AGNTCon + MCPCon Japan 2026

From a green software perspective, waste in agentic AI comes not only from model choice, but also from workflow design. Agent workflows combine planning, retrieval, retries, memory, tools, and model calls. Poor controls can lead to large models for simple tasks, long histories, repeated retrieval, or needless tool calls, increasing compute, cost, and latency.

This talk presents a design-review approach for reducing unnecessary computation in agent workflows. As a case study, it uses Lean Agentic AI (https://github.com/navveenb/lean-agentic-ai) as an open-source workflow example. For each workflow step, it asks: Is an LLM needed? Is the model appropriate? Is context bounded? Could code, rules, or a smaller model replace a large-model call?

The goal is not precise carbon accounting. Instead, it identifies avoidable inference, oversized context, and needless tool calls before estimating CO2 emissions.

Takeaways:
* See how agent workflow design affects compute, cost, and latency.
* Understand how reducing unnecessary computation supports green software goals.
* Ask simple review questions to reduce unnecessary LLM calls, retrieval, memory, and tool use.

___________________________
Presentation Language: English
Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

As autonomous agents move from experimental scripts to production systems, we’re exposing a massive flaw in how they’re built. We are giving LLMs the power to execute code, access files, and make network requests—essentially turning them into untrusted programs with direct authority over our infrastructure.

Prompt injection isn’t just a model quirk; it’s an open door to a massive attack surface. The moment an agent processes untrusted data, that input can hijack generated code, trigger outbound requests, and lead to data leaks or Server-Side Request Forgery (SSRF). Without proper guardrails, a highly capable agent is just a friendly interface over a Remote Code Execution (RCE) vulnerability.

This session reframes the entire security challenge. Instead of wasting time trying to make the model perfectly "safe," we’ll look at how to design infrastructure that stays secure even after the agent is compromised. By enforcing strict policy gates, we ensure that even if an agent is hijacked, it cannot access secrets, traverse your network, or execute privileged actions.

___________________________
Presentation Language: English

MCP UI lets servers return interactive application surfaces instead of plain tool results. But it raises a new question: what happens when the interface inside that surface is generated at runtime by the agent?

This talk shares lessons from building a Generative UI layer within MCP UI. MCP UI provides the app/resource boundary and host communication model, while frameworks like OpenUI provide the generated interface inside that boundary: a component registry, model-friendly UI language, streaming validation, form state, and explicit actions that route back to MCP tools.

The key shift is that MCP UI does not have to mean one fixed widget per tool result. A server can expose capabilities and context, the agent can generate the right interface for the task, and the host can still control rendering, permissions, actions, and observability.

The demo uses a data-dashboard workflow: an agent connects to a datasource, inspects data, generates an interactive dashboard with filters and drilldowns, then turns the result into persistent artifacts such as reports, documents, or slide decks.

___________________________
Presentation Language: English

This session presents a lightweight AI assistant built to help a Security Assurance team review policy exception tickets more efficiently. The assistant summarizes tickets, generates follow-up questions, and maps requests to internal standards to support faster reviews.

The solution uses GitHub Workflows, a custom MCP server and client written in Go, ServiceNow integration, and Python-based evaluation. We used RAGAS to assess relevance and hallucination risk, and verified that the assistant retrieved internal standards through MCP calls.

We will share early results, including meaningful time savings in ticket review, as well as practical challenges such as stakeholder alignment, service account access, and the difficulty of evaluating correctness in security workflows. Attendees will leave with a practical blueprint for building a standards-grounded AI workflow for security review. In our implementation, the initial review step dropped from about 60 minutes of manual effort to about 50 seconds of automated generation plus validation, a time savings of roughly 98.6% per ticket.

___________________________
Presentation Language: English

A web service exposes /health; a phone line exposes nothing. The telephone is the oldest telecommunication tool still in production — and our LLM voice agents answer customer calls over it, with no way to know whether they are answering, hearing, and behaving correctly right now.

So we gave a frontier model a telephone.

Our MCP server gives any LLM a phone: dial PSTN numbers, speak via TTS, and read the other side via silence-detected transcripts. A frontier model becomes the caller, phoning our production voice agents in an agent-calls-agent loop — one mechanism covering the whole testing spectrum: ping-style health checks, deep evaluation via scripted and adversarial conversations, and load testing with concurrent caller fleets.

