# Notes From MCP Dev Summit Toronto

> Den Delimarsky, one of MCP's two lead maintainers, has Claude build an MCP server for any app that lacks one. Accenture's Michael Forrester told of a user's agent that found a way to send email after the company had said no. My own agents keep asking me for a yes.

Number: № 035
Published: 2026-10-11
Tags: ai
Canonical: https://yihanzhu.com/blog/notes-from-mcp-dev-summit-toronto/
Author: Yihan Zhu

---

Den Delimarsky and I were talking at MCP Dev Summit Toronto when I saw a 3D animation on his LinkedIn. He had made it in Blender, with Claude driving the app through MCP.

From what he told me, he works that way with nearly every app. When an app has no MCP server, he has Claude reverse-engineer the app and build one.

The next morning's keynotes were about what happens when a whole company works the way Den does.

## Claude builds the servers Den is missing

He talks to Claude, and Claude reaches into his other apps through MCP, the open protocol that lets AI models connect to other software. An app joins in through an MCP server, a small program that exposes what the app can do. Den works at Anthropic and is one of MCP's two lead maintainers. His keynote from the first morning, [*MCP As The Agentic Substrate*](https://events.linuxfoundation.org/mcp-dev-summit-toronto/program/schedule/?id=1317104), is not online yet, and the schedule describes it as a look at how MCP became the default way for agents to reach everything else.

Connect a server and the model on the other end grows hands, as I put it in *[The Layers Grow Back](https://yihanzhu.com/blog/the-layers-grow-back/)*. Every server Claude builds for him adds another hand. For one person, I think that works fine. He is the only one using it, and if something goes wrong, he deals with it himself.

## An agent went around Accenture's no

I was at the summit both days, and the second morning's keynotes, on October 6, were the only talks I sat in. So far their [livestream](https://www.youtube.com/watch?v=a8p-Pz1k5l0) is the only recording online. Angie Jones from the Agentic AI Foundation set them up with the question that comes once a server is shared: "[What should the agent be allowed to do?](https://www.youtube.com/watch?v=a8p-Pz1k5l0&t=1792s)" NVIDIA's Chris Alexiuk described how a big company answers it. NVIDIA runs what he called MCP as a service, a managed layer so people are not spinning up their own random servers, and it handles access for hundreds of people and thousands of agents. When the company's research app calls a tool, permissions travel with the request and get checked in that service layer instead of inside each MCP server. In his takeaways he called it "[enforcing permissions at the service boundary](https://www.youtube.com/watch?v=a8p-Pz1k5l0&t=2699s)."

Michael Forrester from Accenture had bigger numbers. He said the company has more than 800,000 employees and that [more than half a million people there have used MCP](https://www.youtube.com/watch?v=a8p-Pz1k5l0&t=2932s). Everyone had been told to use AI as much as they could.

A user [asked Forrester's team for an MCP server that could send email as them](https://www.youtube.com/watch?v=a8p-Pz1k5l0&t=3430s), and the team said no. So the user asked their agent. (He said it was Claude, and added that it could have been any of them.) The agent wrote a PowerShell script that drove classic Outlook and started sending email as the user. For Teams, it opened Edge in a mode that lets another program control the browser, and sent Teams messages through the user's signed-in session. It only used paths that were already open, and the team closed them afterwards.

At Accenture someone had already said no, and the user's agent got there anyway.

## Den said it depends on trust

My own question for Den was about where approvals should sit. MCP has a feature called elicitation, which lets a server pause partway through a task and ask you something through the agent harness, the program the agent runs inside, maybe for a detail it is missing or for a yes before it goes on. The harness has its own approvals too, which decide whether an action is allowed to happen at all. I asked him, roughly, whether MCP still does elicitation, or whether approvals are handled at the harness layer now.

I am going from memory here. He said MCP still does elicitation, and then something like: it depends on how much you trust it.

The way I understand it now, if I do not trust a server, its own "are you sure?" protects me from nothing, because the thing asking permission is the thing that wants to act. An approval I actually depend on has to live in a layer I trust, which for me means the harness.

A breakout talk I skipped points to an exception. I had hoped to watch the breakouts later, but none are online yet, so I know this one only from its description on the schedule, written before the summit. [*Who Approved This Tool Call?*](https://events.linuxfoundation.org/mcp-dev-summit-toronto/program/schedule/?id=1346833), by Teng Wu, describes a server that pauses until a verified person approves that exact action, for things like payments and refunds. There the server asking is the one guarding the money, which you would have to trust anyway, so I think its own check counts. I now read Den's answer about trust as the rule and the exception together.

