wal.sh
home > events > agntcon-mcpcon-na > 2026 · Jul 20, 2026
conferencesai-agentsagent-governancemcpaaifmodel context protocolagent identityagent securityagent evalsagent-to-agentagentic engineering

AGNTCON + MCPCon North America 2026

Table of Contents

AGNTCON + MCPCon North America :conference:mcp:aaif:ai-agents:

AGNTCON + MCPCon North America (Oct 21-23 2026) The inaugural US pairing of the Linux Foundation's Agentic AI Foundation (AAIF) with MCPCon. Opening keynote by AAIF CTO Manik Surtani; Anthropic MCP co-creator David Soria Parra keynotes Day 2; Berkeley's Dawn Song keynotes Day 3 alongside Tim O'Reilly. Program covers agent identity + auth, MCP protocol evolution, evals, provenance, multi-agent coordination, and agentic-engineering practice.

Alignment verdict [I]

Against the corpus (deterministic simulation testing, TLA+/Quint, formal verification, functional programming), this event has the highest overlap of any 2026 AI conference I've mapped — not uniform, but concentrated in specific tracks:

  • Auth / identity is treated as a real protocol problem. Aaron Parecki (OAuth 2.1 editor) on CIMD; Alvaro Inckot on DCR→CIMD migration; Anishma Mavuram on recursive delegation with Ed25519-signed child tokens; Mohit Gurnani on user-scoped access. These are load-bearing standards-track sessions, not thinkpieces. [E]
  • Provenance / audit trails. Steven Mih (Action State) demoing an IETF-track transparency-log approach to agent actions; Vikas Luthra's AgentLedger (SHA-256 chained + Merkle root, O(log n) verification); Shub Argha on trust preambles cutting context contamination from 88.8% → 33.3% in controlled testing. These have measurable falsifiable claims. [E]
  • Deterministic bridges to LLM-driven work. Marcio Klepacz on agent-authored DAGs (reasoning outside, deterministic execution inside); Lucas Beeler on knowledge representation + constraint solvers under HIPAA compliance instead of "LLM in a loop"; Dexter Horthy on why "do the tests pass" fails as an eval signal. This is the closest the industry gets to correctness by construction. [E]
  • Real red-team + failure taxonomy work. Advait Patel + Charit Upadhyay on live MCP rug-pull attacks; Syed Anas Mohiuddin on SSRF in official MCP servers (CVEs disclosed); Han Xu (Amazon) on the 6,000-trajectory MAST-style failure audit; Bar Kaduri on white-box multi-turn agent exploits. [E]

Refutation condition. If the "context engineering / harness patterns" tracks turn out to be vibes-as-content ("we shipped 3,478 PRs; here's how our five layers work"), the honest read downgrades to "attend the protocol + auth + provenance tracks; skip the field-report keynotes." On current abstracts I don't yet know which way most of them fall. [I]

Cost of being wrong: moderate — travel + 3 days of attention. But the video-recorded tracks carry most of the load-bearing content, so attend selectively then triage recordings for the rest.

Curated sessions (grouped by theme)

Not the full ~100-session catalog — a curated slice with real technical payload. Times in the schedule's declared tz (check event page; likely PT).

Auth, identity & delegation (MCP + agent principals)

  • Oct 22 10:15 — Evolution, not Revolution: How MCP is Reshaping OAuth — Aaron Parecki (Okta, OAuth 2.1 editor). CIMD, PRM (RFC 9728), Identity Assertion Authorization Grant. Load-bearing.
  • Oct 22 10:50 — From DCR to CIMD: MCP Client Identity in Production — Alvaro Inckot (Runlayer). Decision tree; audit model preserving human → agent → tool → API attribution.
  • Oct 22 16:45 — One MCP Server, 50 Agents: The Identity Gap OAuth Doesn't Close — Mohit Gurnani (Nutanix). Envoy AI Gateway PR #2047, header forwarding, Vault + ESO rotation without pod restart.
  • Oct 23 11:35 — When Agents Spawn Agents: Securing Recursive Delegation — Anishma Mavuram (EmpowerID). RDCP: OAuth Token Exchange + RAR + DPoP or mTLS child tokens, monotonic least-privilege attenuation, AuthZEN PDP decisions.
  • Oct 23 12:10 — Auth.md — The Open Protocol for Agentic Registration — Michael Grinich (WorkOS). Agent-native signup, ID-JAG, agent-as-user identity boundaries.

Provenance, audit trails & verifiable action

  • Oct 22 17:20 — Who, May, Did: Composing Agent Identity with Verifiable Proof of What Agents Actually Do — Steven Mih (Action State). Content-private action records via digests to DID/VC + AgentFacts; anchored on SCITT/COSE. Joint live demo with MIT NANDA.
  • Oct 22 18:30 — Configured for Autonomy — Casey Silver + Viyat Bhalodia (OpenAI Agent Security). Sandbox denials + LLM judge escalation as a feedback loop; policy changes replayed against previous workflows before rollout.
  • Oct 23 13:20 — The Agentic Orchestration Stack: Durability, Guardrails, and Attestation — Yaron Schneider (Diagrid; co-creator of Dapr + KEDA). Cryptographic attestation + verifiable execution histories.
  • Oct 23 16:40 — Prove What Your Agent Did: Tamper-Evident Audit Trails for Tool Calls — Vikas Luthra (Komatsu). SHA-256 chained records + Merkle root, O(log n) verification without full replay. OSS TypeScript lib on npm.

