AGNTCon + MCPCon Japan 2026

From a green software perspective, waste in agentic AI comes not only from model choice, but also from workflow design. Agent workflows combine planning, retrieval, retries, memory, tools, and model calls. Poor controls can lead to large models for simple tasks, long histories, repeated retrieval, or needless tool calls, increasing compute, cost, and latency.

This talk presents a design-review approach for reducing unnecessary computation in agent workflows. As a case study, it uses Lean Agentic AI (https://github.com/navveenb/lean-agentic-ai) as an open-source workflow example. For each workflow step, it asks: Is an LLM needed? Is the model appropriate? Is context bounded? Could code, rules, or a smaller model replace a large-model call?

The goal is not precise carbon accounting. Instead, it identifies avoidable inference, oversized context, and needless tool calls before estimating CO2 emissions.

Takeaways:
* See how agent workflow design affects compute, cost, and latency.
* Understand how reducing unnecessary computation supports green software goals.
* Ask simple review questions to reduce unnecessary LLM calls, retrieval, memory, and tool use.

As autonomous agents move from experimental scripts to production systems, we’re exposing a massive flaw in how they’re built. We are giving LLMs the power to execute code, access files, and make network requests—essentially turning them into untrusted programs with direct authority over our infrastructure.

Prompt injection isn’t just a model quirk; it’s an open door to a massive attack surface. The moment an agent processes untrusted data, that input can hijack generated code, trigger outbound requests, and lead to data leaks or Server-Side Request Forgery (SSRF). Without proper guardrails, a highly capable agent is just a friendly interface over a Remote Code Execution (RCE) vulnerability.

This session reframes the entire security challenge. Instead of wasting time trying to make the model perfectly "safe," we’ll look at how to design infrastructure that stays secure even after the agent is compromised. By enforcing strict policy gates, we ensure that even if an agent is hijacked, it cannot access secrets, traverse your network, or execute privileged actions.

MCP UI lets servers return interactive application surfaces instead of plain tool results. But it raises a new question: what happens when the interface inside that surface is generated at runtime by the agent?

This talk shares lessons from building a Generative UI layer within MCP UI. MCP UI provides the app/resource boundary and host communication model, while frameworks like OpenUI provide the generated interface inside that boundary: a component registry, model-friendly UI language, streaming validation, form state, and explicit actions that route back to MCP tools.

The key shift is that MCP UI does not have to mean one fixed widget per tool result. A server can expose capabilities and context, the agent can generate the right interface for the task, and the host can still control rendering, permissions, actions, and observability.

The demo uses a data-dashboard workflow: an agent connects to a datasource, inspects data, generates an interactive dashboard with filters and drilldowns, then turns the result into persistent artifacts such as reports, documents, or slide decks.

A web service exposes /health; a phone line exposes nothing. The telephone is the oldest telecommunication tool still in production — and our LLM voice agents answer customer calls over it, with no way to know whether they are answering, hearing, and behaving correctly right now.

So we gave a frontier model a telephone.

Our MCP server gives any LLM a phone: dial PSTN numbers, speak via TTS, and read the other side via silence-detected transcripts. A frontier model becomes the caller, phoning our production voice agents in an agent-calls-agent loop — one mechanism covering the whole testing spectrum: ping-style health checks, deep evaluation via scripted and adversarial conversations, and load testing with concurrent caller fleets.

We cover the MCP tool design for a domain the spec wasn't written for — tools that block for tens of seconds, turn-taking over live audio, per-call session state — where the spec fought us and what we would feed back, plus what broke: timeout cascades and evaluations that flap.

We are open-sourcing the server. You'll leave knowing how to connect your own agent to the PSTN — and how to ping, probe, and load-test anything that answers a phone.