Full transcript
0:07[music]
0:14>> All right. Um so everyone, I'm uh Karan
0:18Sampath. I'll be talking to you about
0:22how we Anthropic think about MCPs in the
0:24enterprise. I've alternatively titled
0:27it, I think more catchily, is why we
0:28think gateways are all you need. Um so
0:31before I go into the talk, uh I'm going
0:33to quickly tell you a bit about me. I
0:34was uh I'm a forward deployed engineer
0:36at Anthropic, um
0:37first one outside uh the US. Uh a lot of
0:40my work includes working with
0:42enterprises on things like MCPs, and I
0:44also work on our internal use cases. In
0:47this talk, I'm going to be
0:49positing to you what we think the
0:51problems with enterprises, what
0:53enterprises face with MCPs today, why we
0:56think gateways and the the necessary
0:58implications that come out of it are the
1:00best way to fix a lot of these problems,
1:02and what is that how does that align
1:03with our future vision for agent tech
1:05deployments. Um so before we go on, I
1:08know a lot of you already know this. I'm
1:09going to quickly run through this, but
1:11just a very quick overview of MCPs as it
1:13is relevant today. The first is of
1:14course we all know it's an open standard
1:16that was created. Uh most of us know
1:18that at Anthropic. Um there is an
1:19official registry today which contains
1:21over thousands of servers, and this is
1:23growing rapidly over the last year. Um
1:26and we see this happening that
1:27individual companies all the time are
1:29building new servers uh very quickly,
1:31and are trying to ensure that they stay
1:33ahead and trying to adhere to this
1:35protocol nowadays. But still, even if
1:37this happens, we see a major problem
1:40when enterprises try to use it.
1:42Enterprises struggle to deal with what
1:44they believe to be table stakes. Things
1:46like observability. When they want to
1:48know who's using my MCP, who's using
1:50these tools, how do I ensure that the
1:52correct people are using it, um and how
1:54do I know how to develop on certain
1:56parts of the MCP protocol, which parts
1:58of my tools aren't working properly.
2:00These are something that something
2:01that's simply completely opaque to
2:02enterprises today.
2:03Second is access control, something I
2:05just touched upon already, right? How do
2:07I ensure the correct correct users have
2:09access to these servers? Things like
2:10ensuring that certain servers are scoped
2:13correctly. Tools are only made are only
2:15allowed for certain groups of servers.
2:17If you're working in observability MCP,
2:19you might want the entire company to
2:20have
2:21view into like why which things are
2:23failing, but only certain people to have
2:25the ability to actually change things
2:26and update new dashboards, right? These
2:28are the kind of things that currently
2:29are quite hard to do with MCP servers.
2:31And honestly, not something that we as a
2:33community have worked on enough. And
2:35finally, security. And I like to think
2:37of the three of these is almost like a
2:38three-headed hydra in some ways, right?
2:40Um security is a wide range of things. I
2:43like to think not only in terms of the
2:44MCP server, where you know you
2:46enterprises want to know how do you
2:48verify whether a server is safe, it has
2:50uh the correct protocols and the correct
2:52ways of ensuring data exfiltration
2:54doesn't occur, things like uh you know
2:56the tools on on can't be used in a
2:59harmful way both for infrastructure
3:01externally, and but your internal
3:02infrastructure as well. But secondly,
3:04how do you ensure remote clients that
3:06are perhaps untrusted in nature can
3:08access your private data as an
3:10enterprise, right? These are all really
3:12hard problems that you've kind of solved
3:14in previous paradigms with APIs, but we
3:16really don't have a good way of solving
3:18it uh at the moment.
