Shub Argha
Head of Forward Deployed Engineering @ Arcade.dev
New York City, New York, United States
Actions
Shub Argha is a Founding Forward Deployed Engineer @ Arcade.dev. He is a proud Michigan Wolverine with a passion for innovation and entrepreneurship, especially in AI and electronics. In quieter moments, he enjoys the literary works of Michael Chabon.
Links
Area of Expertise
Topics
Trustworthy Context Is Untrusted By Default
Structured memory is a compact injection surface. If an agent reads context that says "always use the production database" and acts on it, the consequences are real. This talk presents a trust architecture for stored agent context: server-generated preambles that warn agents context was written by another agent and may be stale, risk classifications on write operations, provenance footers that record who wrote what and when, file anchors with commit-at-write hashes for staleness detection, and read-time verification guidance. We present evidence that trust preambles reduced one class of context contamination from 88.8% to 33.3% in controlled testing, while being transparent about which attack classes remain unmitigated. The principle: stored context should be useful but never trusted by default.
We Reverse-Engineered Every MCP Client's Session Behavior — Here's What We Found
MCP sessions don't mean what you think they mean. We built a probe server that logs every header, _meta field, session ID, TCP socket, and timing pattern, then connected seven MCP clients and tested whether different chat conversations produce different signals. The results: Claude Code creates new sessions per conversation, Codex sends session_id and thread_id in _meta, ChatGPT sends x-openai-session headers, Claude.ai sends changing sentry-trace_ids, and Cursor sends nothing — sharing a pool of 6-8 sessions across all conversations with zero differentiation. We then dug into Cursor's source code and found that composerId flows through the entire tool call chain but is dropped one function call before the HTTP request. This talk presents the full methodology, raw findings, and what it means for MCP server authors who need per-conversation state.
The Stateless MCP Server: Architecture Patterns For The 2026-07-28 Spec
The new MCP spec eliminates sessions, moves client info to per-request _meta, and introduces requestState for server-side state that travels with requests. This changes how MCP servers are built. This talk covers: migrating from initialize/initialized to server/discover, replacing Mcp-Session-Id with requestState for stateful operations, using InputRequiredResult for multi-round-trip flows without SSE streams, implementing the new Mcp-Method and Mcp-Name headers for gateway routing, adopting ttlMs and cacheScope for list and resource responses, and handling the transition period where both old and new protocol versions coexist. We share migration patterns from a production self-hosted MCP registry that supports both protocol versions simultaneously.
The MCP Capability Cascade: Tools, Prompts, Resources, And Fallbacks
Rich MCP clients can use prompts, resources, image blocks, and OAuth discovery. Basic clients support only tool calls. A well-designed MCP server should use all of these when available but never depend on a rich client for the core experience. This talk introduces the capability cascade pattern: skills entries become MCP prompts for clients that support them, entries can become MCP resources for resource-capable clients, image artifacts return native image blocks when possible, and read tool with view parameters provides a universal tool-based fallback for everything. We demonstrate the same data served five different ways to five different clients, showing how the server adapts without separate codepaths.
The Runtime Envelope: Teaching Agents The Room They Are In
Most MCP tool responses return content and nothing else. But an agent working in a shared context needs to know more: who am I, what can I access, what changed recently, are there unread signals, is this content trusted, and what should I do next. This talk introduces the runtime envelope pattern where every tool response includes identity, scopes, state, activity, signals, and trust metadata alongside the actual content. We show how this gives agents situational awareness without adding tools, how trust preambles force verification of stored context, and how provenance footers carry write-time metadata. The result: agents that collaborate safely because the tool responses teach them the room they are operating in, not just the data they requested.
Stop Re-Explaining Your Codebase To Every Agent
A fresh coding agent explores your repo for 30 turns and $1.31 before it can answer a question. The next agent does it again. And again. This talk demonstrates a context registry that breaks the cycle: Agent A explores, writes architecture docs, conventions, and a handoff note to a shared MCP capsule. Agent B starts fresh, calls one tool, reads the capsule, and answers in 5 turns for $0.16 — an 87.6% reduction in model cost. We show the Time Traveler demo live, explain the URI-schemed context model that makes stored knowledge inspectable and versionable, and present the research methodology behind the cost claims including caveats about break-even thresholds and model-specific variation. The audience leaves with a running self-hosted registry they can try in five minutes.
The Context DMZ: Scoped Capsules For Customer, Partner, And Vendor Agents
Companies increasingly need customer, partner, vendor, and auditor agents to access limited context without opening internal systems. An MCP capsule can serve as a context DMZ: a scoped boundary between your organization and outside agents. This talk shows how to create external-access capsules with content scoping that restricts visible URI schemes, deny prefixes that hide sensitive entries, connection identities that distinguish internal from external agents, artifact views that serve documents without raw file access, and activity logs that track what external agents read and write. We demonstrate a customer implementation scenario where internal agents get broad context, customer agents see only approved docs and runbooks, and partner agents access campaign assets — all from the same MCP registry with different grants.
