Platform & DevTools Team Brief

Executive Summary

AI Engineer Europe 2026 made clear that the platform and tooling layer is now the critical constraint on developer productivity. Every major team on stage — from Anthropic, Cloudflare, and OpenAI to Cursor, GitHub, and Supabase — reported that the bottleneck has shifted from model capability to infrastructure: context management, harness reliability, tool-call efficiency, evaluation pipelines, and deployment sandboxing. The message for platform teams is unambiguous: the era of "ship the model and let developers figure it out" is over. The teams capturing the most value are those building the scaffolding that makes agents reliable, observable, and composable.

The MCP ecosystem emerged as the dominant integration layer, but with a clear maturity problem. David Soria Parra (Anthropic) reported 110 million monthly MCP downloads — reaching that milestone twice as fast as React — yet enterprise adoption remains stuck below single-digit server deployments per org. Karan Sampath (Anthropic) diagnosed the root cause as a "three-headed hydra" of missing observability, access control, and security primitives. The implication: the next wave of platform investment should focus not on more MCP servers but on the gateway, registry, and governance layer that makes those servers enterprise-deployable.

Context engineering displaced prompt engineering as the dominant technical theme. Multiple sessions converged on the same finding: agent quality degrades not because of weak models but because of poor context hygiene — bloated tool sets, polluted conversation histories, and context windows carrying irrelevant state. Sunil Pai (Cloudflare) demonstrated a 99.9% token reduction by replacing 2,600 MCP tool definitions with two code-accepting tools. Peter Werry (Unblocked) showed a 6x speed improvement and 52% token reduction on a real coding task simply by pre-seeding the agent with organizational context. Platform teams that build context engines — not just RAG pipelines — will unlock orders-of-magnitude efficiency gains for their developer users.

Continuous evaluation at every stage of the agent lifecycle emerged as a non-negotiable infrastructure requirement, not an optional quality process. Lawrence Jones (Incident.io) showed how serializing UI debug views as downloadable file systems allowed coding agents to traverse prompt hierarchies and diagnose failures in minutes instead of hours. The Anthropic workshop demonstrated that generator-evaluator adversarial harnesses with Playwright MCP produce qualitatively different output than agents running without a critic. Phil Hetzel (Braintrust) argued that agent observability requires a custom storage and indexing stack — gigabyte traces, 20MB spans, and full-text search over unstructured reasoning — that traditional APM tools cannot handle. Platform teams that treat eval infrastructure as a first-class product surface will become essential to every AI engineering team they serve.

Key Findings

1. MCP Is the Integration Standard — But Enterprise Deployment Requires a Gateway Layer

David Soria Parra (Anthropic, AIE Europe Keynotes Day 2) confirmed MCP has reached 110 million monthly downloads, growing faster than React at the same adoption stage. The June 2026 spec additions are directly relevant to platform teams: stateless HTTP transport (eliminating the need to maintain long-lived connections), async agent-to-agent task primitives (enabling A2A workflows without synchronous round-trips), server discovery via well-known URLs (making MCP catalogs self-documenting), cross-app enterprise SSO (see below), and skills-over-MCP (a primitive for distributing reusable agent behaviors through the protocol itself).

Karan Sampath (Anthropic, "Gateways are All You Need") identified why enterprise MCP adoption stalls at single-digit server counts despite the broader ecosystem scaling. The problem is the absence of a centralized root of trust. His proposed MCP Gateway architecture sits between all MCP clients (Claude.ai, Claude Code, Cursor, any agent runtime) and the full internal MCP server catalog. The gateway handles OAuth + IDP integration, role-based access control at the tool level, secure tunneling, a sub-registry for internal servers, and a developer-facing CLI for scaffolding new servers. The strategic payoff: every new MCP server built internally only needs to implement business logic — auth, scaling, and security review cycles are handled once at the gateway. Sonny Merla, Mauro Luchetti, and Mattia Redaelli (Quantyca, "One Registry to Rule them All") validated this pattern at Amplifon (20,000 employees, 26 countries), describing a four-layer stack: an AI gateway with Entra ID auth and per-use-case budget management, a private MCP registry, an A2A agent card registry, and a use-case registry with full object lineage graphs. CI/CD pipelines auto-publish server metadata and agent cards on every tagged deployment.