3:20So just going back to the registry
3:22point, it's really useful to think of
3:24where we are and where we want to go,
3:25right? Registries are really useful, and
3:27I don't think there's any discussion
3:29that here where we are having where we
3:30think they're not useful. We're really
3:31proud of it and we're really happy we we
3:33helped develop this. But it's really
3:35important to realize that registry
3:36registry simply aren't complete for an
3:38enterprise. And what's like funny about
3:40this is is that MCPs were specifically
3:42designed um if you attended David
3:45David's talk earlier today, MCPs are
3:47specifically designed because they allow
3:49themselves to be so much more useful for
3:51enterprises. And there's this kind of
3:52gap which the protocol allows for that
3:54we have yet to build into well, and
3:57these include things like
3:58authentication, but also access control,
3:59observability, and credential
4:00management. These are all things that
4:02enterprises need and are critical part,
4:04um but are simply not working. So now
4:07that we have this happening, what is
4:08what do enterprises do right nowadays?
4:11What they do is something like this,
4:12where every single team now with cloud
4:15core, you know, and explosion of coding
4:17across across various surfaces, can now
4:20start developing MCPs. But suddenly find
4:23out that they can't actually get them
4:24deployed. Or even if they want to get
4:25them deployed, the MCPs often can't use
4:28the tools they want to, those tools
4:30can't give them the correct access, and
4:31security teams on the other end are also
4:34pretty justified how they're going about
4:35it, because they're often overloaded,
4:37and they're often unable to see which
4:38MCPs they want to go through, and which
4:41they want to which they want to allow.
4:43And finally, at the company level, CEOs
4:46and C-suites are like, you know, why are
4:47my MCPs not working correctly? Why are
4:49my agents ineffective? Why can't um why
4:52can't your agents actually, you know,
4:54being be the thing that we all thought
4:55it was going to be? And so this
4:57bottleneck, which we're seeing right
4:58here, is something we need to solve. We
5:00need to ensure that security teams
5:03aren't overloaded, that users are given
5:05the freedom to actually develop their
5:06own MCPs, and organizations have
5:08visibility into all of them. And so what
5:11I'm going to tell you is that this
5:14problem where enterprises stay with a
5:15handful of MCP tools is going to
5:17fundamentally restrict the protocol and
5:18hurt agents until we really go and solve
5:21this.
5:22And I think it's worth zooming out at
5:23that moment, right? It's like I think
5:25it's really valuable to think how
5:27important these paper cuts are, and how
5:29valuable it is to try and invest the
5:30time to try and solve it um
5:32super super well.
5:34On to why we think the gateways are a
5:36better solution. I think this is a very
5:38way to good way to build intuition.
5:40The core intuition here is at a point in
5:43which almost all of your teams can build
5:45MCP servers really well, or have the
5:48ability to theoretically be able to do
5:50so because they're simply using coding
5:52agents that can understand the structure
5:53of the servers very well, that are able
5:55to understand what the tool definitions
5:56look like, what you should want, uh what
5:59access controls look like. The really
6:01important thing for security teams and
6:03enterprises that want to allow this to
6:04be decentralized is they need to
6:06establish a root of trust. And so we
6:08think that the goal for a secure this
6:10for any security team is to is to bless
6:13one platform. And this is if I take one
6:15thing away from this talk, I would
6:17really suggest it be this slide, because
6:19it's irrelevant like you can you might
6:20want to use a gateway and I'll mostly be
6:21talking to you through this, but I think
6:23this intuition is really the intuition I
6:25would really want to stress. Because
6:27enterprises that are able to do this, in
6:28our experience, we've done this
6:30internally and done this externally,
6:31too, are able to explore the usage of
6:33MCPs, and thereby explore the usage of
6:36how powerful the agents are. And it's
6:38worth obviously coming back here and
6:39saying like, you know, MCPs if the usage
6:41is exponential, every good MCP you have
6:43helps all of the agents in your company.
