8 takeaways from Agentics Day: MCP + Agents

The KubeCon co-located event put AI agent production lessons in the spotlight.

On November 9, I spent most of my day at Agentics Day: MCP + Agents, the co-located conference held the day before KubeCon NA 2026 officially began in Salt Lake City, Utah.

The presentations spanned a number of areas that tackled the on-the-ground realities of putting agents into production. How do we handle agent communication? How can we limit threats? What is the role of MCP?

Below, I'll look at a handful of key lessons from the event. I wasn't able to attend every session, so this isn't comprehensive, but hopefully it gives a sense of where the landscape is at.

1. Agents are (still) on the rise

First, the opening lines of many talks acknowledged that agents are rapidly on the rise: agentic traffic is increasing exponentially, more agents are in use, and what they can do is increasingly actionable.

With that sudden shift come new concerns across security, protocols, ongoing maintenance and infrastructure, all areas Agentics Day was primed to explore.

2. Agentic AI needs open foundations

As Manik Surtani, co-founder and CTO at the Agentic AI Foundation, said, "open is not enough." Too often, a heavily relied-upon "open-source" solution is actually at the mercy of a single vendor, which might end maintenance or delete it, depending on its product roadmap.

In his opening keynote, Surtani explained this is the core reason the Agentic AI Foundation was formed: to be a neutral governing body for new standards. "Nobody wanted to bet their entire business on infrastructure that ultimately one company would control," he said.

The foundation has grown rapidly. It's only one year old, yet it supports a growing list of projects, from goose, MCP and AGENTS.md to recent donations like Anthropic's Agent Skills and OpenAI's Open Responses.

The takeaway is that we need openness at the protocol layer to create an interoperable agentic AI ecosystem.



3. Agents need internal knowledge

Enterprise knowledge is often hard to navigate and sits behind authentication, which keeps agents from getting the context they need to make better engineering recommendations.

So, how do we ground AI agents in enterprise coding knowledge? At Apple, the answer is building an enterprise knowledge base for AI agents. Apple's Spandana Balumuri and Nirav Jain presented on how they're doing this in practice with their knowledge platform.

Their system uses crawlers to continually index documentation at build time, stores it in a vector database, and then exposes it as REST APIs or MCP servers.

Enterprises have thousands of internal systems to navigate, and the manual workflow doesn't scale. So, figuring out how to expose knowledge platforms to AI agents will be important for bringing domain context to LLMs.

4. Agents need to stop polling

How do we get around constant polling with agents? Aman Singh from Microsoft Azure demoed how Drasi, a new data change processing platform, could support event streams within an agent-driven order fulfillment platform.

Drasi is a Cloud Native Computing Foundation (CNCF) sandbox project that gives agents an easier way to both choose which MCP tools to use and subscribe to event streams, using a single line of code.

Singh shared that Drasi currently works with Dapr Agents, but the goal is to integrate it with Microsoft Agent Framework, Google ADK and others. A new MCP Events extension is in the works, too.

The latter will give agents a standard way to list and subscribe to event streams, making them more reactive. It's something to keep an eye on in the MCP ecosystem!



5. Agents bring new threat vectors

Agents and their underlying LLMs bring nuanced threats, many of them surrounding MCP. eBay's Saurabh Yergattikar and Audible's Harshul Jain explained that the big gap is that LLMs can't tell data from instructions, opening the door to poisoning and injection-style attacks.

Looking at various real-world attacks, tool poisoning succeeded 61-73% of the time, and chained tool attacks succeeded more than 90% of the time.

They recommended SAFE-MCP, an open source framework that maps more than 100 MCP threats. It could help inform DIY automated analysis and checks for MCP security gaps.

They also recommended using a proxy at the MCP transport layer, and pointed to an open source option, ShieldMCP, which checks what's sent between the agent and server and analyzes responses, too.

6. MCP should learn from APIs' history

"MCPs are like APIs, also sort of not really." Baruch Sadogursky, head of DevRel at Port, gave a steampunk-esque introduction to MCP and APIs.

His point was the big consumer shift. Whereas developers are smart and rational, agents are nondeterministic and stochastic, without a concept of right or wrong. As he put it, "If we give infinite monkeys infinite time, they will produce the entire corpus of Shakespeare."

That's alarming, since we don't really know how many MCPs are in use. "How many know how many MCPs agents are accessing in their organization?" he asked. Two hands went up in the audience.

The solution is to see what MCPs we have, log them and limit them, bringing the same controls we use for APIs: access control, authentication, monitoring and governance.



7. Agents can run at scale on Kubernetes

When you have thousands of users calling multiple service-based agents, running concurrently, you now have a distributed systems problem, said Intuit's Derek Wang.

Wang described Kynomesh, an open source multi-agent orchestration platform for placement, discovery, scaling and rollout on Kubernetes. He showed it off in a live demo of a multi-agent system involving a hotel, flight and planner agent.

One interesting aspect of the platform is that it can specify exactly how agents communicate, whether through top-down orchestration, agent-to-agent handoffs or only sequentially.

8. Multi-agent traffic requires mediation layers

The significant growth of agentic traffic also requires work at the gateway layer. Cisco's Pradheep Shrinivasan demonstrated the company's MCP/LLM gateway, and Google's Boteng Yao emphasized its egress agent gateway traffic policy. Both pointed to Envoy as a bedrock for agent gateways.

The future looks toward production-ready agent infrastructure, with more focus needed on orchestration, identity-based security and egress control, and smarter LLM routing.

In the same way API gateways became standard practice, we essentially need to adopt MCP gateways, said Sadogursky.

The incoming focus: local AI

All this talk of agents and MCP is great, but it misses something happening at the model layer: a big shift toward local AI.

What's coming next is owning your own models, said Ralph Squillace, principal product manager at Microsoft. "You can own your own models. You can own your own data. In Kubernetes, this is happening now."

The benefits of retraining models? You own your data, control costs and get more precise results for your specific workloads. "Every industry will do this," and it's already starting, he added.

"Make this the year of open weights," he said. He recommended tools like AI Runway, Agent Substrate, KAITO, llm-d, vLLM, Dynamo and ONNX to get open-weight models running and trained.

Laying down the plumbing

"The plumbing to the agentic age is being made right now," said Surtani.

We're clearly at the start of a large movement, and the protocols are still evolving. The community growth around the AAIF is telling, too.

MCP will continue to play a central role, while operators repurpose proven infrastructure like Envoy and Kubernetes.

So, after the pipes are in, what's next? We let the agentic firehose go strong, I suppose.