with MCP Servers and Live Data

Not classified · Oct 5, 2026 · 11:00–11:25 local time; timezone inferred

What happens between a user typing "Show me AR aging by customer" and a fully interactive dashboard appearing on screen? This talk pulls back the curtain on a production agentic system that turns natural language into deployed dashboards — complete with KPIs, charts, and filterable tables — powered by live enterprise data. At the core is a ReAct agent loop that reasons about data needs, discovers available tools at runtime, and iterates through up to 10 cycles of thought-action-observation to produce a structured DashboardSpec. The agent connects to enterprise ERP data through MCP (Model Context Protocol) servers, an open protocol for dynamic tool discovery across multiple transports (SSE and Streamable HTTP), with a Redis caching layer that cuts repeated query latency by 50x. The architecture is built on portable, open technologies: LangGraph for agent orchestration, FastAPI for the service layer, and Strawberry GraphQL for the subscription API. This is a live demo talk. You'll watch the system handle ambiguous prompts, recover from MCP server failures, and validate outputs through structured tool schemas.

• Rohit Deshpande
• Scott Young

Sessions Are Dead. Now What Breaks?

Not classified · Oct 5, 2026 · 11:00–11:25 local time; timezone inferred

On July 28, the MCP spec removed server-side sessions entirely. If you maintain an MCP server, this probably already broke something for you (or it will when your users update their clients). I spent three weeks going through the 2026-07-28 spec diff line by line and mapping every change against the tool handler patterns in 100+ MCP servers I'd already audited with MCPeek. The short version: SSE streaming is gone (replaced by Streamable HTTP, which handles long-running tool calls differently), servers can no longer hold conversation context between requests, and OAuth token binding without session affinity is genuinely harder than the spec changelog makes it sound. That last one is the thing I see nobody talking about yet. This talk is the migration guide I had to write for myself. Each breaking change comes with the code diff in both the TypeScript and Python SDKs and the migration path I'd recommend.

• Akash Sathish

Workshop: From Zero to Production MCP Server: Turn Any API Into an Agent Tool

Workshop · Oct 5, 2026 · 11:00–12:25 local time; timezone inferred

Most MCP demos stop at hello world. Then you try to wrap a real system at work and hit everything the tutorials skip: authentication, secret handling, deciding which actions an agent may take, and what happens when a tool call fails. This session closes that gap. Starting from an empty editor, I'll build an MCP server live with FastMCP in Python, wrapping a small FastAPI service that stands in for an internal company API, then harden it into something you'd actually deploy. We'll cover authenticating the server, keeping secrets out of the model's reach, scoping dangerous actions so an agent can read without being able to delete, and handling failures so one broken call doesn't derail the agent. We'll test it live with MCP Inspector. You'll leave with a clear mental model and a practical checklist for exposing your own systems to agents over MCP. The patterns are shown in Python with FastMCP and portable to any official MCP SDK.

• Kaan Turgut

One MCP to Rule Them All!

Not classified · Oct 5, 2026 · 11:30–11:55 local time; timezone inferred

Most MCP authors have figured out that one-tool-per-endpoint is a dead end. The smart ones now compress dozens of endpoints into a handful of well-designed tools. That's real progress. But the bloat just moved up a level. If your agent needs to do real work, it ends up loading five, ten, twenty MCP servers - and the tool list is bloated again, one floor up. The way out is one MCP that can reach anything. I'll show how: a single server backed by search + execute over an embedded OpenAPI spec, with Keycard handling identity end-to-end. Because the upstream APIs are already protected by Keycard, the auto-generated MCP can safely reach all of them - RFC 8693 token exchange, per-operation scopes pulled straight from the spec, Cedar policies for who's allowed what. Zero upstream secrets on the server. The first call is a bit slow - the agent has to search the spec and figure out the shape. But the MCP ships with a skill, so the agent learns how to call it once, then every call after skips the discovery and goes straight to execute. Over a session it gets faster, not slower. One MCP. Any API. Real identity. Skills that compound.