6:45And so doing something like this has
6:47knock-on effects beyond just that one
6:49MCP. Um so now now that we think that,
6:52you know, our platform is really useful,
6:54let me tell you why I think gateways and
6:56I'll define it for you are a good way of
6:58doing this. So a gateway, as a black box
7:01definition of it, is simply a middleman
7:05or
7:05sort of middle layer in between your MCP
7:08servers, and they can be numerous into
7:10the hundreds, and any MCP client. Notice
7:13the diagram here is notice is extremely
7:15simple, and it leaves a lot to be filled
7:17in. But what I really want to talk about
7:19is what we want to get out of the
7:20gateway. Things like authorization,
7:23authentication,
7:24observability, ensuring that you have
7:26correct connectivity between
7:28clear secure connections between your
7:30MCP client, which might be untrusted,
7:32and internally. And also finally, you're
7:35able a easy way to host and deploy any
7:37new MCP server. What this allows for is
7:40that any new MCP server now does not
7:42have to deal with any of these five
7:43things. And a team that wants to wants
7:45to add a new server only needs to care
7:47about what is the business logic. So
7:49your legal team which wants to review
7:51contracts only needs to care about,
7:53okay, if a contract comes in, this is
7:55what I want to be seen, this is how a
7:57redline should happen, this is what this
7:58is how you should escalate your
7:59different people. They don't need to
8:01ensure, you know, who who accesses this,
8:03how often can it be accessed, how do I
8:05know it's being accessed correctly, how
8:06do I know it's like scalable, and if I
8:08want to have new agents come in, how
8:10These are all things you need to worry
8:11about. And that's a really really useful
8:13middle layer to have, because actually,
8:15in the world we live in, your legal team
8:17can build the MCP server on their own.
8:18They aren't forced to go back to a new
8:20technical team and build it, right? And
8:22so if you really do want to live in that
8:23world, a gateway is a fundamental piece
8:25of that infrastructure.
8:28What does a gateway contain? Now there's
8:29like multiple definitions of gateways,
8:31we're going to give you examples, but in
8:32my mind, uh there is there are normally
8:35these components which usually exist
8:37within it. You know, I'm not going to be
8:38like this is hard and fast, this is
8:40neither exhaustive nor nor the only nor
8:43like the without these like there's not
8:46all required. But what you would really
8:47like to do to achieve the goals I just
8:49achieved I just talked about, is you
8:51kind of want a way to do auth, you want
8:53a way to do access control using roles,
8:55you want a way to route using a proxy
8:57such that any MCP client can only see
8:59your gateway, and and the gateway then
9:01can route to the individual MCP servers
9:03which treat the gateway as the only
9:05trusted endpoint. You want a way to
9:07ensure you have a tunnel which is a
9:08secured connection. You want to have a
9:10sub registry, which is your MCP servers
9:12internally. And finally, you would want
9:14to have any additional tooling. Tooling
9:16like a CLI for your gateway, such that
9:18anyone who wants to create a new MCP
9:20server in your in your company can
9:22easily create one because the gateway
9:24has a quick and easy CLI that not you,
9:27not that team, but but the agent that
9:29team is using, that cloud core or
9:31something else, can easily understand.
9:33Um these are all parts that when put
9:35together become really powerful, because
9:37someone who is just wants to create a
9:40new MCP server can use the gateway CLI
9:42and just easily integrate into these
9:44five components, and then completely
9:46focus on their MCP server, right? And
9:48that's why we really think that in
9:50making that kind of one-time investment,
9:52which doesn't hopefully doesn't require
9:53a lot of maintenance, and something you
9:55can easily do with agents would lead to
9:57several knock-on benefits.
10:00Um just like and just like a
10:02higher-level view of what this gives
10:03you, right? So, we already talked about
10:05this in terms of a listing of what we
10:07think is required, but just looking at
10:09once we have this, you have a vision of
10:12a gateway which can give you access
10:14authentication very easily. You might
10:15have your own IDP which you can plug in.
