Day 2 (afternoon): MCP as the USB Port for AI, Building a Server in Two Lines, the Four Orchestration Shapes, and CRUD as the Security Model

Siddharth grounds 'protocol' in the familiar ones, then defines MCP as the agreed way a tool and a model exchange requests and results. The USB / HDMI analogy carries the value: without it every AI-to-app integration is bespoke; with it any software plugs into any AI. His claim is that roughly 95% of software is reachable - a ready-made server exists or the existing API can be wrapped - and he proves ubiquity by finding an MCP server for Tally, 'the most uncle-old accounting software', and browsing a directory of ~32,000 servers (ElevenLabs, Excel, SAP, Zed...). MCP can also drive hardware - phones, microcontrollers, cameras.

The Connectors menu (Gmail, Figma, Granola, Linear, Slack, and a catalogue behind Manage Connectors - Notion, Miro, Zapier, Airtable, Stripe, Vercel, AWS, GitHub, make.com...) is MCP with a friendlier name. Two demos: a Slack message to a colleague by user ID, and 'find me a free three-hour slot tomorrow and send the options to Om' across Calendar and Slack. Each action raises Always Allow / Allow Once / Deny; he chooses Allow Once deliberately and returns to it in the security section. A third demo has Claude drive Chrome directly to read and summarise ten tweets on x.com.

Per the official spec an MCP server offers tools, prompts (contextual notes - what a database column means) and resources (files, templates, past reports), plus rarely used utilities. PROCEDURE with the official SDKs: create a server object with a name and version; register a tool by wrapping an existing function - TypeScript server.tool(name, args, handler), Python / FastMCP @mcp.tool() - and likewise add resources and prompts. The docs are 'honestly quite bad, but official'. Compare Claude's per-connector permission list, which separates read-only tools from write / delete ones like 'schedule message'.

An API is a code-to-code contract between systems that already trust each other, with auth and CORS and the rest; an AI cannot safely execute raw APIs without a sandbox layer, which is inefficient. MCP is designed to be directly executable by an AI and absorbs those concerns - 'the API for AI'. A sandbox is a contained environment where an agent can delete its own database without touching the live one, which is exactly where full permissions belong. Some servers are free (Slack, Google Calendar), some paid (ElevenLabs).

Sequential - agents run one after another (the podcast pipeline). Team / sub-agent - a manager receives the task and delegates to specialists. Swarm - no manager; agents coordinate among themselves. Graph - flowchart-style conditional routing between agents, tools and data, the most powerful and most complex, heavily used by enterprises (a food-delivery chatbot that looks like one thread is a graph behind it) and the origin of LangGraph's name. Rule: begin sequential; escalate only when the simpler shape cannot solve the problem. Frameworks sit on a spectrum from no-code n8n through CrewAI to all-code LangGraph - Canva versus Photoshop - and the choice is fit, not superiority; the frameworks are free, the model calls are not.

PROCEDURE, shown running: a CrewAI project with crew.py, YAML files defining each agent's role / goal / backstory, and main.py; Researcher filters AI news, Reporting Analyst writes the report, Scriptwriter produces a 5-10 minute script and the audio. He edits the greeting in YAML, runs crewai run, and plays the result. Cost 'around 3-4 rupees' with heavy search, 'less than 1 rupee' casually. Trigger: his Mac mini runs it when the MacBook disconnects from home Wi-Fi; delivery is a Telegram voice message. The repo was shared with a known double-generation bug left for attendees to fix.

Reason about every agent permission as Create / Read / Update / Delete on a resource. Anything sent through MCP goes to the lab's servers, so passwords and legal documents never go to an AI. Overwriting a file with an empty one is a Create that deletes; editing away content is an Update that deletes - so nothing but Read is safe on live data. Give full CRUD only to a copy in a sandbox. Choose Allow Once for real systems and audit standing grants in Manage Connectors (Always Allow / Needs Approval / Blocked). And keep real backups: sync is not backup; read up on 3-2-1.