46 talks, 7 themes, one fast way through the event — key takeaways, standout quotes, and every recording from MCP Dev Summit Seoul 2026.
Worth noting
Opening remarks for MCP Dev Summit Seoul: AAIF added Visa, Wells Fargo and Alibaba as gold members, and the community held seven global meetups celebrating the new MCP 2.0 stateless spec release.
Quote
We had lead maintainers giving talks. People are still talking about this today, the new release, right?
Worth noting
MCP SDK downloads hit 3.06B cumulative (28x last July), the registry has 20k+ servers, and SDKs grew from 2 to 10 languages, backed by Google, Microsoft, JetBrains.
Quote
We're at half a billion downloads a month... 3.06 billion downloads total for those three SDKs only.
Worth noting
MCP's July 28 spec update shifts it from stateful to stateless for enterprise-scale load balancing; a new "Agent Plugins 1.0" open standard lets coding-assistant plugins move across tools like Cursor, Copilot, and Codex.
Quote
Protocol compatibility is just the foundation at the bottom, not the ceiling at the top.
Worth noting
Announced the Agentic AI Foundation's upcoming MCP certificate launching next month, plus a wave of new regional MCP Dev Summit events and expanding podcast/YouTube content.
Quote
I'm going to just list off a ton of QR codes right now.
Worth noting
Workato advocates wrapping multi-step business logic (e.g., refunds) into single locked-down workflow MCP tools rather than exposing thin per-action MCP servers directly to the LLM, plus a central MCP registry/proxy for auth, logging and auditing across 14,000+ connectors.
Quote
AI가 결국 제대로 일하려면 시스템과 데이터가 연결돼야 된다는 문제점들 그걸 해결해야 되는 상황이 벌어지는 거죠.
Worth noting
Quote
잘 만드는 것도 중요하지만 잘 전달하는 것도 중요하다는 것을요
Worth noting
Preliminary Linux Foundation OSPO survey data shows 35% of organizations with OSPOs already co-lead AI governance initiatives, and 44% participate in related discussions.
Quote
Perhaps now the next frontier to scale this adoption and have more organizations across different industries implementing this is operational trust.
Worth noting
Proposes a decision checklist: use coding agents for uncertain exploration, versioned templates for stable methods, APIs for known contracts, workflow engines for state, and MCP only when multiple hosts need standardized discovery.
Quote
MCP is not the automatic next step after one useful result. It is an interface choice.
Worth noting
Combined 5 open-source projects (FastMCP, a custom Swagger→OpenAPI converter, a Kubernetes Operator, LangGraph/deepagents, langchain-mcp-adapter) to auto-generate MCP tools from OpenAPI specs, avoiding hand-coded tool functions per backend.
Quote
I will talk about how to transform from legacy to agentic AI.
Worth noting
Observe.ai rebuilt its voice-AI agent platform as Git repos (branches, PRs, diffs, blame) so MCP-driven edits get CI simulations/evals and reviewable rollback instead of direct production changes.
Quote
Can we like build agents as code bases, right? And basically what we get like all of the benefits that software development has like figured out and like solved for over the years.
Worth noting
Lablup demoed MCP Apps rendering live GPU cluster dashboards inline in a chat agent, letting operators query, inspect and delete idle sessions with clicks instead of navigating Backend.AI's dashboards.
Quote
MCP 앱스는 어떻게 보면은 LM이 말로만 설명할 수 있는 것에 화이트보드 같은 걸 지워 준다라고 생각하시면 됩니다.
Worth noting
Argues MCP doesn't cover idempotency or durable state; recommends idempotency keys tied to task IDs, optimistic version checks, and write-ahead "pending" status rows to prevent duplicate charges on retry.
Quote
A timeout does not always mean it's a failure. It's not about intelligence, it's about reliability.
Worth noting
Live demo showed a phone hosting its own MCP server (Flutter/Gemma) reachable via cable/iproxy from Claude Code, exposing calendar and device-info tools, but iOS restricts it to foreground-only.
Quote
So our mobile phone now playing a role of MCP server and you actually can provide any capability of mobile phone.
Worth noting
Instead of training a vision-language-action model (200+ failed demonstrations), the speaker built an 8-tool MCP server letting Claude Code directly command a $200 SO-101 robot arm via teleoperation-recorded coordinates.
Quote
What if we use MCP, that is you give an instruction to the robotic arm, there is an agent in between, and it calls a couple of tools via the MCP server, and it does the final action.
Worth noting
Panel of newly appointed Agentic AI Foundation ambassadors introduced AAIF's four founding projects (MCP, Goose, AGENTS.md, agentgateway) and fielded audience Q&A on adoption challenges like security and human-in-the-loop control.
Quote
An LLM can provide probabilistic information, but it cannot do deterministic tasks, and MCP enables you to do that.