Garrett Galow (WorkOS, "One Login to Rule Them All") addressed the OAuth consent-screen proliferation problem with Cross-App Access (XAA), built on the IETF Identity JWT Authorization Grant spec. The protocol allows a single SSO login to an IDP (Okta, Entra) to silently provision short-lived access tokens (5-minute TTL) to any registered MCP server — without additional consent screens. On device compromise or employee offboarding, IDP session revocation immediately blocks all token issuance. WorkOS has already built XAA client-side support for Cursor and Anthropic.

Implication for platform teams: Invest in MCP gateway infrastructure before expanding your MCP server catalog. A gateway with auth, RBAC, observability, and a registry unlocks all downstream server investment. Without it, each new server creates a governance liability.

2. Code Mode — LLM-Generated Executable Code — Is Replacing JSON Tool Calling for Large API Surfaces

Sunil Pai (Cloudflare, "Code Mode") and Matt Carey (Cloudflare, "MCP = Mega Context Problem") presented the most concrete token-efficiency result of the conference: replacing 2,600 Cloudflare API endpoints expressed as MCP tool definitions (~1.2 million tokens) with two code-accepting tools — search and execute — reduced the context footprint to approximately 1,000 tokens, a 99.9% reduction. The mechanism: LLMs generate TypeScript against a typed SDK derived from the OpenAPI spec, then execute it in a V8 isolate sandbox. This unlocks looping, stateful execution, parallelization, and type-checked API access — primitives JSON tool calling cannot provide.

The same Code Mode finding was validated independently by Abhishek Kankani (Cloudflare, AIE Singapore Day 2) who reported conversion of 1.7 million tokens to ~1,000 tokens on the same API surface. Rita Kozlov (Cloudflare, AIE Miami Keynote) calculated a 70% token reduction versus vanilla MCP. The security model for code execution uses capability-based sandboxing: V8 isolates start with zero network or filesystem access; capabilities are explicitly granted per execution; full audit trails are mandatory.

Matt Carey outlined the evolution he expects: programmatic tool calling will become standard in all MCP clients; agents will generate and persist mini-scripts for recurring tasks; and the MCP TypeScript SDK will become lightweight enough to be natively embedded in major full-stack frameworks as a boolean flag on API routes.

Laurie Voss (Arize AI, AIE Miami Day 2) ran 500 structured evaluations comparing GitHub's official MCP server, a verbose 2,187-line skill, and a short opinionated skill using Claude Opus 4.6. The finding: MCP used 12 tool calls versus 5 per task on complex queries, with 6x higher cost. Verbose JSON payloads overflowed context windows, forcing the agent to fall back to bash/jq. The synthesis: CLI/skills win for tools with strong training-data coverage; MCP wins for remote, OAuth-gated, or proprietary tools.

Implication for platform teams: For internal APIs with large surface areas, invest in typed SDK generation from OpenAPI specs and a secure code execution sandbox (V8 isolate, Deno, or Pydantic Monty). This will deliver better agent performance than expanding the MCP tool catalog. Reserve MCP for external integrations requiring OAuth.

3. Harness Engineering Is the Primary Reliability Lever — Not Prompt Engineering

Multiple talks converged on the same architecture: a well-engineered harness around a mediocre model outperforms a weak harness around a frontier model. Tejas Kumar (IBM, "Harnesses in AI: A Deep Dive") demonstrated this live by building a working browser automation agent using GPT-3.5 Turbo (2023 vintage) by incrementally adding: max-iteration guardrails, naive context compression, a cryptographic verify step reading the tool-call trace, and a deterministic login handler. The agent succeeded without touching the prompt.

The Anthropic workshop (Ash Prabaker and Andrew Wilson, "Build Agents That Run for Hours") presented the current state-of-the-art harness pattern internally at Anthropic: a GAN-inspired generator-evaluator architecture where a builder generates output and a standalone adversarial evaluator critiques it using Playwright MCP to open live pages, click through the app, take screenshots, and score against a rubric weighted for design, originality, craft, and functionality. The key insight: tuning a dedicated critic to be harsh is tractable; tuning a builder to be self-critical is not. A Planner adds a third role that converts vague prompts to sprint specs. Before any code is written, generator and evaluator negotiate a "done contract" via files on disk — cited as the key innovation absent from simpler loop patterns.