We cover the MCP tool design for a domain the spec wasn't written for — tools that block for tens of seconds, turn-taking over live audio, per-call session state — where the spec fought us and what we would feed back, plus what broke: timeout cascades and evaluations that flap.

We are open-sourcing the server. You'll leave knowing how to connect your own agent to the PSTN — and how to ping, probe, and load-test anything that answers a phone.

___________________________
Presentation Language: Japanese

The next leap in agent engineering is not bigger models. It's reusable skills.

Today, many agents repeatedly spend tokens rediscovering the same workflow every time a task appears. Whether it's code reviews, incident analysis, documentation generation, or research tasks, the agent often re-plans work it has already solved before.

This talk explores how agent skills are emerging as reusable workflow primitives that package expertise, decision-making patterns, and execution steps into portable capabilities. Instead of relying on increasingly large prompts, teams can teach agents repeatable workflows once and reuse them across tasks, products, and environments.


Key Takeaways

- Why prompts don't scale for repetitive work
- Skills as reusable workflow contracts
- Reducing token consumption through workflow reuse
- How skills and MCP work together
- Building self-improving agent systems

___________________________
Presentation Language: English

Most agent memory is a chat log with extra steps. Dump turns into a vector store, retrieve the top-k by cosine similarity, and hope the right context shows up. It usually doesn't, and the agent pays for it three turns later.

Agentmemory MCP Server began as a fix for that. It combines BM25, dense vector search, and a knowledge graph, fuses them with reciprocal rank fusion, and ages stored memories on an Ebbinghaus forgetting curve so old context decays instead of drowning new signal. On LongMemEval-S it reaches 95.2% recall at 5. The repo trended on GitHub, ranked on Product Hunt, got picked up by AlphaSignal, and was recognized by the Agentic AI Foundation, none of it paid for.

This talk covers how it was built and where the easy version breaks. Single-method retrieval looks fine in a demo and falls apart on long histories. I'll show why each method earns its place, how the pieces compose with one engine an agent can query over MCP, and which design decisions held up once real workloads hit them.

You'll leave with a memory model that beats top-k vector search and a clear picture of how to expose it to agents through MCP.

___________________________
Presentation Language: English

AI coding assistants are becoming part of everyday development, but many enterprises cannot send source code, internal APIs, or project context to external services. They need the productivity of coding agents while keeping models, repositories, prompts, and actions under their control.

In this session, we’ll show how to build an open-source, Claude Code-like assistant using local or privately hosted LLMs, Models as a Service, OpenCode, and AI guardrails. Developers will be able to explore a codebase, generate changes, review explanations, and trigger controlled actions without exposing sensitive data.

We’ll also cover the guardrails needed for real use: secrets protection, data leakage checks, unsafe command blocking, insecure code detection, and policy-based action control.

You’ll leave with a practical blueprint for building a private, secure coding assistant that improves developer productivity without compromising trust, privacy, or compliance.

___________________________
Presentation Language: English

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.

Coding-agent harnesses such as Claude Code, Codex, and OpenCode are widely used as general-purpose agent platforms, customized with Skills and Tools and run inside sandboxes. But these agents are stateless by design: when a session ends or a sandbox is torn down, context and artifacts disappear. Running them in production for many users over months turns memory and artifact management into hard problems.

This session shares how we run multiple harness-based agents in sandboxes, and introduces two open-source tools we built to externalize agent state. mem9 (github.com/mem9-ai/mem9) records sessions through harness hooks and, at the next session, runs hybrid retrieval over past sessions from the user's instruction, injecting only relevant history—persisting sessions while compressing context and cutting token usage. drive9 (github.com/mem9-ai/drive9) is a cloud filesystem FUSE-mounted into each sandbox, persisting artifacts beyond sandbox lifetimes, auto-attaching metadata, and enabling semantic search over outputs.

Attendees will leave with a vendor-neutral, open-source architecture for agent memory and storage that works across any harness, plus lessons from real operation.

___________________________
Presentation Language: Japanese

Captioning will be available for attendees in 50+ languages through Wordly. See instructions in each room to utilize captioning.