AGNTCon + MCPCon Japan 2026

As organizations build more capable agents, those agents will need a common way to communicate and work together across frameworks, vendors, and platforms. This keynote examines the current state of A2A, the problems it is designed to solve, and where the project is headed. We'll also see A2A in action through a production multi-agent system, including what happens when one of its agents is compromised.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

Automating scientific research is one of the most important uses of AI agents, and as agents grow more autonomous, it is quickly becoming realistic. We can already let an agent run research that takes hours or even days.
The main challenge is not whether the agent finishes, but how much we can trust the results it reports. A result that looks successful may come from a misunderstood setup or a manipulated metric. Checking it by hand is hard, and asking another agent to check it only moves the problem one step further.
Being too strict is also risky. A good idea does not always give results quickly, and it is easy to find reasons to call a result a failure. A system that rejects too easily throws away promising research, while ideas that lead nowhere should be stopped early. Balancing proper rejection and reliable acceptance is the hardest part of automated research.
Based on my experience running agentic research-automation systems, I will explain how these problems appear in long-running tasks and the approaches we are developing to keep research reliable.
You will leave with a practical framework for trusting and using long-running autonomous agents in research and beyond.

___________________________
Presentation Language: Japanese

As AI agents move from experimentation to production, authorization is becoming a core architectural concern. The MCP Authorization specification provides a standardized approach for protecting MCP resources and obtaining access tokens, but many developers have not yet seen these mechanisms in action.

In this hands-on workshop, participants will build a secure MCP environment using Keycloak, agentgateway, and MCP Inspector. Starting from an MCP server where all tools are publicly accessible, attendees will progressively introduce authorization controls using Keycloak and agentgateway, and observe how access to MCP tools changes.

Participants will use MCP Inspector to follow authorization flows step by step, including resource discovery, authorization server discovery, user authentication, token acquisition, authorization failures, and authorized tool invocation.

The workshop also explores Step-Up Authorization scenarios introduced in the latest MCP Authorization specification.

By the end of the session, participants will have a working MCP Authorization environment and practical experience securing MCP-based AI agent systems.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

From a green software perspective, waste in agentic AI comes not only from model choice, but also from workflow design. Agent workflows combine planning, retrieval, retries, memory, tools, and model calls. Poor controls can lead to large models for simple tasks, long histories, repeated retrieval, or needless tool calls, increasing compute, cost, and latency.

This talk presents a design-review approach for reducing unnecessary computation in agent workflows. As a case study, it uses Lean Agentic AI (https://github.com/navveenb/lean-agentic-ai) as an open-source workflow example. For each workflow step, it asks: Is an LLM needed? Is the model appropriate? Is context bounded? Could code, rules, or a smaller model replace a large-model call?

The goal is not precise carbon accounting. Instead, it identifies avoidable inference, oversized context, and needless tool calls before estimating CO2 emissions.

Takeaways:
* See how agent workflow design affects compute, cost, and latency.
* Understand how reducing unnecessary computation supports green software goals.
* Ask simple review questions to reduce unnecessary LLM calls, retrieval, memory, and tool use.

___________________________
Presentation Language: English
Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

Kubernetes upgrades are high-stakes, deprecation-laden, and still mostly manual — most "AI for K8s upgrades" projects stop at a feasibility check. We went further: we built an agentic system that planned and executed a real cluster upgrade end to end, and in this talk we walk through exactly how it went, with the steps, evidence, and screenshots from our actual runs.


We'll break down the architecture we shipped — a planner → executor → verifier loop, deprecated-API and CRD/Helm compatibility analysis run before anything touched the cluster, a human-in-the-loop approval gate for irreversible steps, and health-gated automatic rollback. Using captured logs and screenshots, we'll show a real multi-node upgrade as it happened, the failure cases that nearly broke it (version skew, stuck drains, webhook deadlocks), and the decisions we deliberately refused to let the model make.


___________________________
Presentation Language: English
Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

Run the same prompt twice and you get two different agents. Both work. Neither is the same. If you ship agents to customers rather than demos, this is a failure mode you already know, and it is why agent work has not industrialized.

Today's AI coding is 3D printing: brilliant for one-offs, unreliable at scale. Assembly is the alternative, and agents have finally converged enough to make it possible. They have a bill of materials: model, harness, interface layer, state, tool integrations. Open source ships every part. Nobody ships the guarantee that two of them work together.

You will leave with the six-station line we run, why moving the model from author to assembler cuts variance and token spend at the same time, the compatibility matrix we maintain, and the list of component pairs that deadlock, which is the part almost nobody publishes.

We will also name what assembly does not fix, and where reproducibility stops being enough.

---

In order to facilitate networking and business relationships at the event, you may choose to visit a third party's booth or access sponsored content. You are never required to visit third party booths or to access sponsored content. When visiting a booth or participating in sponsored activities, the third party will receive some of your registration data. This data includes your first name, last name, title, company, address, email, standard demographics questions (i.e. job function, industry), consenting to receipt and use of such data by the third-party recipients, which will be subject to their own privacy policies. 

___________________________
Presentation Language: English

As AI agents increasingly invoke tools, access enterprise data, and collaborate, a new architectural challenge emerges: Where should trust boundaries be defined, and where should governance and security controls be enforced?

To explore this, we conducted a technical PoC introducing a shared control layer across agent-to-agent communications and tool execution pathways. Rather than presenting an ideal architecture, this session focuses on practical challenges and lessons learned during implementation.

Key topics include:
- Defining the "Agent": How to define what constitutes an agent in an ecosystem and where to establish trust boundaries for validation, monitoring, and control
- Architectural Insights: Redesign considerations and insights that emerged through prototype development and PoC activities.
- Performance Trade-offs: Balancing stronger security and governance with the low-latency requirements needed for real-world deployment.