Worth noting
Argues MCP needs two authorization checks—tools/list (discovery) and tools/call (parameter-level)—and that most teams only enforce the second, and poorly.
Quote
Denial is a signal. It's not a wall. When an agent actually sees denial, it's going to try something else.
Worth noting
Survey data cited: 80% of orgs ship agents unsecured, 90% run unmonitored agents, and Gartner projects 150,000 agents per Fortune 500 company by 2029.
Quote
You cannot review or permission a decision that doesn't exist until the moment it is actually made.
Worth noting
Proposes unifying API, LLM, and MCP gateways under shared OAuth2 identity, one observability pipeline, and one policy plane to avoid fragmented, ad-hoc agent traffic governance.
Quote
So your gateway thinks it's an attack but it's actually a paying customer and that's a shift.
Worth noting
Advocates combining STRIDE, MAESTRO and the OWASP MCP Top 10 for threat modeling, plus OAuth 2.1/PKCE, MCP gateways, SBOMs, and continuous re-validation to catch "rug pull" attacks on previously trusted servers.
Quote
MCP can be compared with USB-C, a standard for connecting agents, LLMs with services, but there is no security in it.
Worth noting
Their failover MCP server exposes only 4 scoped tools (3 observation, 1 "propose failover") that write to a CRD; a human must approve the state change before a Kubernetes operator executes the actual cluster migration.
Quote
Let AI decide what to recommend and let MCP define what the AI agent may request and also let Kubernetes decide what can actually execute.
Worth noting
Cites research that 72.8% of agent systems and 5.5% of 1,899 public MCP servers are susceptible to tool poisoning; recommends treating tool definitions, schemas and outputs as untrusted, verified via an MCP gateway with hashed/pinned tool lists.
Quote
Every tool definition should be treated as untrusted input.
Worth noting
Proposes running MCP tools as sandboxed WASM/WASI modules with deny-by-default host access (file/network/env/secrets); live demo showed ~10ms average tool response times while blocking unauthorized filesystem, network-port, and secret-access attempts.
Quote
웹 어셈블리 프로세스 자체는 이 가상의 어떤 샌드박스 모듈에서 구동되기 때문에 이 호스트에 대한 권한이라는 게 아예 없습니다.
Worth noting
Proposes "flavors" (curated, goal-based tool bundles at /{flavorId}/mcp) served via a proxy gateway with layered "Swiss cheese" security across public MCP, API gateway, and internal MCP layers.
Quote
A good MCP platform doesn't just make more tools available. It makes the right tools discoverable, routable, secure and measurable.
Worth noting
Production telemetry showed tool schemas eating 37% of a 200k context window; their progressive schema disclosure approach cut effective schema size by 70%.
Quote
Spend context on reasoning, not actually plumbing data, filtering, and all of those things can really be taken care by your server tool calls.
Worth noting
Live A/B test on identical tasks showed a well-structured OpenAPI schema cut API calls from 17 to 6, tokens from ~55K to ~28K, and time from 50s to 18s versus a vague schema.
Quote
Agent readiness is the amount of guessing work that we need to get there to actually get the result done right.
Worth noting
Rewriting an MCP server's docs with five rules—single source of truth, flattened narrative, explicit constraints, one canonical example, resolved referents—cut agent hallucinations and improved human docs too.
Quote
It will be either completely correct answer or incorrect answer, there would be nothing in between.
Worth noting
DevRev cut their MCP server from 40+ tools to 14 by consolidating per-object CRUD calls into generic get/update/link tools and bundling linked context (comments, tickets) into single responses.
Quote
You don't want your agent to know that there are 100 MCP tool calls which are available. Your agent should know that these are the 14 calls.
Worth noting
Naive REST-to-MCP generation for the Cloud-Barista multi-cloud project caused runaway provisioning (VMs up to $366/hr) and token overflows; fixes included cost caps, admin approval gates, response summarization, fewer/merged tools, multi-model testing, and bolting on the Agentgateway project for trust/security.
Quote
I'm one of the maintainers for open source project called Cloud Barista
Worth noting
Apollo's experience shows MCP provides live access/capabilities while Skills encode conventions and know-how; teams should ship both as maintained software, not treat one as replacing the other.
Quote
MCP gives the agent reach. Skills give it direction. They work better together.
Worth noting
Oh shows MCP tool calls can use ~10x more tokens than direct function calling, and offers a 5-point checklist (need 3+ yes) to decide if MCP is warranted.
Quote
MCP designed for connect to one of a tool. If you add more like a many tools one MCP server and your MCP will end up like a monolithic MCP server
Worth noting
Cursor silently truncates tool descriptions at a 6,500-character limit with no error; pagination bugs also drop tools (e.g., 48 tools showing only 30 in Claude, 14 showing only 8 in Cursor).
