AGNTCon + MCPCon Europe 2026

The session opens with the pre-deployment checklist, seven controls, no preamble, then walks through the evidence for why each one exists. This audience deploys MCP in production and needs to leave knowing what to do.

The empirical baseline: 30+ CVEs in 60 days. 24,008 secrets in public MCP configs. 85% attack success rate against major hosts (MCPSecBench, ICLR 2026). Reported as lower bounds with stated provenance.

Three attack classes, demonstrated with lab code. Tool description poisoning: exfiltrates an SSH key simultaneously. Cross-server shadowing: a trusted WhatsApp server weaponised by a malicious daily-facts server, end-to-end encryption intact. The rug pull: postmark-mcp, reconstructed.

The protocol gap analysis is the content specific to this audience. I show the SDK code implementing the flat namespace, the spec text that acknowledges the trust boundary but enforces nothing, then four protocol changes with concrete JSON-RPC schema diffs: today's schema, the addition, the attack class it closes. The finding that changes model selection: more capable models follow poisoned instructions more reliably.

No vendor tools. Source: github.com/aminrj-labs/mcp-attack-labs.