10:17You can have delegated identity in terms
10:19of users and agents. This is something
10:21we think is going to be really important
10:22into the coming year, where we think
10:24agents
10:25are going to require newer and novel
10:26definitions of identity that, you know,
10:29you can uniquely define and think about
10:31and scope for your enterprise using a
10:33gateway. We'll ensure that you can have
10:35one access control panel for all of your
10:38for all of your agents and and MCPs, and
10:40your access control can be scoped
10:42depending on like whether a team is
10:44accessing it, whether a user is
10:45accessing it, whether uh whether another
10:48employee is accessing it. And finally,
10:49observability. And I think observability
10:51here is nuanced in the sense that you
10:53not only want usage metrics to reflect
10:56what MCPs are
10:58being used, but you also kind of want to
11:00know how how are your tools being
11:01defined. In a world where the MCP
11:04protocol is itself being developed so
11:06rapidly, you kind of want to see how to
11:08how what are your load-bearing tools and
11:10how do you better adapt them to meet the
11:12needs of your various agents. So, I
11:14think this is really really cool and
11:16really useful. It kind of, you know,
11:18sometimes some people often say that it
11:19sounds too good to be true, but I really
11:21encourage you to try and take a look at
11:23this
11:23and try and and try and see where you
11:25can go from there. Um but let's say you
11:28have a gateway now, right? We've already
11:30talked about like the minimum
11:31requirements. I think there's a lot of
11:33exciting worlds that you get on very
11:36easy follow-ons or almost free lunches
11:38you kind of get from there. The first is
11:40it's very easy for you to add any new
11:41surface. So, you can easily have your
11:44MCP servers now plug into cloud.ai, they
11:46can easily plug into cloud core, they
11:47can easily plug into cloud core work
11:49because why? Because all of them are
11:50kind of listening to the same gateway
11:53and you kind of you only need to do it
11:54one time. Compare that to the world
11:56where you have 40 different MCP servers
11:58and some MCP servers are better
12:00configured for only one of these
12:01services in one of these clients. This
12:02is really important because this kind of
12:04ensures that you can be kind of
12:06invariant to any new surface that comes
12:08up. And I know like this is something
12:10that sounds interesting coming from me,
12:12but like it's really really useful for
12:14any new enterprise. It's really really
12:16useful for any enterprise to do this.
12:18The second is you have far more secured
12:20connections that can be built in.
12:21Currently, you know, your MCP servers
12:23often have access to sensitive data
12:25internally and you any enterprises are
12:27worried about, you know, "If I send this
12:29out to another client, is that data
12:30going to be exfiltrated? What happens to
12:32my data? How do I ensure that, you know,
12:34my like literally years and years of
12:36work doesn't go away?" You can now
12:38invest in much more secured connections
12:40between your MCP servers that are
12:42between your MCP server and your client
12:44that is completely encrypted
12:46and can ensure that you have root trust
12:48in how in what kind of data be sent. And
12:51this is really important. I think like,
12:52you know, we've often done you've often
12:54made MCP servers with kind of play data
12:57and things that, you know, enterprises
12:58can't really use, but for enterprises to
13:00actually derive the exponential value
13:02they can get from this, this is
13:03something we need.
13:04The third is faster iteration. The real
13:07value in like ensuring your teams can be
13:09decentralized completely is going to be
13:11that they can iterate and develop their
13:13own workflows much faster. If the legal
13:15team is able to very quickly just change
13:17their legal MCP rapidly and iterate on
13:19it without repeated security reviews,
13:22that has a massive effect which can just
13:26which just builds upon itself. So, this
13:27is something that shouldn't be
13:28underrated. The fourth is that you get
13:30very much more standard primitives. So,
13:32any new MCP server that you want to
13:34build kind of has to adhere to
13:36primitives that are that are within your
13:38enterprise and how your enterprise wants
13:40to go about it. A common request, you
13:42know, a common problem enterprises have
13:43is like, "How do I ensure said AI agent
13:47meets my standards and operating
13:48procedures?" A gateway is a way of
13:50encoding that. A gateway is a way of you
13:52being like, "These are my standard
13:54procedures, these are the primitives I
13:55want to see, these are the tools I
13:57expect, and these are the things I don't
13:58want to see." And that's a very quick
14:00way of encoding how you as an enterprise
14:02want to behave. Uh the fifth is
14:04pluggable credentials, right? What we
14:07currently have is certain MCP servers
14:09that only accept one type of user
14:11authentication, right? And it's very
14:13hard to kind of make sure it it it
14:15becomes
14:16like, you know, you can have a
14:18company-wide one or a team-wide one or
14:20something with service accounts. These
14:22are all things which are often useful in
14:24different cases, and that becomes easier
14:26with a gateway because a gateway
14:28allows any new MCP server to easily
14:30support new credentials and swap it in
14:32and out in an intelligent manner. And
14:34then finally, it's scalable, right? Like
14:37if you have 40 MCP servers that need to
14:39scale to from tens to hundreds to
14:41thousands to hundreds of thousands of
14:42agents, that's a really hard surface to
14:44maintain. A gateway which is able to
14:46take all these requests in and farm it
14:48out in an intelligent manner is a far
14:50better place for your teams to focus on.