Quote
One of them was failing silently and I didn't know what went wrong because the MCP server was same... The only difference was they were only three different clients.
Worth noting
TwelveLabs' Jockey MCP server ships 9+ tools that bound long-running video ingestion, offload uploads outside the 500MB chat limit, and render video answers via a custom view-tree grammar instead of round-tripping through the LLM.
Quote
We wanted to ship the capability, not the destination.
Worth noting
Surveying six vision MCP servers (Roboflow, Voxel51, Twelve Labs, NVIDIA), the speaker found agents excel at labeling review but only scored 40/75 on a drone-inspection failure-analysis golden set, arguing human-in-the-loop remains essential.
Quote
GPT 5.6이 나오고 나서는 75개의 골든셋 중에 40개 정도만 맞았고요.
Worth noting
Quarkus + LangChain4j lets you build MCP servers/clients with a few dependencies and annotations (@Tool, @McpToolBox), plus built-in dev-UI testing and observability, while citing studies showing Java is far more energy-efficient than Python at scale.
Quote
So why not use Java for your AI and particularly for MCP?
Worth noting
Proposes a testing pyramid (unit tests, Inspector, conformance suites, fuzzing with Hypothesis/fast-check, linting, LLM evals) and cites Jenkins' MCP server returning 400k-character tool outputs as a real-world design failure.
Quote
Building an MCP server today is very, very, very easy... eight lines of code for you to have an MCP that has one tool.
Worth noting
Proposes a four-pillar trust framework (request, execution, result, identity) plus a JSON "trust envelope" with trace IDs and model versioning to make ML-backed MCP tools auditable; includes an open-source demo repo with injected failure modes.
Quote
LM as a orchestrator, ML as a specialist.
Worth noting
KC-ML2 moved from thin API-wrapper MCP tools to a boundary returning checked outcomes (healthy/critical/indeterminate) with reasons and bounded actions, preventing an LLM from recommending failover to an offline server.
Quote
Instead of asking only what tools should I expose, I recommend ask what decision should this boundary make.
Worth noting
Quote
이런 부분이 확실히 MCP 프로토콜에서 점점 발전하면서 좀 더 고려가 잘 되더라고요.
Worth noting
Litmus Chaos's MCP server lets non-experts query experiments, probes, and infrastructure context in natural language, though experiment creation via MCP is not yet supported.
Quote
We're trying to, you know, decrease the degree of hierarchy which can operate chaos engineering.
Worth noting
Describes GoalHouse, an open-sourced framework letting Codex's frontier "Sol" model track past delegation success/failure to cheaper "Terra"/"Luna" sub-models across goal runs, informed by Luna's 80% API price cut.
Quote
모델이 너무 똑똑해졌기 때문에 하네스로 코딩을 더 잘하게 해 줄 만한 게 없어요. 그냥 골 돌리면 됩니다.
Worth noting
OpenAI cut Luna's API price 80%, and Luna at max reasoning rivals Sol's medium reasoning—enabling cheaper Sol/Terra/Luna orchestration inside Codex's Goal feature.
Quote
코덱스가 참패했습니다. 코덱스가 졌습니다. 코덱스가 갈 길이 먼 것 같습니다.
Worth noting
Speaker argues understanding, not execution, is the real bottleneck for running long agent goals, and shares how he uses voice, podcasts, and simulations built with Codex/Kimi to grasp complex ideas before steering Sol-Terra-Luna agents.
Quote
고를 잘 돌리려면 그냥 고를 잘 완성됐을 때 이 엔드스테이트에 대해서 내가 잘 설명을 해 줄 수 있어야 되고
Worth noting
iOS/Android sandboxing blocks standard MCP transports (stdio, streamable HTTP); Apple App Intents and Android App Functions mimic MCP-like tool registries but are restricted to OS-controlled apps (Siri/Apple Intelligence, pre-installed apps), leaving on-device agents, MCP clients, or tunnel-based servers as the only viable paths today.
Quote
This is a $5 microcontroller. It can host MCP server. And we have a $1,300 mobile phone. It's not really can.
Worth noting
Live demo using his flutter_gemma/flutter_gemma_agent plugin showed an on-device Gemma model calling a local calendar skill fully offline, then querying a remote MCP server over a streamable transport for session info.
Quote
You can run multimodal LLMs, you can run in thinking mode, you can run speech to text and text to speech.
Worth noting
Live demo shows Quarkus+LangChain4j building Java MCP servers/agents via simple annotations, with hot reload, a dev UI for testing tools, and composable sequential, parallel, and autonomous supervisor agent workflows with human-in-the-loop and A2A remote agents.
Quote
You can write your servers in one language and your client in another language and they will interoperate just fine.