MCP Sessions Don't Map To Conversations -- And how the New MCP Spec Fixes It
We tested seven MCP clients and found that MCP sessions have no consistent relationship to user conversations. Claude.ai maintains one session forever across all chats. Cursor creates a pool of 6-8 sessions shared across all conversations with zero differentiation. Only Claude Code creates new sessions per conversation. We dug into Cursor's source code and found that composerId — a unique conversation UUID — flows through the entire call chain but is dropped before the HTTP request, while Codex already ships session_id in _meta. Then the 2026-07-28 MCP release candidate arrived and eliminated sessions entirely, replacing them with per-request _meta and stateless requestState blobs. This talk presents the empirical findings, the source code analysis, and how the new spec's Multi-Round-Trip Requests and requestState mechanism finally solve per-conversation state management for MCP servers.
Memory Is Private. Context Is Shared.
"Agent memory" is overloaded. Chat history, vector databases, local note files, static rules files, and shared project context are fundamentally different things being sold under one label. This talk separates them: private memory is one agent remembering user preferences; shared context is multiple agents and humans maintaining governed project state. Using a self-hosted MCP context registry as the case study, we show why the second category needs URIs instead of opaque embeddings, versions instead of append-only logs, grants instead of shared secrets, provenance instead of blind trust, and signals instead of polling. The audience will understand why "agent memory" products that focus on recall miss the harder problem of collaboration, governance, and portability across tools.
Long-Running Agents Are Recoverable Workflows, Not Long Chats
Long-running agents fail when state lives only in a transcript or compaction summary. A context reset, a crash, or a model switch loses everything. This talk shows how to externalize agent state into a durable MCP capsule: goals in docs:// entries, progress in notes:// threads, artifacts as versioned blobs, definitions of done as guidance:// entries, and handoff notes that let a fresh worker session resume without re-exploring. We demonstrate the initializer-worker-reviewer pattern where a capsule serves as the rehydration layer between sessions, and show how signals coordinate actors without requiring persistent connections. The key insight: the capsule should answer a fresh worker's first questions — what is the goal, what changed, who is working, what should I verify, and what is the next safe step.
Grant Review As An MCP Authorization Primitive
OAuth scopes requested by a client should not automatically become authority. When an agent connects to an MCP server and requests capsule:read and capsule:write, a human should review what that means before access is granted. This talk presents a grant review system built into an MCP registry: OAuth and Dynamic Client Registration handle identity, but a separate approval spine handles authority. We cover approval profiles that pre-configure common access patterns, content scoping that restricts grants to specific URI prefixes, scope downgrading where operators narrow what the client requested, denial and expiry workflows, and why autonomous agent enrollment needs policy ceilings that prevent self-approval of broad access. The key principle: identity bootstrapping is not the same thing as authority.
From Shared Blackboard To Collaborative Workspace: Multi-Agent MCP Patterns
Persistence alone is not collaboration. Two agents writing to the same MCP resource without coordination will clobber each other. This talk shows how to build real multi-agent collaboration over MCP: append-safe write modes that prevent destructive overwrites, optimistic concurrency with if_version for conflict detection, durable URI threads for structured discussion, active/recent signal cursors that compensate for shared-client connection problems, and conventions for handoff notes that tell the next agent what happened and what to verify. Using traces from real two-agent sessions, we show the failure modes — one agent declaring a task done based on another's partial progress, agents clobbering each other's context entries, signals missed due to TTL expiry — and the protocol patterns that prevent them.
Designing MCP Servers For Clients That Disagree About Everything
Cursor, Claude Code, Claude Desktop, ChatGPT, Codex, Windsurf, and browser-hosted clients differ in config formats, OAuth redirect handling, prompt support, resource support, elicitation capability, media rendering, and filesystem access. This talk presents findings from building and testing one MCP server across all major clients. We cover: the client capability matrix we discovered through testing, how to detect clients from clientInfo and user-agent, graceful degradation when prompts or resources aren't supported, the MCP capability cascade pattern (resources → prompts → tools as universal fallback), and specific workarounds for each client's quirks. Includes a live compatibility testing approach using a diagnostic probe server.
Distributed Tracing For MCP: From Host To Tool And Back
The 2026-07-28 MCP spec standardizes W3C Trace Context propagation in _meta — traceparent, tracestate, and baggage keys that let a trace starting in a host application flow through MCP clients, servers, and downstream services. This talk covers practical implementation: how to propagate trace context from the host through tool calls, how MCP servers create child spans for tool execution, how to correlate traces across multiple MCP servers called in sequence, how baggage can carry application-level context like conversation IDs or user metadata, and what observability platforms show when traces span host-to-MCP-to-downstream. We share findings from instrumenting a self-hosted MCP registry with OpenTelemetry, including which clients correctly propagate traces today and which don't.