14:53Finally,
14:54you know, this is not something that's
14:56we think is going to be like we're we're
14:57telling you out of the blocks. We have
14:59examples of this both in the open
15:01source, you have provided something
15:02in-house, but this is also something we
15:04can help with. This is something I do in
15:05my daily basis. If you're interested,
15:07I'd love to talk to you about this after
15:09this.
15:11Um but just finally zooming out, right?
15:13I want I want to take these last few
15:14minutes to think about where we're going
15:16with this. I like pitched a version of
15:18the MCP world to you that, you know,
15:19sounds cool, probably works, but does
15:22this really work in the hundreds of
15:23things you've been hearing over this
15:25conference? I think what we want to
15:26ensure is the larger picture where
15:29things are going is we want to separate
15:30the agent harness from where your data
15:32lives. We have many more surfaces coming
15:35up. We see an explosion of agents, but
15:37those agents shouldn't be tightly
15:39coupled to where how your data
15:41structured and how your MCPs are
15:43structured. An example of this is just
15:46the pure definition of an agent should
15:48like when you have tens of thousands of
15:51the orange box on the left, you don't
15:53need to keep you don't want to ensure
15:55that it has to be opinionated. You don't
15:56want you don't want the things on the
15:57right to be opinionated on how this
15:59works. We have this working we have an
16:02example of this which was released
16:03recently, right? Just as an example of
16:05this right now, if you have an MCP
16:07gateway, you can use you can easily
16:09connect it to cloud managed agents which
16:10was released recently, but you can also
16:12build it into use it internally
16:14with your own cloud agent SDK as well,
16:16right? And this is just an example from
16:17the cloud.x ecosystem. But think about
16:19the value of this. As an enterprise, you
16:22now have the ability to quickly decide
16:24which agents you want to keep in-house,
16:25which agents you want to have outside,
16:27but that becomes an invariant decision.
16:29The gateway remains regardless. What I'm
16:31trying to tell you is that the gateway
16:33is an investment which will allow you
16:35give you the flexibility to try to try
16:37and meet the wide-ranging agent needs of
16:40the future, and that's going to be
16:41really really exciting.
16:43And that allows you to not only
16:46not have to think that much about agent
16:48design at the moment, but it also allows
16:49you to really invest very strongly in
16:52opinionated MCP gateway primitives.
16:56So, just in summary,
16:58I would say three main things here,
17:00right? The first and the most important
17:01takeaway is to invest in common infra,
17:04to not try and roll your own MCPs, and
17:06to ensure your teams can build their own
17:07MCPs. Second, we really think gateways
17:10for secured connections allow you to
17:12build that root of trust. And third,
17:14that moves towards a world where we
17:16think the agent harness is better be
17:18able to separated from your data layer.
17:21So, yeah, thank you so much. If you have
17:23if you're interested in any of this, I'd
17:24love to talk
17:26and that was the talk. Thank you so
17:27much.
17:28>> [applause]
17:37[music]