Testing Compositional MCP in Zero Trust

MCP Dev Summit Toronto 2026

Oct 5, 2026 · 12:00–12:25 · Timezone not confirmed

MCP is designed for composition, but composition creates a security gap: individually permitted calls can together violate user intent, amplify authority, or move sensitive data to an untrusted server. This session presents a vendor-neutral, zero-trust verification method for composed MCP systems. It complements MCP authorization by checking not just each call but the entire end-to-end plan. Using a three-server example, I will show how to represent delegated identity, capabilities, policy snapshots, data provenance, side effects, and evidence. We will test global invariants: authority never grows across hops; capability is not permission; tokens are audience-bound; restricted data cannot reach an unapproved sink; every effect has a prior decision; retries and partial failures remain safe; and the run is replayable. An intelligent layer generates adversarial compositions and prioritizes risky paths, while deterministic policy and evidence checks remain the root of trust. Attendees leave with compositional questions, a zero-trust test matrix, and a conformance workflow for MCP hosts, clients, gateways, and servers.

Session status: scheduled

Room: Terrace East + West

Track: Security, Identity + Trust

Level: Intermediate

Official session / agenda

Saving a session is not registration. Check the official agenda for availability, eligibility and any additional fees.

Speakers and their event affiliations

Parent event

In person · The Conference Centre at the University of Toronto, Toronto, Ontario, Canada

This describes the parent event. Confirm the session’s attendance requirements with the organizer.

Companies participating in the parent event

These are event-level relationships, not confirmed sponsorship of this session.

Showing 24 of 64 company relationships. View all on the event page.