• Jerric Lyns John

When MCP Agents Break Production: Failure Patterns from 20,000 Tool Invocations

Not classified · Oct 5, 2026 · 11:30–11:55 local time; timezone inferred

We deployed an MCP agent to investigate seller support issues across 8 AWS accounts. In its first month: 20,000+ tool invocations, investigation time reduced from 10 minutes to 30 seconds. Then a single input validation regex in our tool pipeline silently zeroed inventory for 70+ sellers — a Sev-2 incident caused by the system designed to protect them. This talk covers three production failure patterns unique to multi-tool MCP architectures: (1) Validation boundary mismatches - when tool-level schemas disagree with upstream data formats, creating silent data corruption. (2) Credential scoping in multi-account routing - how we handle 8 AWS accounts with one agent session without cross-tenant leakage. (3) Observability gaps at the transport layer - why our agent's reasoning traces missed the failure (it happened in API Gateway VTL, outside the MCP tool boundary) and the anomaly detection patterns we now enforce. Built with MCP's open protocol, running against Bedrock. No vendor pitch - just patterns, anti-patterns, and the three rules we'd enforce from day one if we started over.

• Nidhi Singh

Skills-as-Packages: A Package Manager for AI Agent Skills

Not classified · Oct 5, 2026 · 12:00–12:25 local time; timezone inferred

As AI agents proliferate across organizations, from coding assistants to autonomous workflows, teams face a critical infrastructure gap: there is no standard way to version, scope, and distribute agent skills and MCP configurations across teams. Today, one developer builds a powerful set of skills; the rest of the team copies from a Notion doc. Skills evolve bidirectionally (at source and point of use), creating drift that no existing tool resolves. This session introduces an open-source architecture for a unified skill registry that operates as both an npm-like CLI for developer workspaces AND an MCP server for runtime agent resolution. We'll cover the declarative requirements.yaml format that lets teams describe intent rather than write full skill packages, namespace-based scoping (@org → @team → @personal) with version inheritance, and how the resolution algorithm works in multi-agent (ACP) systems. Live demo included.

• Brahada Srinivas

Testing Compositional MCP in Zero Trust

Not classified · Oct 5, 2026 · 12:00–12:25 local time; timezone inferred

MCP is designed for composition, but composition creates a security gap: individually permitted calls can together violate user intent, amplify authority, or move sensitive data to an untrusted server. This session presents a vendor-neutral, zero-trust verification method for composed MCP systems. It complements MCP authorization by checking not just each call but the entire end-to-end plan. Using a three-server example, I will show how to represent delegated identity, capabilities, policy snapshots, data provenance, side effects, and evidence. We will test global invariants: authority never grows across hops; capability is not permission; tokens are audience-bound; restricted data cannot reach an unapproved sink; every effect has a prior decision; retries and partial failures remain safe; and the run is replayable. An intelligent layer generates adversarial compositions and prioritizes risky paths, while deterministic policy and evidence checks remain the root of trust. Attendees leave with compositional questions, a zero-trust test matrix, and a conformance workflow for MCP hosts, clients, gateways, and servers.

• Shakthi Bachala

Lunch

Break · Editorial classification · Oct 5, 2026 · 12:25–13:55 local time; timezone inferred

Building a Regulatory Knowledge MCP

Not classified · Oct 5, 2026 · 13:55–14:20 local time; timezone inferred

Chopping municipal regulations (or other highly structured content) into flat chunks for RAG just gives you a fancier search engine, no matter how many dimensions the embeddings have. But regulations carry meaning in their structure and cross-reference: a subsection means nothing without its parent, the definitions it leans on, the sections that reference it, and who enforces it. We'll walk through our development of an MCP server that helps AI agents understand Washington D.C.'s Municipal Regulations through a property graph. We modeled the corpus with several different kinds of node and edge types to map hierarchy, entities, entities, authorities, and more. What makes the graph useful for an agent are intent-specific tools: resolving a citation, finding similar entities, showing areas of accountaibility, and so on. We'll be honest about how entity extraction and community-building really went; what worked and what very much didn't. We'll share lessons for anyone exposing graph data via MCP, and demonstrate queries that plain RAG gets wrong and the graph gets right.