Ryan Lopopolo (OpenAI, "Harness Engineering") described a monorepo growing to 750 packages in a PNPM workspace, with files capped at 350 lines (enforced by test), one ORM, one programming language, and lint rules preventing agent re-implementation of shared utilities. The harness enforces non-functional requirements as tests and lint rules rather than prompt instructions — "Garbage Collection Fridays" convert weekly review feedback into durable automated guardrails. Persona-based reviewer agents (front-end architect, reliability engineer, scalability engineer) trigger on every push, removing humans from synchronous review loops.

Nick Nisi (WorkOS, "How I deleted 95% of my agent skills") validated the anti-pattern empirically: generating 10,000 lines of skills from documentation caused a 20-percentage-point accuracy regression on specific tasks. Deleting 95% of those skills and replacing them with 553 lines of "gotcha" notes cut eval time from 68 minutes to 6 minutes while improving pass rates. His principle: the model already knows how to code; it only needs to know where the landmines are in your specific product.

Implication for platform teams: Invest in harness primitives — verify steps, guardrail hooks, lint rules that trigger at commit time with actionable error messages, and reviewer agent infrastructure — before expanding skill libraries. The marginal value of the 500th skill is negative.

4. CI/CD Infrastructure Is Breaking Under Agent-Scale Commit Volume

Hugo Santos and Madison Faulkner (Namespace, "CI/CD Is Dead") delivered the most operationally urgent talk for platform infrastructure teams. The core problem: traditional CI/CD was designed for human developers submitting one or two diffs per week. At agent scale — Namespace reports their own PR-equivalent volume at 4x historical baseline — runner saturation, cold Docker builds on every short-lived branch, cache thrash, and merge queue serialization become primary bottlenecks. GitHub commit statistics cited: 275 million commits per week in 2026, extrapolating to 14 billion by year-end, with a growing share agent-authored.

The replacement architecture eliminates PRs as the unit of work. The proposed flow: codified intent-and-plan (Linear ticket, spec document) fed into an agent harness → inline validation (build + tests) within the loop → human review of intent-plus-outcome (including demo videos and LLM security reports), not diffs. External validation uses specialized LLM reviewer agents — security-focused, API-conformance-focused — providing structured feedback directly into the harness. A pre-merge queue handles serializability across concurrent agent branches. Governance moves up into the harness rather than being enforced externally.

Liam Hampton (Microsoft, "Cooking with Agents in VS Code") demonstrated a practical three-tier model: local agents (developer machine, human-in-loop), background agents (Git worktrees, isolated branches, 50/50 hands-on/hands-off), and cloud agents (GitHub Actions, network-firewalled, no main-branch access, GitHub MCP + Playwright MCP). The cloud tier is appropriate when the developer genuinely doesn't care about the implementation path. Eric Zakariasson (Cursor, "Building your own software factory") described running 5-10 cloud agents asynchronously at any given time, with automated stale feature flag removal, daily review agents aggregating Slack and GitHub activity, and an agentic code-owner system assessing PR risk level and routing reviews.

The CI infrastructure failure at Intercom (Brian Scanlan, "How Building with AI Can Double the Throughput") is the clearest production signal: PR throughput doubling caused CI infrastructure to "melt" as an unintended side effect. 17.6% of Intercom PRs are now auto-approved under SOC 2, ISO 27001, and HIPAA compliance.

Implication for platform teams: Audit CI infrastructure for agent-scale throughput now. Key investments: stateful compute environments (eliminate cold Docker builds on short-lived branches), merge queue serializability at 10-100x current PR volume, intent-plus-outcome review interfaces, and automated security/conformance reviewer agents as CI gates.

5. Agent Observability Requires a Custom Storage and Indexing Stack

Phil Hetzel (Braintrust, "How agent o11y differs from traditional o11y") made the clearest architectural case: traditional APM tools are insufficient for agent observability because (1) agent traces are non-deterministic and cannot be evaluated with standard metrics, (2) agent trace data is qualitatively different — single traces up to 1 GB, individual spans up to 20 MB, semi-structured with large volumes of embedded unstructured text — and (3) meaningful evaluation requires domain experts (clinicians, lawyers, wealth advisors) who interact directly with traces, not just systems engineers.

