AGNTCon + MCPCon Japan 2026

Debugging eats 42% of developer time — $300B lost globally every year. On an average, fixing an issue takes 15 days. Debug Assist does it in 30 minutes — issue alert to validated, reviewable PR.

Most AI debugging tools stop at root cause analysis. Debug Assist goes much further: it writes a fix, validates it in a loop till correct, and creates the PR. Example, It caught a crash at 5% rollout, landed the fix the same day — preventing it from reaching thousands of users. Built on LangGraph with 11 MCP servers, 5 plugins, and parallel subagents: Sourcegraph for code search, crash analytics, Jira, feature flags, Jaeger, and logging — all one protocol.

Debug Assist even works on user-reported bugs which have minimal information attached. A user complained of battery drain, and Debug Assist traced it to a hot-looping code path, producing an RCA from behavioral evidence alone.
Domain knowledge lives in markdown skill files in a plugin marketplace — any developer can contribute fix patterns with no code, no redeployment.

We'll share how we built this from ground up, scaled to 5,000 RCAs/month across 6 languages, the challenges we hit, and how we improved the acceptance rate from 5% to 30%.

___________________________
Presentation Language: English
Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

Every agent system is two things: the model, which you rent, and the mask - the character - which is yours. The industry keeps upgrading the model and expecting the mask to improve. It doesn't work that way.

I'm a LAMDA-trained actor turned agent engineer. This talk is the actor's toolkit applied to shipped systems. Case one: a comms pipeline in production at a major crypto protocol - the generating model does Stanislavski table-work (super-objective, through-action, lining) before writing a word; a separate director model audits it blind; and voice is scored by a Laban Movement Analysis classifier that grades the human-written corpus and the machine's output on the same instrument. Brand voice becomes a falsifiable measurement. Case two: the home lab - eleven agents built with a Stanislavski character method, orchestrated over MCP, running my actual work.

You'll leave with the model/mask distinction, a character pipeline you can copy, and the failure modes: drift, voice collapse, paint-by-numbers slop.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

Agent sandboxes are often described as ephemeral, but real MCP tool workflows are not. Agents edit files, install dependencies, run tests, download inputs, generate reports, and resume after failures. When workspace state is treated as disposable, reproducibility, isolation, and debugging become unnecessarily painful.

This talk presents a practical framework for designing durable volumes in agent sandboxes. Through a structured checklist — covering lifecycle management, tenant isolation, quotas, snapshots, read-only sharing, dependency caches, artifact retention, remount recovery, and audit trails — attendees will learn how to reason about workspace state systematically.

We then map these requirements to Kubernetes PersistentVolumes and explore the tradeoffs using JuiceFS CSI as a concrete open-source example. JuiceFS is used for its strong Kubernetes integration and snapshot capabilities, though the framework applies equally to local containers, serverless environments, and remote tool sandboxes.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

The AI industry has moved so fast that we are still evaluating probabilistic software using the same deterministic metrics we applied to traditional code. As a Product Analyst working on AI agents at PagerDuty, I saw a critical need for a new observability standard, one that moves beyond clicks to measure true reasoning and reliability. To address this, I’ve developed and open-sourced a specialized framework designed to help teams decide, with data, when to hire, train, or fire an AI agent. In this session, I will walk through the H.I.R.E. Framework methodology and share the technical architecture of an evaluation pipeline that turns qualitative conversational data into structured, actionable product insights. I will share the open-source repository containing these metric definitions and templates, providing resources for the community to move past agent-washing and toward building verifiable, trustworthy agentic systems.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

"Every MCP server, skill, and plugin in your coding agent is code or instructions you never really reviewed, running with your access to your database, your repos, and your keys. Three different ways in, and almost nobody is watching any of them."

Most of the agent security conversation is about prompt injection. Meanwhile there are three underserved vectors sitting right inside the tools you use every day:

- **MCP servers** run with the same access you have. One can look clean when you approve it and change its behavior later, or pull in a compromised dependency on the next run.
- **Skills and instruction files** (`SKILL.md`, `AGENTS.md`, `CLAUDE.md`, rules files) are just text. Nothing to install, nothing to flag. They quietly reshape what your agent does, and hidden instructions, zero-width characters, and pipe-to-shell tricks ride in the same way.
- **Plugins** bundle the first two together and ship through marketplaces with uneven vetting, so a single install can bring in both an MCP server and a skill you never opened.

I'll show where each one lives on disk, why the usual tooling misses it.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

AI coding agents are useful in isolated demos; the hard problem is making them controlled enough to ship production code. At Delphi, we built an agentic software factory that turns product specs and engineering tickets into scoped pull requests, then routes those PRs through reviewer agents, CI, browser verification, and merge gates.

This session breaks down the operating system around the agents: how we package repo context, encode architectural rules, isolate attempts in worktrees, make agents cite source-of-truth patterns, prevent drift from legacy code, and decide what should stay human-controlled. I will also cover failure modes we hit in production: stale context, over-broad diffs, flaky tests, review spam, false confidence, and agents copying the wrong pattern.

Attendees will leave with a practical blueprint for moving from “agent writes code” to a controlled delivery pipeline for agent-generated software.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

Teams are moving coding agents onto self-hosted open-weight models to control inference cost, and real sessions routinely span tens of turns and hundreds of thousands of tokens. But the only common signal for judging those models is the static accuracy benchmark, which says little about how a model behaves across a real, multi-turn session.