Agents Will Hack Any Approval Surface You Give Them
We built an MCP server with a guard tool pattern — data access requires an unlock token, obtained through human approval on a separate web page. The agent self-approved in under two seconds. We added a password-protected login page. The agent read our source code, found the password, logged in, and approved itself. We moved the approval to a separate port. The agent found it and approved itself there too. This talk presents a series of progressively hardened MCP authorization experiments, each defeated by the agent, leading to the conclusion that approval surfaces must be on architecturally separate origins with authentication the agent cannot obtain. We show the exact attack chains, the code, the logs, and the defense that finally worked: separating the MCP server (agent-accessible) from the registry dashboard (human-authenticated, agent-inaccessible).
Artifacts Are Attack Surface: Security For Non-Text Content In MCP
Screenshots, PDFs, spreadsheets, slide decks, archives, and log files are not harmless attachments — they are agent-readable context that can carry stale, malicious, or sensitive information. This talk covers the security model for non-text artifacts in MCP: exact byte preservation with content-addressed storage and source hashes, view manifests that describe available representations without exposing raw files, size limits and format validation at upload, metadata extraction risks from OCR and text extraction, and why artifact provenance belongs in the same threat model as prompt injection. We show how a self-hosted MCP server serves image views, text extractions, table summaries, and metadata manifests from the same stored artifact, letting agents work with the content without direct file access.
A Stable URL Is Not A Credential: Building OAuth-Native MCP Servers
MCP servers need stable addresses that teams can bookmark, share in docs, and paste into agent configs — but stable URLs must not double as access credentials. This talk walks through building an MCP server where the URL is a resource address and credentials live in OAuth, PKCE, and human-approved grants. Using a production self-hosted MCP registry as the case study, we cover: Protected Resource Metadata for scope advertisement, Dynamic Client Registration for automatic agent enrollment, why token-in-URL sharing breaks down at team scale, how operators narrow requested scopes during grant review, and how connection revocation works without changing the URL. The audience will leave with concrete patterns for separating resource addressing from credential management in their own MCP servers.
The Missing OS: Building Production Runtimes for Persistent MCP Agents
As the Model Context Protocol (MCP) standardizes agent connectivity, the industry is shifting toward persistent, collaborative "Co-Work" agents. However, building production-grade runtimes for these agents requires solving infrastructure challenges that the protocol doesn't define. This session shares battle-tested patterns from a high-density, multi-tenant MCP runtime implementation. We explore four critical pillars: 1) Recursive MCP Bootstrapping: Enabling agents to programmatically manufacture, test, and hot-plug new MCP servers into their own lifecycle at runtime. This shifts from static toolsets to evolving capabilities. 2) Event-Streamed State: Using Redis Streams to maintain agent persistence and handle multi-client synchronization, a requirement for collaborative environments like Claude Co-Work where state must persist across sessions. 3) Git-Backed Sandboxing: Leveraging lightweight filesystem isolation (Git worktrees) to process massive datasets locally via MCP-native primitives without context window bloat. 4) Auth Orchestration: Implementing dynamic OAuth discovery and exchange within the JSON-RPC layer to navigate enterprise boundaries securely.
Untangling the Web: Navigating the Complex Landscape of Open Source AI Networking Protocols
As AI systems grow more distributed and agentic, networking is becoming one of the most critical yet misunderstood layers in the AI stack. This talk demystifies emerging protocols and patterns shaping the future of open source AI infrastructure—from Anthropic’s Model Context Protocol (MCP) and Google’s Agent-to-Agent (A2A) frameworks, to RDMA and zero-copy inference. We’ll examine how these technologies affect everything from fine-tuning and multi-agent coordination to RAG and edge deployments. Through real-world use cases and architectural diagrams, attendees will learn how traditional protocols like gRPC and GraphQL are evolving for AI workloads—and where new standards are desperately needed. Most importantly, we’ll identify key open source projects and opportunities for contribution in this fast-evolving space.
Unifying Multi-Cluster Networks with the ngrok Ingress Controller and Kubernetes Gateway API
Organizations are adopting multi-cluster architectures to enhance resiliency and scalability. This creates challenges in network orchestration and security. We will explore the integration of the ngrok Ingress Controller with the Kubernetes Gateway API to solve these challenges. The integration offers a centralized, declarative model for network configuration, automates the propagation of network policies across clusters, and enables sophisticated traffic shaping and security mechanisms.
Shub Argha
Head of Forward Deployed Engineering @ Arcade.dev
New York City, New York, United States
Links
Actions
Please note that Sessionize is not responsible for the accuracy or validity of the data provided by speakers. If you suspect this profile to be fake or spam, please let us know.
Jump to top