Braintrust built a custom database from scratch for this reason, citing ClickHouse's inadequate full-text indexing as the trigger for migration. The custom stack includes: a write-ahead log for instantaneous trace visibility, analytical indexes for filtering and aggregation, and a forked Tantivy (Rust-based full-text search, open-source) enabling engineers to query every trace containing a specific word or phrase.

Danny Gollapalli and Zubin Koticha (Raindrop, "Everything You Need To Know About Agent Observability") described a practical signal taxonomy for production agents: explicit signals (tool error rate, latency, cost, regeneration events) and implicit signals broken into classifier signals (binary ML classifiers for refusals, task failure, user frustration, jailbreaking), regex signals (keyword matching for sentiment, inspired by the leaked Claude Code `user_prompt_keywords.ts`), and self-diagnostics — a tool definition plus system prompt pattern exploiting model self-introspection. The self-diagnostic tool frames feedback as "giving creators information," which significantly increases the firing rate compared to naming it something like `unsafe_bash_use`. A customer case showed user frustration dropping from 37% to 9% after deploying prompt v2.4, detected via classifier signal A/B test with a few hundred events.

SallyAnn DeLucia (Arize AI, AIE Singapore) described four production lessons from building Alyx: planning must live in explicit tool states (pending/in-progress/blocked/completed) outside conversation history to prevent truncation; large-JSON abstractions compress string values but preserve full schema structure; production traces are better eval ground truth than hand-authored golden sets; and Arize Skills feed traces directly into Claude Code to close issue-to-fix cycles in minutes.

Lawrence Jones (Incident.io, "Fighting AI with AI") showed the highest-leverage observability pattern for platform teams: serializing UI debug views as downloadable file systems. Every agent interaction is packaged as a downloadable snapshot including full trace data rendered as ASCII-friendly text files. Engineers drop this into a Claude Code session and the agent traverses the prompt hierarchy to identify the failing prompt and suggest a fix — turning a 1-hour debugging session into minutes. A fleet-scale pattern runs 25 parallel Claude Code agents analyzing one investigation each, then clusters results to surface systemic failure patterns across customer cohorts.

Implication for platform teams: Agent observability is a product surface, not a logging configuration. Plan for custom storage with full-text indexing over unstructured traces, domain-expert annotation interfaces, A/B testing infrastructure for prompt/model changes, and self-diagnostic tool patterns to surface capability gaps from the agent itself.

6. Context Management Is the Primary Reliability Problem in Production Agents

Andrej Karpathy's framing — context engineering as "the delicate art and science of filling the context window with just what needs to happen" — was cited in at least four independent sessions as the successor discipline to prompt engineering. The production failure patterns are consistent across talks:

Brendan O'Leary (Kilo Code, "Agentic Engineering") identified two compounding failure modes: context bloat (quality degrading noticeably above ~50% context window utilization, with every enabled MCP server loading additional tokens on every request) and context poisoning (mixing unrelated tasks or stale exploratory paths causing bad patterns to re-emerge). Prescriptions: persist working memory in files outside the context window, pull in only what is relevant to the current step, and isolate work across parallel agents.

Peter Werry (Unblocked, "Mergeable by default") showed a concrete benchmark: implementing Anthropic's adaptive thinking mode took 2 hours 25 minutes and 21 million tokens without a context engine, versus 25 minutes and 10 million tokens with Unblocked's context engine — a 6x speed improvement and 52% token reduction from pre-seeded organizational context alone. The context engine requires six components: unified semantic relationships between data sources, conflict resolution with recency and expert-signal weighting, personalized retrieval by contributor frequency, data governance flowing from source access control, expert bottling (distilling domain expert contributions into reusable artifacts), and a social engineering graph (PageRank + vector clusters + LLM distillation).

Sarah Chieng (Cerebras, "Fast Models Need Slow Developers") documented what high-speed inference (1,200 tokens/second on Codex Spark) does to context management: context compaction that previously took 10 minutes now happens in 30 seconds, requiring developers to actively steer rather than review asynchronously. Her four-file external memory system — agents.md (sub-agent definitions), plan.md (step-by-step checklist), progress.md (completed vs. remaining tasks), verify.md (per-step quality gates) — externalizes memory so that short context windows don't reset accumulated state.

