MCP Dev Summit Bengaluru 2026

MCP gives us a clean abstraction for agents calling tools. But it doesn't talk about security: what if the tool does bad things?

For read-only tools returning structured data, a shared-kernel container is fine. For the growing class of MCP servers exposing code execution, the attack surface that produced CurXecute (CVE-2025-54135 and CVE-2025-59944), containers are the wrong primitive, because a single exploit crosses from MCP server to host.

This talk covers what MCP tool execution looks like when you take isolation seriously. It walks through the architectural pattern of scheduling Firecracker microVMs for MCP tool execution - sub-second resume (for chained tool calls and fast-start), minimal kernel configurations, and common integration paths with Kubernetes.

Attendees leave with a decision framework: four signals that isolation complexity is worth it, three signals it's overkill, and a clear mental model of the latency-vs-isolation tradeoff.