This session closes that gap with a trace-based evaluation method built on open technology: OpenTelemetry for capture and MLflow for analysis. Through a case study tracing real Claude Code sessions on a 120B-class open-weight model and a frontier model, it surfaces behaviors no leaderboard reports. For example, in the sessions we traced, the model's logged reasoning recorded a user's constraint, and the same turn violated it. An accuracy score sees only the wrong action; the trace shows the model had the rule in hand and did not follow it.

Attendees leave with a reusable observability architecture for their own agents, metrics that go beyond accuracy, and a clear view of what running a coding agent on open weights actually costs, in reliability and not only in dollars.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

AI coding agents now generate UI from component libraries. Most teams write component markdown files and expect agents to take it from there. The docs were complete. Agents still got it wrong.

Sitting with engineers in code review, the same things kept surfacing: the agent picked a visually similar but wrong component; it invented props; it read "Tag" as a UI primitive when the codebase meant a security concept. One author. No review process. A library too large for any agent to navigate without a map.

Not a component library talk. A talk about what the workflow was missing when the docs were already done.

I'll walk through the workflow that came out of those sessions: why a component file needs more than one author before agents can trust it; how an index changes what agents can find; and the naming decision that was invisible to humans and catastrophic for agents. Including the moment the team realized the problem wasn't the docs.

You'll leave with one reframe: a component library has always had two users. It now has a third. Here is what the workflow looks like when you build for all three.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

As AI agents move from local tests to real-world use, developers face a big problem: How do we easily find, direct, secure, and track AI traffic going to MCP servers? Standard API gateways do not understand LLM tool calls, and writing static lists of agents is too hard to manage.

In this hands-on workshop, we will connect AI agents and external tools easily using the standalone versions of Solo.io’s agentgateway and AgentRegistry. We will show you how to build a strong control layer for the Model Context Protocol (MCP) using simple local tools like Docker.

Participants will learn how to:

• Discover: Run AgentRegistry locally to list, version, and find MCP servers dynamically.

• Control: Set up agentgateway as a smart proxy to catch and manage agent requests.

• Secure: Add AI-specific rules, like rate limits and basic access control, to agent tool calls.

• Observe: See exactly which tools the agents are using and how fast they respond.

Join us to learn how to build a safe, easy-to-run foundation for your multi-agent systems right on your laptop!

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

Open protocols like MCP and A2A let you combine agents and tools from different teams into one system.

But at company-wide scale, new challenges arise: who can access the system, who can call which agent, whether it fails safely, and whether it follows internal governance. Coding agents now write most of the code, so the spec we give them shapes the whole system's quality.

We'll share how we tackled this from two sides on a company-wide MCP × A2A platform.

Architecture side: where to declare per-agent access, how to handle attribute-based authorization, how to split the write and read sides of authorization data, and how to stay fail-closed, mapped to standard authorization-control models.

Development-process side: a multi-stage review of the requirements given to coding agents, covering format, clarity, cross-walk with external standards, and adversarial testing. This catches auth and governance issues, plus input validation flaws and data leakage, before code is written.

You'll come away with ideas for an interoperable MCP/A2A authorization layer, a reusable way to gather enterprise-grade requirements, and a view of specs themselves as security assets.

___________________________
Presentation Language: Japanese

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

Coding-agent harnesses such as Claude Code, Codex, and OpenCode are widely used as general-purpose agent platforms, customized with Skills and Tools and run inside sandboxes. But these agents are stateless by design: when a session ends or a sandbox is torn down, context and artifacts disappear. Running them in production for many users over months turns memory and artifact management into hard problems.

This session shares how we run multiple harness-based agents in sandboxes, and introduces two open-source tools we built to externalize agent state. mem9 (github.com/mem9-ai/mem9) records sessions through harness hooks and, at the next session, runs hybrid retrieval over past sessions from the user's instruction, injecting only relevant history—persisting sessions while compressing context and cutting token usage. drive9 (github.com/mem9-ai/drive9) is a cloud filesystem FUSE-mounted into each sandbox, persisting artifacts beyond sandbox lifetimes, auto-attaching metadata, and enabling semantic search over outputs.

Attendees will leave with a vendor-neutral, open-source architecture for agent memory and storage that works across any harness, plus lessons from real operation.

___________________________
Presentation Language: Japanese

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

Most agentic payment systems enforce compliance through post-hoc log monitoring: detection after the fact, not prevention. This talk argues that cryptographic proof can replace compliance theater: an agent generates a zero-knowledge attestation that its intended payment satisfies policy constraints before execution.

We present Trust402, an open-source protocol demonstrating this model in production. Agents produce zero-knowledge proofs that verify spend limits, role permissions, and regulatory constraints. Circuits are proof-system-agnostic, enabling post-quantum upgrades without policy-layer changes.

Concrete takeaways:

• The wrapFetchWithProof pipeline: ZK proof generation composes into x402. No valid proof, no payment

• The role-spend-limit circuit: LessEqThan constraints mapping role membership and spend limits to provable gates

• Verification: ephemeral proofs, on-chain attestation per transaction

• Trade-offs: proving time vs. trust model, circuit expressiveness vs. policy complexity

Attendees leave understanding where ZK proofs fit in agentic payments, what's production-ready, and where the hard problems remain.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.