Tejas Bhakta (Morph LLM, AIE Miami Day 2) presented specialized sub-agent models for non-frontier tasks: a context compaction model running at 33,000 tokens/second and a code-search model supporting 12 parallel tool calls. Cross-customer data showed that doubling speed without hurting accuracy roughly doubles conversion rates.

Implication for platform teams: Build context engines, not just RAG pipelines. The key differentiator is semantic understanding of relationships between data sources, conflict resolution across sources, and personalization by contributor. Evaluate context management primitives — compaction strategies, external memory patterns, selective tool loading — as core platform capabilities.

7. Evaluation Infrastructure Must Be Continuous, Malleable, and Agent-Operated

Vincent Koc (OpenClaw/Comet, "Malleable Evals") coined the term eval calcification for the central failure mode: static benchmark suites built for stable software cannot track the 20% of agent behavior that drifts as customers change, edge cases emerge, and products evolve. His replacement framework has four components: intent-based outcome definitions (evaluate whether the agent reached the end state, not whether input produced specific output), self-curating test suites (agents mine their own traces to identify behavioral drift and update test cases automatically), always-on online evaluation (continuous service running against live traces, not periodic batch runs), and telemetry-in-the-loop self-correction (harnesses that detect their own error and cost signals and self-correct mid-run).

Samuel Colvin (Pydantic, "Agent Optimization with Pydantic AI: GEPA") presented the most concrete eval-driven optimization result: GEPA (Genetic Evolution of Prompts via Agents) improved a hand-engineered prompt from 92% to 96.7% accuracy on a political dynasty classification task after 400 evaluation calls — a significant lift over the human-engineered prompt. GEPA is most valuable for private-data domains where models have no prior training signal. Shopify reduced annual model costs from ~$5 million to $73,000 by combining GEPA-style optimization with a smaller quantized model. Colvin demoed Logfire managed variables: live prompt swapping, model switching (Anthropic Sonnet to GPT-4.1), and A/B traffic splitting without server restart.

Benjamin Verbeek (Lovable, "How Lovable self-improves every hour") described two continuous self-improvement loops processing 200,000+ daily projects: a Stack Overflow-style knowledge injection system (LLM judge monitors for stuck→unstuck session transitions, extracts what context would have resolved the issue, stores as knowledge entries, and runs holdout A/B tests to validate each entry against project deployment rate) and a vent tool (a dedicated agent tool for reporting platform limitations directly to a Slack channel, which detected a silent file-copy bug caused by non-breaking spaces within the first hour of launch). The vent volume pattern also serves as a reliable incident detector.

Patrick Debois (Tessl, "Context Is the New Code") framed the broader discipline as a Context Development Lifecycle (CDL): Generate → Evaluate → Distribute → Observe. The Distribute phase introduces context packaging analogous to software package management: versioned context libraries, registries (skills marketplaces), dependency resolution, and AI SBOM (Software Bill of Materials) tracking which model generated a skill and under what conditions. The Observe phase mines agent logs for missing context patterns and automatically creates new context entries, turning PR review feedback directly into context improvements.

Implication for platform teams: Eval infrastructure should be a platform service, not a per-team project. Key capabilities: online evaluation running against live production traces, A/B testing primitives for prompt and model changes, self-curating test suites triggered by behavioral drift, and a context registry with versioning and dependency tracking.

8. Sandboxing and Security for Agent-Generated Code Is an Unsolved Infrastructure Problem

Diego Carpentero ("$1 AI Guardrails") catalogued six attack vectors relevant to platform teams building agent infrastructure: direct prompt injection, indirect context injection via external content (a March 2026 case showed adversarial website content overriding AI advertising review systems), GCG gibberish token attacks transferring from open-weight to closed models, RAG poisoning (5 chunks in an 8-million-document corpus sufficient to force a target answer), MCP tool-description asymmetry exploits (human sees a one-liner; LLM reads hidden instructions that exfiltrate credentials), and agentic escalation (a February 2026 supply-chain attack where a malicious NPM package referenced in a GitHub issue was installed by a coding agent, affecting 4,000-5,000 developers). His recommendation: a zero-trust defensive layer using fine-tuned ModernBERT (150M parameters, 35-40ms classification, ~85% accuracy on the InjectGuard dataset of 75,000 labeled examples).

