AGNTCon + MCPCon Europe 2026

AI models are becoming a commodity. GPT-4, Claude, Gemini.  Pick one, swap it next quarter, and the differentiation has already moved on. What hasn't moved is context: the data an agent can actually reach. Most of today's MCP ecosystem wraps the easy 80 percent.  SaaS APIs, ticketing systems, chat platforms, anything that already had a REST endpoint. The other 20 percent: legacy databases running since the 1980s, CAD/BIM/GIS formats, real-time sensor and SCADA feeds, regulated records that legally can't leave the building, and hybrid environments split across cloud and on-prem by design,  still have no real path to an agent. In most enterprises, that's exactly where the decision-relevant data lives. 
Drawing on 32 years building spatial and enterprise data integration, this talk looks at what it actually takes to expose hard, hybrid, and on-prem data as MCP tools: treating data workflows as callable tools instead of one-off scripts, separating the control plane (what an agent is allowed to call) from execution (where the data actually lives and stays), and building both directions, consuming MCP tools and exposing your own, without hardwiring to one model or vendor. 

In one year, agents went from unable to pay for anything to spoiled for choice. x402 (Coinbase, now Linux Foundation) for machine-to-machine. AP2 (Google, donated to the FIDO Alliance) for signed payment mandates. ACP (OpenAI and Stripe) for checkout. MPP (Stripe and Tempo, launched March 2026) for streamed micropayments against a pre-authorized session. Four protocols, four layers, real volume.

What none of them owns is the part that decides whether an agent is allowed to spend this, now, on this. MCP returns HTTP 402 inside a tool call, but it has no concept of a budget, an attribution, or an audit trail. The vendor bolt-ons are already multiplying and fragmenting.

And the question stopped being academic. US regulators now treat agent purchases as ordinary card transactions, Europe is moving to put liability on whoever deployed the agent unless they can produce the mandate and audit trail. The receipts are now a legal requirement with no standard home.

This talk maps the four-protocol stack, shows the MCP payment handshake live, and argues for the one layer the agent economy is still missing.

Enterprise mainframe systems often contain large amounts of unused and unreachable code, increasing complexity and risk. Safely removing this logic is difficult due to deeply interconnected execution paths.

In this session, I present a real-world case study where we delivered large-scale dead code remediation into production with zero incidents using an MCP-powered agentic AI approach.

We developed specialised AI agents, backed by Python tooling, to analyse code, detect unused logic, and support safe, auditable remediation with human validation. This reduced analysis time from days to under an hour per program.

The same approach was extended to business knowledge enablement using a reverse engineering agent, generating structured context integrated into Copilot Spaces, enabling finance teams to query system behaviour using natural language.

Learn how agentic AI can safely modernise legacy systems and bridge developer and business understanding.

We promised our CX team an agent that would write customer success plans. Six months and four architectures later, we shipped a compiler that calls LLMs in four places.

Each architecture was the right fix for the previous one's failure. The single skill could not enforce quality. The subagents drifted across stages. The scripted prompts hit determinism walls. Only when we accepted that "agentic" was the wrong frame did the output become reviewable, replay-able, and trustworthy enough to ship to real customers.

The talk is a tour of the architectural moments where we learned what LLM-driven systems can and cannot own. Specific failures: a real customer plan shipped with the wrong rows, a quality firewall the LLM kept violating until we made it structural, and "temperature=0" arriving as a footnote rather than a solution.

You leave with three things. A maturity curve from skill to engine. A working distinction between pipeline work and agent work. And a vocabulary for the conversation with stakeholders who keep asking when the agent will be ready, when what they actually want is a compiler with an agentic UI.

Every agent framework reinvents context management differently: scratchpads, artifacts, or memory stores. This creates distinct storage problems (system config, user memory, thread scratch, task state, shared workspaces, external data, and inter-agent messaging) collapsed under "agent context", with no shared vocabulary and a lack of interoperability.

In an attempt to close this gap for the industry at large, we present a production architecture that models agent context as scoped virtual filesystems. Agents interact through standard filesystem tool calls (read, write, and list), while the agentic AI platform enforces scope, lifecycle, and access control per mount.

The talk covers three layers. First, scoped state: how four filesystem scopes (system, user, thread, and task) compose across collaborating agents, using file modes and mount isolation to prevent cross-scope leakage. Second, external data as mountpoints: turning retrieval into navigable directory trees with ls/cd/cat semantics instead of opaque vector search. Third, protocol implications: how this maps to the MCP spec today and the case for filesystem operations as a first-class agent interoperability primitive.

This is the EUDI Wallet architecture, running inside an agent, 18 months before the Dec-2026 mandate.

Every "agent that verifies you" or "agent that pays" demo skips the hard part: how does an AI agent request a real, government- or bank-grade credential from your device, on any phone, any wallet, Android or iOS, and prove who authorized it?

We'll run the full chain live. An MCP server renders a verifier inside Claude and ChatGPT; the W3C Digital Credentials API requests a credential over OpenID4VP; FIDO caBLE carries it cross-device to your phone; the wallet returns an mdoc or SD-JWT credential held in hardware (StrongBox, TEE, Secure Enclave); an AP2 mandate binds your intent.

Identity is the headline, age, membership, passport, healthcare, with payments as one example. And it's not a stage trick: it's an open-source Digital Credential MCP server, soon to be released and donated, that you can clone, point at your own credential, and ship. Built on open standards, across every platform, with UCP & ACP conformance on the roadmap.

