Fast MCP

Your Insecure MCP Server Won't Survive Production — Tun Shwe, Lenses

Apr 8, 2026 · 24:34

Tun Shwe and Jeremy Frenay from Lenses.io argue that poorly designed MCP servers are inherently insecure, and propose five core design principles—shrink attack surface, constrain inputs, treat docs as defense, return minimal data, minimize blast radius—that also thwart OWASP's MCP Top 10. They highlight that standard I/O fails under load (20 of 22 requests failing with 20 concurrent connections), forcing a shift to streamable HTTP with OAuth 2.1. Jeremy details Dynamic Client Registration (DCR) and the newer Client ID Metadata Document (CIMD) approach, noting DCR's vulnerabilities (phishing, non-portable registrations) and CIMD's stronger identity verification since November 2025. Beyond OAuth, enterprise deployment requires tool-level RBAC, data masking for PII, full audit logs, and end-to-end tracing to meet regulations like the EU AI Act.

Building Agents at Cloud Scale — Antje Barth, AWS

Aug 2, 2025 · 19:00

AWS Principal Developer Advocate Antje Barth demonstrates how to build and scale AI agents using cloud-native patterns, arguing that specialized agents will reinvent customer experiences. She showcases Alexa Plus, which orchestrates hundreds of expert systems across 600M+ devices and tens of thousands of services, and the Amazon Q Developer CLI agent, shipped in just three weeks. Barth introduces Strands Agents, an open-source Python SDK for building production-ready agents that supports multiple model providers (Claude, Llama, OpenAI) and over 20 prebuilt tools including memory, RAG, and multi-agent workflows. She demonstrates integrating MCP servers via Lambda with DynamoDB for session storage, and previews upcoming A2A protocol support and a future of personal agents connecting to agent stores.