Peter Steinberger (OpenAI/OpenClaw, AIE Keynotes Day 1) described the "lethal trifecta" of agentic risk: personal data access + untrusted content + communication ability. OpenClaw has logged 1,142 security advisories in five months — 16.6 per day, twice curl's lifetime total — with 99 critical. He is forming the OpenClaw Foundation with contributions from Nvidia, Microsoft, Tencent, and Bytedance to address the governance problem.

Jun Yu Tan (Tusk, AIE Singapore) introduced Fence, a deterministic OS-level execution boundary for coding agents. The mathematical motivation: a 99% reliable probabilistic classifier yields only ~30% zero-error probability over a 120-tool-call session and essentially zero over 1,000 calls. Fence enforces file-system, network, and command policies at kernel level with no container runtime — the middle layer in a classifier → OS policy → container isolation stack.

Steve Kaliski (Stripe, "Building safe Payment Infrastructure") presented the economic dimension: agents are already economic actors. Stripe's Shared Payment Tokens encode spend mandates (scoped to seller, capped amount, time-limited), the Machine Payments Protocol repurposes HTTP 402 for per-API-call micropayments, and the Agent-to-Commerce Protocol (ACP) enables structured programmatic checkout negotiation. The core principle: discovery and exploration should embrace non-determinism; credentials, payments, and checkout require strict determinism.

Implication for platform teams: Sandboxing is infrastructure-level work. Invest in: capability-based sandbox defaults (zero network access unless explicitly granted), OS-level execution boundaries for coding agents, lightweight classifier guardrails at the ingress layer, MCP gateway security scanning, and agent identity/credential management as a first-class auth primitive.

Strategic Implications

For platform and developer-tooling teams, AI Engineer Europe 2026 surfaces four strategic reorientations:

From tools to platforms. The highest-leverage investment is no longer adding more MCP servers or writing more skills. It is building the infrastructure that makes all existing and future tools composable, governable, and reliable: MCP gateways, context engines, harness primitives, eval infrastructure, and sandboxed execution environments. Teams that build this layer become essential to every AI engineering team they serve; teams that don't become vendors of incremental utilities.

From prompt engineering to context engineering to harness engineering. The discipline ladder is clear from the conference: prompt engineering is table stakes, context engineering (what goes into the window and when) is the current frontier, and harness engineering (verify steps, guardrails, reviewer agents, eval pipelines) is where the next order-of-magnitude reliability gains live. Platform teams should build tooling that supports all three disciplines while nudging teams toward the harness layer.

From batch evaluation to continuous evaluation. Static golden datasets evaluated periodically are insufficient for adaptive agent systems. The platform should provide always-on evaluation as a service: online evaluation running against live traces, A/B testing for prompt and model changes, self-curating test suites triggered by behavioral drift, and domain-expert annotation interfaces. Eval is a product, not a script.

From human-scale CI/CD to agent-scale continuous compute. Existing CI/CD assumptions — PR as unit of review, human approvals in the critical path, stateless runners per branch — break at agent commit volumes. The platform should invest in stateful compute environments, pre-merge serializability queues, intent-plus-outcome review interfaces, and LLM-based automated reviewer agents for security and conformance. This is CI/CD reinvented, not CI/CD extended.

Action Items

Priority 1 — Immediate (0-4 weeks)

1. Audit current MCP server inventory for gateway readiness. Map which MCP servers lack auth, RBAC, and observability. Identify one server to pilot through a gateway architecture (Anthropic has open-source examples and professional support available).

1. Instrument agent traces for implicit signal extraction. Deploy classifier signals for task failure and user frustration. Add regex-based sentiment detection on conversation history. Baseline the current frustration and task-completion rates before any prompt changes.

1. Add a verify step to your most-used agent harnesses. Implement deterministic post-run trace inspection that checks whether the agent actually executed the claimed actions (file writes, tool calls, test runs). This single change eliminates the most common class of silent agent failures.

1. Run a CI/CD throughput audit. Measure current PR volume, runner utilization, and merge queue depth. Establish a baseline before agent-driven commit volume scales. Identify the first bottleneck that will saturate at 4x current volume.