Here are some examples of the demos we're planning to showcase: https://github.com/dzuluaga/mcp-apps-shopping-demo

A three-layer evaluation strategy for AI agents and their tools, from experience operating across multiple LLM providers and runtimes.

Offline evaluation: designing benchmark suites with curated requests, expected tool selections, and arguments. Computing precision, recall, F1 scores, confusion matrices for tool mix-ups, and argument hallucination rates to pinpoint description problems.

End-to-end benchmarks: multi-tool flows where the agent chains several calls to complete a task, catching integration regressions that single-tool evaluation misses.

Production A/B experiments: a case study of tool search experiments across OpenAI and Anthropic through staged rollouts. Challenges we hit: caching bugs under real traffic, tool discovery failures, and data skew making early results inconclusive. How we decided whether to advance, pause, or roll back.

These layers compensate for each other's blind spots, forming a testing pyramid that enabled us to safely ship changes to MCP and agent across model providers. Attendees leave with a reusable playbook for testing MCP servers, agents, and running A/B experiments.

The AI ecosystem suffers from a critical engineering immaturity: deploying stochastic models via manual "vibe checks." Operating autonomous agents at enterprise scale requires abandoning ad-hoc observation for strict, distributed systems rigor. This session introduces a deterministic, CI/CD-native evaluation architecture for Agent Skills, shifting from indeterministic to reliable software execution.

By adhering to the formalized capability standards defined by agentskills.io, we will deconstruct the transition from subjective testing to hermetic, code-driven audits. Attendees will learn to engineer scenario matrices that enforce strict cognitive boundaries via negative testing—guaranteeing agents safely reject out-of-scope triggers. We will demonstrate isolating execution within sandboxed environments to capture pristine telemetry: deterministic tool-call structures, system exit codes, and exact token utilization.

Crucially, we address the anti-pattern of relying on "LLM-as-a-judge" for critical path assertions. Instead, we architect a framework grading system invariants via AST parsing and JSON Schema enforcement to achieve instantaneous, hallucination-immune evaluation.

Frontier labs are spending billions making agents better at SWE-Bench. But how much of your engineering work actually looks like SWE-Bench? At Datadog we kept seeing agents that crushed public benchmarks fail on our codebase: missing our conventions, reaching for the wrong internal libraries, technically correct but doing the work the wrong way.

To get past demos and gut feel, we built an evaluation platform that measures agents on tasks drawn from our real work, and gave our platform teams a way to encode best practices as evals. Teams shipping skills, steering docs, agent harnesses, and MCP servers can now see whether their changes actually moved the needle.

In this talk I'll share how SOTA and open-weight models actually compare on real work, what their cost-performance profiles look like, tooling decisions that can shift token usage by 10% or more, and how a surprisingly small eval suite can produce stable signal.

You'll leave with a clearer way to think about model choice as a tradeoff between performance you actually need and tokens you're willing to spend, and a sharper sense of what makes an eval keep paying off over time instead of becoming a one-off exercise.

AI can generate a week’s worth of code before lunch and just as quickly ship SSRF, RCE, and path traversal vulnerabilities into prod. Rules and “/security-review” prompts aren’t enough: they’re costly, brittle, and non-deterministic. Run them three times, get three answers. Meanwhile, who vets hallucinated npm packages as the agent installs them? Oh you’re running the agent with “--dangerously-skip-permissions”? Color me surprised, sigh.

Well the good news is you don’t have to trade speed for security, let me show you how. This talk shows a concrete, developer-first pattern: learn how to use MCPs & Hooks to give agents real security superpowers. We’ll wire in just-in-time package health checks and deterministic code reviews via pluggable AI components, with clear contextually engineered details for your agent. You’ll leave with a better understanding of the security dangers relying on agentic coding tools alone and a reliable and deterministic agentic workflow to make AI coding fast and safely shippable.

What does it take to let AI agents run a real business? Before handing over an entire restaurant, our team started with something much smaller: a network of vending machines.

In this session, we'll share what we've learned by giving AI agents responsibility for real world operational decisions, including pricing, inventory management, and marketing. The vending machine serves as a practical testbed for exploring how autonomous organizations behave under real customer demand, where mistakes have real consequences but the risks remain manageable.

We'll discuss how this work evolved from simulated restaurant environments into live deployments, what worked, what failed, and why small scale experiments are the fastest path toward larger autonomous operations. We'll also look ahead to the next phase, including autonomous restaurants and the role robotics may play.

Attendees will leave with a practical framework for experimenting with autonomous organizations, along with lessons learned from taking AI agents out of the lab and into the real world.

H Company is the leading agentic AI startup in Europe, based in Paris, specialized in computer use.

The AI landscape is shifting rapidly from passive text generation to active execution. The frontier belongs to Agentic AI, systems that don't just chat, but autonomously navigate digital environments to complete complex workflows.

At H Company, we bridge this gap between frontier research and production-grade deployment. We will explore how H Company built Holo3, our state-of-the-art model family designed specifically for "Computer Use" (GUI perception, planning, and OS navigation). Moving from theory to practice, we will demonstrate how these compact, high-efficiency models power our latest enterprise tools—including HoloTab, our autonomous AI browser companion. Finally, we will unpack the unified infrastructure model required to train, deploy, and scale these agents securely across multi-cloud environments.