AGNTCon + MCPCon Europe 2026

When an MCP server calls an API server requiring an access token in a different domain, elicitation in URL mode is defined by the MCP. Furthermore, token exchange is also used in real-world use cases. We describes the security and operational issues associated with these two methods and proposes solutions.

Elicitation in URL mode may cause user swapping. Moreover, even if an authorization server performing the initial authorization securely perform it by following MCP spec, the well-known attacks may succeed if the other authorization server performing the external authorization does not care about security.

Token exchange may cause information leaks, fraudulent access token use, and availability problems.

In both methods, there are two access tokens: for accessing the MCP server, for accessing the API server. To detect user swapping, it is needed to ensure that both users bound with the first and second token are the same. However, even if the same user registered in both different domains, their user identifiers are usually different. Therefore, simply matching them exactly is not effective.

We describe these issues and propose their solutions.

Enterprise AI agents are moving from demos into production, and auth is becoming a blocker. Demo agents can connect to tools with OAuth, but real enterprise agents may need SaaS services for thousands of employees. Per-user, per-service consent does not scale.

This session explains ID-JAG, the Identity Assertion JWT Authorization Grant pattern behind MCP's Enterprise-Managed Authorization extension. ID-JAG turns an existing SSO login into centrally governed, auditable access to approved MCP servers, without repeated OAuth prompts.

We'll cover the production problem, protocol flow, and lessons from implementing ID-JAG support in Archestra, one of the first MCP clients to support it. We'll also discuss what identity provider support enables.

Attendees will leave with a model for production agent auth: one SSO login, centralized policy, scoped MCP-native access tokens, fewer consent screens, and a cleaner security review story.

We'll close with the missing piece: SaaS provider adoption. To unlock enterprise deployments, authorization servers need to support this flow so agents can access approved business systems without key-sharing, manual credentials, or one-off integrations.

Drawing from lessons of how to scale an enterprise to thousands of microservices, we make the case that pushing concerns to the infrastructure for agentic systems should be a no-brainer when planning to scale agentic systems.
This talk explores how Zalando tackled this challenge by building and open-sourcing our own agentic identity broker as part of our broader agentic platform initiative. We will share how it supports delegation chains across third-party and in-house applications, integrates with the CNCF project agentgateway and how it allows us to keep these pesky authentication / authorization concerns on the infrastructure and keep MCP servers and agents simple.
We will dive into the technical mechanics, how it integrates into a larger enterprise and allows us to apply just enough governance to stay ahead of the game. We will cover practical applications and limitations of dynamic client registration.
A closing outlook will illustrate how tool approvals and human-in-the-loop can be enforced centrally without agent authors or MCP authors having to build anything. Practical examples of CIBA and intent-based access will complete the session.

MCP Apps are the last piece in moving toward a new web - one that's "nearly" headless. Autonomous agents, not humans, will interact with most websites through MCP, APIs, and other data channels. Websites and browsers become obsolete, replaced by personal assistants that orchestrate tasks on our behalf. In rare cases, agents will fall back to browser capabilities to navigate sites that aren't yet agent-ready.
But we'll still need the last mile.
Some moments still require human eyes and human input: choosing a seat at a venue, completing a check-in, reviewing a 3D model, verifying intent on important decisions. This is where MCP Apps come in - letting tools, websites, and services send composable, interactive chunks of UI directly to agents, exactly when needed, maintaining brand and identity.
We'll explore the full cycle of this nearly headless web: the infrastructure required to support autonomy and trust, the new UI layer, and how assistants are becoming the new browsers.
MCP Apps redefine the web's interface. Headless, but with a human eye at the end.

As MCP servers multiply, the ecosystem is hitting the fragmentation problem APIs hit a decade ago: every server is a point-to-point integration with no shared way to discover or describe it. Live introspection over a connected session does not scale to the catalogs, registries, and gateways that need to reason about thousands of servers without starting each one up. Open Resource Discovery (ORD) solved this for APIs, events, and data products. Each resource publishes a static, machine-readable description at a well-known endpoint. Aggregators crawl those descriptions and build catalogs that registries and gateways can query without connecting to the resource. Recent ORD work applies the same shape to agents and the MCP servers they depend on, scoping the dependency to the tools and prompts an agent uses. The same pattern fits MCP. The talk walks through a Server Card design that serves tools, prompts, and resources alongside metadata from a well-known endpoint, so registries and gateways can reason about a server before any agent connects. The design has been contributed into the open MCP community via SEP-2127, with a public renderer and playground demonstrating it end-to-end.

Spotify’s workforce went from zero to near universal use of MCP servers in breakneck time. It was only possible due to the MCP gateway - custom code written in a weekend to support the urgent need to expose Spotify’s extensive internal API ecosystem to AI agents.

The MCP gateway rapidly became a victim of its own success; multiple teams were committing significant changes to the codebase, and domain ownership and on-call support for the gateway were somewhat uncertain. From a sustainability perspective, the MCP gateway was becoming a big risk.

In this talk you’ll learn how Spotify successfully rebased its highly custom MCP gateway use case onto OSS technologies, while retaining deep integration into Spotify’s infrastructure management plane, service discovery, and microservice ecosystem. Hear how kgateway, the Envoy proxy, kro, and the Gateway API were used to build the new MCP gateway, enabling it to be better sustained by the right teams contributing their specific expertise.

Agents increasingly draw on specialized human knowledge at inference time, and the infrastructure delivering it is converging around Skills, MCP, and very often a mix of the two. That makes these standards a decision point: provenance either travels with the knowledge or its absence becomes the default.

The MCP community is standardizing two complementary efforts: Interceptors (deterministic hooks in clients, servers, and gateways) and how, why, and when to serve Skills over MCP. This talk shows how the two fit together to standardize attribution for human expertise and other content encoded as Skills and related inference-time formats.

The talk showcases two examples:
- An attribution gateway that validates and records authorship in a centralized control plane
- A standardized client-side hook to log and credit authors when Skills are invoked

Almost every observability project and vendor has shipped an MCP server in the past year.
Prometheus, Jaeger, and OpenTelemetry sit next to Grafana, Datadog, Honeycomb, Polar Signals, and a long list of others. This talk puts a few dozen of them side by side: how they handle transport, auth, tool design, and read/write access, and which ones do something genuinely interesting.

The data is what makes observability hard. Time series, distributed traces, and profiles are dense, high-cardinality, and deeply nested, and wrapping a JSON API in a few tools doesn't make any of that easier for an LLM to read. We'll look at how different servers represent these
signals, and what makes one format easy for a model to reason over while another just fills up the context window. We won't be proposing a new standard. The goal is to surface the best implementation patterns the industry has already converged on, so the audience can judge which observability MCP server to adopt (or build a better one themselves).

Join Jeremiah Lowin (Fast MCP), Shaun Smith (fast-agent) and Sam Morrow (GitHub MCP) for a panel on the challenges and opportunities of shipping MCP, hosted by Angie Jones, VP of Developer Experience at the AAIF.

By bringing perspectives from server, SDK and agent harness developers together in the same panel, you’ll see where their experiences align, l where they diverge, where they see the protocol heading and what they’re excited about.