Priority 2 — Near-term (1-2 months)

1. Build or adopt a context engine for your primary monorepo. Start with expert bottling: identify 2-3 domain experts whose PR comments and Slack discussions encode non-obvious constraints. Distill those into reusable context artifacts. Measure token consumption and doom-loop frequency before and after.

1. Implement Code Mode for large internal APIs. Generate a typed TypeScript SDK from your largest internal OpenAPI spec. Deploy a capability-based V8 isolate sandbox (or Deno equivalent). Measure the token reduction versus the equivalent MCP tool catalog.

1. Establish an eval-as-a-service platform. Deploy Braintrust, Langfuse, or equivalent with: online evaluation running against live agent traces, A/B testing for prompt changes, and a human annotation interface for domain experts. Connect production trace failures to offline eval datasets automatically.

1. Integrate Cross-App Access (XAA) into your MCP server auth model. Adopt WorkOS XAA or equivalent short-lived token patterns to eliminate long-lived OAuth tokens across agent credentials. This resolves the security gap exposed by the NPM Axios compromise incident described at the conference.

Priority 3 — Strategic (2-6 months)

1. Build an internal MCP registry with enterprise metadata. Implement the registry pattern from Amplifon/Quantyca: ownership, deployment environment, auth mechanism, cost attribution, use-case linkage, and CI/CD auto-publishing of server metadata. Provide GitHub template repositories as developer blueprints for MCP and A2A servers.

1. Deploy OS-level execution boundaries for coding agents. Evaluate Fence (deterministic kernel-level policy enforcement) or equivalent as the middle layer in your agent security stack alongside classifier-based guardrails and container isolation. This is the defense-in-depth architecture that survives individual layer failures.

1. Invest in intent-plus-outcome review infrastructure. Build or adopt tooling that presents developers with feature demo videos, LLM security reports, and outcome summaries rather than raw diffs. This enables meaningful human review at agent-scale PR volume without requiring each PR to be read line-by-line.

1. Establish a context skills lifecycle process. Define a CDL (Context Development Lifecycle): version control all agent skills, run eval before and after every skills change, publish skills to an internal registry with quality gates, and mine agent session transcripts to identify missing context patterns. Treat context rot (stale skills from model upgrades) as a production incident category.

Sessions to Watch

| Session | Speaker | Why It Matters | |---|---|---| | Gateways are All You Need | Karan Sampath, Anthropic | The definitive architecture brief for enterprise MCP deployment — gateway, RBAC, sub-registry, and the strategic case for centralized root-of-trust infrastructure. | | Code Mode: Let the Code do the Talking | Sunil Pai, Cloudflare | The 99.9% token reduction result and capability-based V8 sandbox architecture — the most concrete platform efficiency win at the conference. | | Harness Engineering: How to Build Software When Humans Steer, Agents Execute | Ryan Lopopolo, OpenAI | Detailed monorepo architecture, lint-enforced non-functional requirements, persona-based automated reviewer agents, and "Garbage Collection Fridays" — a complete platform engineering philosophy. | | CI/CD Is Dead, Agents Need Continuous Compute and Computers | Hugo Santos & Madison Faulkner, Namespace/NEA | The most urgent operational brief: how CI/CD breaks at agent scale and what the replacement architecture looks like, with concrete pre-merge queue and stateful compute patterns. | | How agent o11y differs from traditional o11y | Phil Hetzel, Braintrust | Custom storage architecture for gigabyte traces, Tantivy full-text indexing, and the case for treating observability and eval as the same underlying system. | | One Registry to Rule them All | Sonny Merla et al., Quantyca/Amplifon | Production-validated enterprise registry architecture spanning MCP servers, A2A agents, AI gateway, and use-case lineage — the most complete governance implementation at the conference. | | Fighting AI with AI | Lawrence Jones, Incident.io | File-system serialization of debug views, parallel sub-agent analysis pipelines, and the eval YAML CLI pattern — practical infrastructure patterns for debugging agentic systems at scale. | | Anthropic Workshop: Build Agents That Run for Hours | Ash Prabaker & Andrew Wilson, Anthropic | Generator-evaluator adversarial harness with Playwright MCP, sprint contract negotiation, and evidence that harness design determines quality ceiling more than model selection. |