> Markdown version of [/events/conference-india-2026/sessions/1993-shipping-mcp-to-real](https://www.wearedevelopers.com/events/conference-india-2026/sessions/1993-shipping-mcp-to-real). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Shipping MCP to Real Users: Scaling, Auth, and the PII Leak You Didn't See Coming


- **Event:** Conference India 2026

## Description

MCP demos are easy. MCP in production, multi-tenant, for tens of thousands of users, is a different sport.

Connecting an MCP server takes an afternoon. Running one for real customers is where the interesting failures live. I'll cover what actually holds up under load: stateless MCP transports on serverless (why an in-memory session map quietly kills horizontal scaling, and why request/response JSON just works), OAuth 2.1 connectors with PKCE, and on-demand data stores - with real numbers from a burst test.

Then the security landmines that are specific to this shape of app: a public per-tenant connector that will happily hand every customer's name, email, and phone to any anonymous caller; forgeable session cookies that also mint an OAuth token; an unauthenticated endpoint that can wipe a tenant's data; and the host-side constraints you simply cannot control - your connector's icon is your domain's favicon, and you can't pre-fill the install dialog no matter what you try.

Every item comes with the fix, straight from a production readiness audit.

## Speaker

### [Hadar Geva](https://www.wearedevelopers.com/@hadar-geva)

Co Founder & CTO


## Related talks at this congress

- [What I Got Wrong Shipping an MCP Server for Live Infrastructure](https://www.wearedevelopers.com/events/conference-india-2026/sessions/1999-what-i-got-wrong) — Pritesh Kiri
- [Supply Chain Security for the Everyday Engineer](https://www.wearedevelopers.com/events/conference-india-2026/sessions/1994-supply-chain) — Pradumna Saraf
- [How We Cut Our API's p99 Latency from Minutes to Under a Second](https://www.wearedevelopers.com/events/conference-india-2026/sessions/1987-how-we-cut-our-api-s) — Deepak Agrawal
- [Multi-Cloud Isn't a Project. It's a Side Effect.](https://www.wearedevelopers.com/events/conference-india-2026/sessions/1989-multi-cloud-isn-t-a) — Antonio Mendoza Pérez, Gaurav Thadani

## Watch remotely

Can’t make it to Bengaluru? Watch this session live with Pro. You also get:

- All full videos, bookmarks, and playlists
- World Congress livestreams

[See pricing](https://www.wearedevelopers.com/pricing)

## Links

- [Get tickets](https://www.wearedevelopers.com/conference-india/tickets)