We will share practical takeaways on designing trust boundaries and navigating trade-offs among security, governance, and operational performance.

___________________________
Presentation Language: Japanese

The first wave of MCP adoption was defined by abundance. Every API endpoint became a tool, every workflow became a collection of tool calls, and many servers exposed hundreds of operations directly to agents. It worked, but at a cost: bloated context windows, slower tool selection, and increasingly unreliable agent behaviour.

But then Code Mode appeared!

With approaches Code Mode agents can search an API surface, generate code, and interact with services directly. If models can consume entire APIs and write code to acomplish a task, does tool design still matter?

In this talk, we'll compare three approaches to agent tooling: curated workflow-oriented tools, tool discovery and search, and Code Mode's search-and-execute model. Using real-world examples, benchmarks, and evals, we'll explore the trade-offs in reliability, latency, token usage, and task success.

Attendees will leave with a practical framework for deciding when to consolidate tools, when to expose APIs, and whether the future of MCP is better tools or fewer tools altogether.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

AI agent discussions often focus on coding or MCP. My starting point is different. I use coding agents such as Claude Code and Codex as assistants for work beyond development. Instead of automating isolated tasks, I keep them beside me as a secretary and knowledge platform for routine operations, speaking requests, internal coordination, slide preparation, and customer-facing project delivery.

That daily use reveals agent-worthy problems. With Markdown, Git, Google Workspace, and MCP in the loop, work becomes context an agent can read, improve, and hand back. I then turn those problems into agents I build, deploy, review, and operate myself.

I will cover Vibe Presales, my term for turning a customer's concerns, constraints, and reactions in a presales conversation into a working demo while the context is fresh. I will also share lessons from a PowerPoint-building agent, including design, deployment, review, and output quality for real slide and proposal work.


___________________________
Presentation Language: English
Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

As autonomous agents move from experimental scripts to production systems, we’re exposing a massive flaw in how they’re built. We are giving LLMs the power to execute code, access files, and make network requests—essentially turning them into untrusted programs with direct authority over our infrastructure.

Prompt injection isn’t just a model quirk; it’s an open door to a massive attack surface. The moment an agent processes untrusted data, that input can hijack generated code, trigger outbound requests, and lead to data leaks or Server-Side Request Forgery (SSRF). Without proper guardrails, a highly capable agent is just a friendly interface over a Remote Code Execution (RCE) vulnerability.

This session reframes the entire security challenge. Instead of wasting time trying to make the model perfectly "safe," we’ll look at how to design infrastructure that stays secure even after the agent is compromised. By enforcing strict policy gates, we ensure that even if an agent is hijacked, it cannot access secrets, traverse your network, or execute privileged actions.

___________________________
Presentation Language: English

This session presents a lightweight AI assistant built to help a Security Assurance team review policy exception tickets more efficiently. The assistant summarizes tickets, generates follow-up questions, and maps requests to internal standards to support faster reviews.

The solution uses GitHub Workflows, a custom MCP server and client written in Go, ServiceNow integration, and Python-based evaluation. We used RAGAS to assess relevance and hallucination risk, and verified that the assistant retrieved internal standards through MCP calls.

We will share early results, including meaningful time savings in ticket review, as well as practical challenges such as stakeholder alignment, service account access, and the difficulty of evaluating correctness in security workflows. Attendees will leave with a practical blueprint for building a standards-grounded AI workflow for security review. In our implementation, the initial review step dropped from about 60 minutes of manual effort to about 50 seconds of automated generation plus validation, a time savings of roughly 98.6% per ticket.

___________________________
Presentation Language: English

MCP grants AI agents access to file systems, Git, cloud, and SaaS. Yet permission models — IAM, OAuth scopes, PATs — were built for humans and fall short for AI.

The issue isn’t granularity. Existing permissions assume “human rationality” as a boundary: write access doesn’t mean a human wipes a repo; CI write access doesn’t mean a human exfiltrates secrets. Permissions stay broad because human judgment fills the gap. AI lacks this buffer — through prompt injection or edge cases, it acts destructively where a human would stop. Per-call approval collapses under fatigue.

As an SRE on strong production credentials, my question wasn’t “how to restrict AI” but “how to maximize safe delegation.”

I propose Intent as Code: coding what was left to human rationality. Three OSS tools:
safe-push rejects pushes touching .github/ or others’ commits, preventing CI hijacking
safe-gh wraps gh CLI with conditions like “only own issues” or “only approved PRs to develop” — expressing intent PATs can’t
safe-webfetch uses Claude Code Hooks to auto-allow learned-safe URLs, cutting fatigue decisions

Attendees leave understanding why permissions fall short for AI, with patterns to apply.

___________________________
Presentation Language: Japanese

A web service exposes /health; a phone line exposes nothing. The telephone is the oldest telecommunication tool still in production — and our LLM voice agents answer customer calls over it, with no way to know whether they are answering, hearing, and behaving correctly right now.

So we gave a frontier model a telephone.

Our MCP server gives any LLM a phone: dial PSTN numbers, speak via TTS, and read the other side via silence-detected transcripts. A frontier model becomes the caller, phoning our production voice agents in an agent-calls-agent loop — one mechanism covering the whole testing spectrum: ping-style health checks, deep evaluation via scripted and adversarial conversations, and load testing with concurrent caller fleets.

We cover the MCP tool design for a domain the spec wasn't written for — tools that block for tens of seconds, turn-taking over live audio, per-call session state — where the spec fought us and what we would feed back, plus what broke: timeout cascades and evaluations that flap.

We are open-sourcing the server. You'll leave knowing how to connect your own agent to the PSTN — and how to ping, probe, and load-test anything that answers a phone.

___________________________
Presentation Language: Japanese