• Andrew Nicklin
• Maeve Mulholland

Making MCP Work Better in Small Models: Tool Calling Improvements and Context Methods for SLMs

Not classified · Oct 5, 2026 · 13:55–14:20 local time; timezone inferred

While the Model Context Protocol (MCP) has seen strong enthusiasm and rapid iteration in the developer community, translating that success into broader industry adoption, particularly among small and medium enterprises, remains a major challenge. Many SMEs run AI agents locally to keep sensitive data on premises. These deployments typically use mid-sized open-weight models in the 8B to 32B parameter range. In practice, tool calling and MCP performance degrade sharply for these models under realistic contextual overload. In this session we present a systematic benchmarking study of tool calling and MCP behavior across multiple models. We evaluate performance on two benchmarks: τ²-bench and CEO-Bench. A key finding is that introducing standardized MCP OAuth and RBAC alone improves task completion accuracy by over 60%. We also demonstrate how combining MCP with skill and routing LLMs, together with targeted context engineering techniques such as context cleaning and context mutation, significantly boosts overall reliability, reduces tool-use errors in multi-turn scenarios, and markedly improves interpretability.

• Dheeraj Pai
• Lu Xian

Going Stateless: Scaling MCP Servers to the Cloud Native Java and HTTP

Not classified · Oct 5, 2026 · 14:25–14:50 local time; timezone inferred

Join us for a deep dive into the evolution of the Model Context Protocol (MCP) as we explore the shift from stateful, session-heavy architectures to stateless, cloud-native deployments. In this session, we will examine how the latest updates to the MCP specification introduce a stateless HTTP foundation, enabling MCP servers to function as lightweight, independent microservices. We’ll discuss the operational advantages of this paradigm shift, including simplified load balancing and the ability to scale down to zero when traffic stops. Additionally, we will demonstrate how combining this stateless architecture with cloud-native Java—specifically using Quarkus—creates the ultimate stack for high-density AI infrastructure. You’ll learn how to leverage Ahead-of-Time (AOT) compilation and reactive routing to build highly specialized, memory-efficient MCP tools that start instantly. Whether you are building database-lookup tools or internal API proxies, you'll walk away with the knowledge to design predictable, scalable, and reliable AI systems for enterprise production environments.

• Daniel Oh

Poisoned by Design: Auditing MCP Tool Descriptions at Catalog Scale

Not classified · Oct 5, 2026 · 14:25–14:50 local time; timezone inferred

The MCP spec defines a tool's description as nothing more than "human-readable description of functionality." That's it. It's free text, and the model reads all of it. Annotations get an explicit warning to treat as untrusted; description doesn't - it happens to be exactly the field tool poisoning attacks target, hiding instructions in that text for an agent to follow with no sanitization or provenance check. At WRITER, we ended up solving this the same way we solved a completely unrelated problem: bad descriptions hurting tool selection. Both come down to running an LLM over the whole catalog in batches, not one call per tool, so checking most of it stays cheap. When a batch flags something, we go back and check each tool in it individually. One classifier scores descriptions and pulls in live web search to rewrite the weak ones. The other flags likely poisoning. Batching creates its own attack surface: a bad description can go after the batch prompt itself. Newlines forging fake catalog entries. Padding to blow past a fixed character budget. I'll walk through those failure modes, the fail-open vs fail-closed call we made, and where detection stops and enforcement takes over.