Deterministic bridges & correctness-adjacent

  • Oct 22 17:20 — Bridging Agentic Reasoning and Deterministic Execution — Marcio Klepacz (ComparaCAR CTO). Agent-authored DAGs: reasoning where flexible, deterministic where reliable.
  • Oct 23 11:00 — Beyond LLMs in a Loop: Building Trusted Agents in Regulated Industries — Lucas Beeler (Aerospike). HIPAA staffing agent; LLM only translates intent → spec; classical AI (knowledge representation, formal verification, constraint solvers) does the reasoning.
  • Oct 23 13:20 — Your Agent Sandbox Is Built Backwards — Ariadne Conill + Dan Fernandez (Edera). Capability-object model from OS-security tradition vs. subtractive policy. "Authority that was never minted cannot be invoked."
  • Oct 23 16:05 — Agent Governance Lives in the OS — Alexander Sklar + Roberth Karman (Microsoft). MXC (Microsoft Execution Containers): one policy across bubblewrap / seatbelt / AppContainer. Where composition breaks down honestly discussed.

Evaluation & the failure taxonomy of agents

  • Oct 22 10:15 — Stop Vibe-Testing: Run Real Agent Evals — Laurie Voss (Arize; ex-npm co-founder).
  • Oct 22 11:25 — There's No Dark Factory Without Better Software Verifiers — Dexter Horthy (HumanLayer). "Do the tests pass" as insufficient signal for LLM-generated code long-term.
  • Oct 23 12:10 — Building an Agentic Eval Pipeline: Battle-Tested Lessons with EvalBench — Kurtis Van Gent + Prerna Kakkar (Google; MCP core maintainer). Trajectory, tool accuracy, sub-goals.
  • Oct 23 12:45 — Why Your Agent Is Failing: Failure Modes from 6,000+ Agent Trajectories — Han Xu (Amazon). Top-5 failures = 89% of errors; endless loops + timeouts alone = 32%.
  • Oct 22 17:55 — Rethinking CI/CD Release Gates for Agent-native Software — Prathmesh Patel (MCPJam CEO). 4-layer gate: behavioral evals, protocol compliance, deterministic checks, security.

MCP security & red-team (working exploits)

  • Oct 22 13:10 — MCP Rug Pulls in the Wild: Live Attacks and How to Stop Them — Advait Patel + Charit Upadhyay (Broadcom + Adobe). Three real 2026 incidents; live demo + cryptographic tool-identity defense.
  • Oct 23 11:00 — Protocol Pivoting: SSRF in MCP Servers Enables Cross-Protocol Lateral Movement — Syed Anas Mohiuddin (independent). Multiple CVEs in official MCP servers, cross-protocol reach (Redis / SMTP / Elasticsearch), preprint on Zenodo, mcp-safeguard scanner.
  • Oct 23 17:15 — Breaking the Agentic Loop — Multi-Turn Exploits Against Tool-Using AI Agents — Bar Kaduri + Lidan Hazout (Capsule Security). White-box red-team; adversarial interaction trees.
  • Oct 23 10:25 — 1,149 Hackers Tried to Break Our AI Agent Guardrails. 0 Succeeded. Here's Why — Uchi Uchibeke (APort). Public CTF data; Ed25519-signed policy decisions at ~65ms p50.
  • Oct 22 17:20 — Break the Lethal Trifecta (workshop) — Zayne Turner + Chris Miller (Workato). Simon Willison's "lethal trifecta" as architecture, not prompt-hardening.

Distributed systems + multi-agent coordination

  • Oct 22 12:00 — Programmable LLM Inference for Open Agent Infrastructure — Lin Zhong (Yale; co-inventor of Prompt Cache). Pie: OSS programmable inference runtime; Rust/Py/JS Inferlets compiled to Wasm close to the model.
  • Oct 22 13:10 — Multi-Agent SRE: What Happens When Your Agents Want Opposite Things — Aditi Mewada + Prakshal Doshi (Apple SRE). Conflict detection + priority hierarchies.
  • Oct 22 17:55 — Beyond Static DAGs: Orchestrating AI-Generated Multi-Agent Workflows — Cong Wang (Linux kernel developer; Agentry). Runtime-generated workflow orchestration + Context Graph.
  • Oct 23 13:20 — Making Swarm Work: Coordination Primitives for Decentralized Multi-Agent Systems — Jodee Varney (Cisco/Outshift). Mycelium; peer-to-peer intent alignment + constraint negotiation.
  • Oct 23 11:00 — Event-Driven Multi-Agent Orchestration: Fast Path, Smart Path — David Kjerrumgaard (StreamNative; Apache Pulsar committer). Choreography over orchestration; DLQ per failure.

