The Model Context Protocol has established a dominant position in the initial phase of agentic infrastructure development. With roughly 500 million monthly downloads across primary SDKs and nearly 10,000 servers in the official registry, the protocol has moved beyond experimental curiosity into the bedrock of modern software architecture. Yet, as the second day of the MCP Dev Summit Toronto unfolds, the conversation has shifted from the excitement of adoption to the sobering reality of maintenance. The protocol is succeeding, but the infrastructure required to verify that success is lagging behind.
The scale of this adoption is no longer theoretical. Uber recently deployed an MCP Gateway supporting over 800 servers and 5,000 tools, facilitating 60,000 agent tasks every week for thousands of engineers. Similarly, enterprise SaaS providers like Workday are moving toward native MCP integration. At the extreme end of the spectrum, TELUS is managing MCP deployments for a workforce of 750,000 users. These organizations are not just experimenting; they are building critical business logic on top of the protocol. However, this rapid scaling has exposed a structural risk: the absence of robust, standardized testing infrastructure.
The fragility of the current state was underscored by the recent Cycode disclosure of an OAuth vulnerability in the Python SDK. With a CVSS score of 7.5, the flaw allowed malicious servers to intercept sensitive credentials, effectively enabling account takeover. It was a stark reminder that protocol maturity is not synonymous with security. When developers rely on self-administered conformance suites — which currently exist as a community-run repository rather than a centralized certification authority — the burden of security falls entirely on the individual implementer. In a regulated enterprise environment, this decentralized approach is insufficient.
Day two of the summit has become a venue for practitioners to share the stopgap measures they have built to fill this void. Sessions from TELUS and NVIDIA highlight the reality of enterprise-grade MCP: it requires custom-built layers for identity management, rate limiting, tool filtering, and authorization guardrails. When speakers describe the “OAuth wall” or the disappointment of current dynamic client registration standards, they are describing the friction that occurs when a protocol is deployed at scale without a corresponding ecosystem of verified, hardened infrastructure.
We are currently in a transition period. The Linux Foundation has launched the Model Context Protocol Associate certification, and while this validates individual knowledge, it does not solve the problem of protocol-level conformance for software deployments. Microsoft is pursuing its own vendor-specific marketplace certification, but this creates a fragmented landscape rather than a unified standard. The existing conformance suite is a necessary starting point, but it lacks the teeth of a central certification badge that enterprises can rely on to ensure interoperability and security.
The central question for the remainder of the summit is whether the community will move toward a proposal for centralized testing infrastructure or continue to validate these layers in isolation. The current model — where every Fortune 500 company builds its own gateway and security wrapper — is a testament to the protocol’s utility, but it is also a sign of an immature ecosystem. If MCP is to remain the standard for agentic substrates, the community must decide if it is willing to trade some of its decentralized flexibility for the rigor of a shared, certified testing framework. The infrastructure gap is no longer a minor oversight; it is the primary hurdle to the next phase of enterprise adoption.