• Kapil Duraphe

The Hidden Cost of Fewer Tokens: Interface Lessons from Playwright

Not classified · Oct 5, 2026 · 14:25–14:50 local time; timezone inferred

The Playwright MCP and CLI expose the same tools with different interfaces, making for an useful side-by-side comparison. I’ll walk through an investigation that began as a runtime performance benchmark and led to a stranger result: “context-inefficient” interfaces like the Playwright MCP can make agents faster, more accurate, and less expensive. I compared the Playwright MCP, CLI, and agent-browser across QA scenarios. To my surprise, agents with the MCP were consistently 2-3x faster than the alternatives. The alternatives focus on token efficiency as their raison d'être, and do consume dramatically fewer tokens. They achieve this by returning less information, which requires agents to make more tool calls before acting. Each tool call adds significantly to the runtime and the cost. The results don't tell us to choose MCP or CLI, but should inform interface choices for both. Concise responses save tokens, but if an agent needs that context, it pays for the conciseness with extra steps. This talk expands on https://outpost.ranger.net/post/the-hidden-cost-of-fewer-tokens/ , with more detail on the methods, results, and what they suggest for designing better interfaces for agents.

• Mikayla Thompson

Beyond the Protocol: The Agentic Stack Enterprises Say Is Still Missing

Not classified · Oct 5, 2026 · 14:55–15:20 local time; timezone inferred

MCP became the default way enterprise agents reach tools and data in barely a year. Will it last? For a Linux Foundation Research and Agentic AI Foundation study, we interviewed 22 leaders building and running agentic systems: open source contributors and enterprise operators in regulated industries across the globe.Almost all of them use MCP. Few agree on its future. Some think better models and skills will make it less necessary, and one retail Head of AI told us it might disappear altogether. They agreed more on what MCP doesn't cover: agent-to-agent communication, identity, and discovery, the layers that decide whether agents from different vendors can work together. Two patterns came up again and again: 1) A gateway sitting between agents and models for governance and cost control, and 2) guardrails enforced below the model rather than through prompts, since a model can't police the same channel used to hijack it. The recurring point: trust, not capability, is what separates a demo from something a company will actually run in production. I'll walk through what our findings mean for where developers should spend their effort.

• Hillary Curran

From Tool Calls to Revenue: Metering and Billing MCP Servers at Scale

Not classified · Oct 5, 2026 · 14:55–15:20 local time; timezone inferred

Building an MCP server is getting easier. Monetizing one is not. At first, usage-based billing looks simple: count tool calls, aggregate them monthly, and send an invoice. But once MCP servers move into production agent workflows, the definition of “usage” becomes much harder. Was that one tool call or ten? Should you bill for tokens, API calls, records retrieved, compute time, successful outcomes, or prepaid credits consumed? What happens when an agent retries, chains tools, streams results, or calls the same resource through multiple clients? In this session, we’ll dive into the infrastructure behind trustworthy metering and pricing for MCP-native products. We’ll cover how to design a billing pipeline that can: Count usage once and only once, even with retries, failures, and agent loops Handle high-volume event streams from MCP tool calls Give customers real-time visibility into current-period usage Support pay-as-you-go, prepaid credits, drawdown models, and hybrid pricing Preserve developer trust by making usage explainable and auditable

• Lior Mechlovich

What Can Your AI Agents Actually Do? Cedar Analysis for MCP Servers

Not classified · Oct 5, 2026 · 14:55–15:20 local time; timezone inferred

The MCP spec recommends servers not to reinvent the access control wheel. Now the question is: what OSS building block will emerge as the access control foundation of choice for the MCP ecosystem, to avoid fragmentation? The CNCF project Cedar Policy offers a declarative language and engine for attribute-, relation- and role-based access control policies, making it easier to audit, version, reason about and share policies across applications. ToolHive recognized Cedar's utility and uses it to enforce consistent access control across MCP servers. Cedar is grounded in mathematical logic, which means you can analyze, compare, and query policies themselves, not just evaluate them. Did your refactored policies change any decisions? Is an allow policy actually dead code, always overridden by a stronger deny? Who can access this resource? What can this agent do in the system? Could an AI agent exfiltrate private data to an external sink? These questions Cedar can answer statically and always correctly (unlike LLMs), across all your policies. After this talk, the audience knows how Cedar could be used to promote ecosystem-wide consistency, and how ToolHive already uses it in production.

• Chris Burns
• Lucas Käldström