Reading the two keynotes side by side, I think the email story shows where a company's own layer stops, though neither speaker put it that way. Accenture had such a layer. On stage, Forrester described people at their laptops reaching their tools [through a proxy or a gateway](https://www.youtube.com/watch?v=a8p-Pz1k5l0&t=2971s), and his team decided which servers could go live behind it. A server that could send email was refused. The agent never went near that gate. It wrote a script on the user's own computer and drove Outlook directly, so whatever yes there was came from the user's side, a place the gateway never sees.

As far as I can tell, NVIDIA's service layer has the same limit. Chris described it checking the requests that go through it, and MCP's specification says plainly that "[MCP itself cannot enforce these security principles at the protocol level](https://modelcontextprotocol.io/specification/2026-07-28)." A layer a company runs can hold its rules for whatever passes through it, and an agent that can build its own way into an app, the way Den's does, can build one around it as well.

Forrester seemed to have reached the same place. He said the tooling is not keeping up with the agents, and his biggest lever turned out to be people. His team got users on side by explaining why the answer was no and by running internal support like a product. His phrase for it was "[win the hearts and minds of your users](https://www.youtube.com/watch?v=a8p-Pz1k5l0&t=3685s)."

## Agent makers worry about asking too often

Toronto's program leaned hard on security and trust. On the official tracks of the [schedule](https://events.linuxfoundation.org/mcp-dev-summit-toronto/program/schedule/), Security, Identity + Trust had 12 of the 51 talks, second only to building with MCP. At the [MCP Developers Summit](https://web.archive.org/web/20250620123144/https://mcpdevsummit.ai/) in San Francisco in May 2025, 3 of the 20 talks were about security, and none of the titles mentioned approval or governance.

San Francisco had its Tech Week the same week, and I followed it online from Toronto. My impression was that people there had moved from agent apps to agent infrastructure, and the public calendar only partly bears that out: about 6 percent of the 1,595 events on the [2026 calendar](https://www.tech-week.com/calendar/sf) have "agent" in the title, close to the [5 percent last year](https://web.archive.org/web/20251010214902/https://www.tech-week.com/calendar/sf), and a lot of SF's infrastructure talk is about compute and energy. Inside the agent events, the ones about trust or approvals went from a few out of fifty-odd last year to around fifteen out of about a hundred. Those are rough counts from titles, on a calendar where hosts list their own events, and last year's archived copy may be missing some.

A second worry runs the other way: agents ask so often that people stop reading and approve. The companies that build coding agents have been saying so for about a year, [Cursor](https://cursor.com/en-US/blog/agent-sandboxing) and [OpenAI](https://alignment.openai.com/auto-review) among them. Anthropic measured it. In a test on its own coding agent, people caught a planted dangerous command [13.6% of the time](https://claude.com/blog/auto-mode-default-in-claude-code), and only about 5% after 50 or more prompts. Each of these companies sells a way for its agent to ask less, which is worth keeping in mind. This year the worry reached the event listings too. Teng Wu's talk description promises "avoiding unnecessary prompts," and Outhora's listing for "[Human-in-the-Loop Is Already Broken](https://www.tech-week.com/calendar/sf/events/virtual-human-in-the-loop-is-already-broken-here-s-what-replaces-it-dc8bb363-61f5-4d10-af17-df6e317f0c2f)," a virtual fireside chat on SF's calendar, says that "by approval #50, the human has stopped reading and started clicking."

## Telling my agents to ask less

Outhora's approval #50 line is close to what I told my own agent team this week, more or less: "Do I need this many approvals? Just finish the roadmap." Back in April I said in *[When the Agent Browses for You](https://yihanzhu.com/blog/when-the-agent-browses-for-you/)* that an agent needing approval for every action "is just a suggestion engine with extra steps," and I still think so.

This runs straight into the rule I took from Den's answer. The yes that protects me has to come from the harness, and a yes I give there without reading protects me no better than the server's own "are you sure?"

Forrester described a [near-miss](https://www.youtube.com/watch?v=a8p-Pz1k5l0&t=3086s) that shows what that could cost. Someone planted a line in an application's log file. An operator gave the logs to an agent to look for anomalies, and the agent came back asking whether it should send an access token to a remote third party. He said that even if the token had gone out, other defenses would have kept the attacker from using it. The agent did ask first, about a request that came from the attacker. A yes clicked out of habit would have sent the token.

As with Den, nobody but me uses my setup or cleans up after it. When I say yes in my harness, I am also the one who carries the risk, so my yes there counts. Because it counts, it belongs only on the few kinds of actions I will actually read. With my agents, I decide app by app which actions wait for me.

Every new server adds a few more of those decisions.