Context, memory & data

  • Oct 23 16:05 — How Contexts Fail (and How to Fix Them) — Drew Breunig (cmpnd). Context rot taxonomy; treat context as programmatically assembled.
  • Oct 23 17:15 — Context Is the Substrate: Production Patterns for Knowledge-Graph-Backed Agents — Cassie Shum. Provenance as working memory; code as truth.
  • Oct 23 16:05 — Data Agents over S3: Build the Missing Semantic Layer for Files — Dmitry Petrov (DataChain; DVC creator). Typed, versioned, lineage-tracked datasets that compound across runs.
  • Oct 22 13:10 — Trustworthy Context Is Untrusted By Default — Shub Argha (Arcade.dev). Preamble warnings cut context contamination from 88.8% → 33.3% in controlled testing.

MCP protocol edges (production-hardening)

  • Oct 22 11:25 — What Your MCP Server Does When Nobody's Looking — Austin Parker (Honeycomb). 40%+ of weekly query volume via agents; how to instrument for a caller with no session boundaries.
  • Oct 23 10:25 — The MCP Cold-Start Problem: When Your Agent Has 100 Tools — Karthik Karunanithi (IBM). Hierarchical tool routing; on-demand discovery with caching.
  • Oct 23 11:35 — Why the Heck Aren't Any Agents Supporting MCP Tasks? — Cornelia Davis (Temporal). July 2026 spec puts durability on the client too; why no client shipped it in 7 months.
  • Oct 23 12:45 — Your Tool Is in Another Castle: How Five Frameworks Reshape the Same MCP Server — Thierry Damiba (Arcade.dev). Client compliance benchmarking + mcp-mirror leaderboard.
  • Oct 23 10:25 — Schrödinger's Skill: A 50-Client Autopsy of What "SKILL.md Support" Actually Means — Golan Myers (Bloom Security). Enforcement fields silently skipped; proposed Skills RFC.

Keynotes worth catching live

  • Oct 22 09:15 — Manik Surtani (AAIF CTO)
  • Oct 22 09:40 — Building the Human-Agent Workplace — Bradley Axen (Block, goose creator)
  • Oct 22 14:50 — David Soria Parra (Anthropic; MCP co-creator)
  • Oct 22 15:10 — Sarah Drasner (Google; Chrome Web Ecosystem)
  • Oct 23 09:25 — Thomas Dohmke (Entire; ex-GitHub CEO)
  • Oct 23 15:05 — Dawn Song (UC Berkeley; RDI Center)
  • Oct 23 09:55 — Tim O'Reilly (O'Reilly Media)
  • Oct 23 15:45 — Chi Wang (Google DeepMind; AutoGen/AG2 creator)

Scoring rubric — how I picked

Sessions in the curated list satisfy at least one of:

  1. Names a specific standard, RFC, or spec the audience can read (RFC 9728, RFC 9421, ID-JAG, AGT, MAST, ACS, SCITT/COSE, MCP tasks spec).
  2. Cites measurable results on falsifiable claims (88.8% → 33.3% contamination, 0/1,149 CTF attackers, 89% of errors in top-5 categories, 32% loops/timeouts).
  3. Demonstrates deterministic mechanism rather than probabilistic guardrail (Ed25519-signed decisions, Merkle-anchored audit trails, capability-object minting, DAG-executed workflows, constraint-solver reasoning).
  4. Comes from a maintainer of a load-bearing standard or piece of infrastructure (Aaron Parecki on OAuth 2.1, David Soria Parra on MCP, Kurtis Van Gent on MCP core, Ariadne Conill on Alpine security tooling, Lin Zhong on Prompt Cache, Cong Wang on Linux kernel).

Sessions I skipped even though they might be popular: "we shipped N PRs" field reports without falsifiable claims; general "AI collaboration maturity" talks; the SMB-focused Copilot demos; the "here's my company's homegrown framework" showcases without an OSS reference implementation.

Open questions to bring [I]

  • MCP tasks durability boundary. Nov-2025 vs. July-2026 spec shift puts durability on the client. What's the smallest correct client implementation, and does anyone actually have one? (Cornelia Davis session should answer.)
  • ACS composition with A2UI / A2A / UCP. Microsoft's Agent Control Spec is deterministic at 5 checkpoints; A2A/UCP are protocol-level. Do the enforcement points compose or fight?
  • Verifiable action records vs. audit logs. Steven Mih's SCITT-anchored records + Vikas Luthra's Merkle chain overlap significantly. Are they redundant or complementary? Is either an IETF-track draft the community will converge on?
  • Where does capability-object security (Edera) sit relative to policy-DSL enforcement (Microsoft ACS, Workato Lethal Trifecta workshop)? The additive vs. subtractive model matters — determines whether prompt hardening ever needs to be relied on again.

Sources