MCP Adoption and Why OSPO Skills Matter - Ana Jiménez Santamaría

All right. So, thank you everyone for joining my talk. Uh, my session today is about the model context protocol MCP adoption uh from a organizational perspective and why opensource from office skills matter. Uh this is going to be really introductory around MCP because I understand there might be people in the in this audience that has an Ospo or that are involved in the OSPO with open source strategy but not so familiar with MCP concept and vice versa. So I'll try to to keep it um introductory based and uh dive as during the end of the session more into uh the the the topic itself. So for those who doesn't know about me this works okay awesome. Uh my name is Anna. I'm currently working as senior project manager in Linux Foundation and two specific projects. One is the tudo group that is an open source from office community uh from organizations uh engaging with Linux foundation that has open source strategy or opus and also in pytorch foundation uh in some of their initiatives. Um, also I'm an aentki foundation ambassador and uh I own a master's in data science specialized in the past in analyzing open source developer communities and community health and I'm currently also involved in a lot of conversations around open source strategy and OPO adoption and OSPO strategies. So um I wanted to start the session with a bit bit of context on uh how yes on uh where are we heading where our AI applications heading right now. Um so we're seeing that now just generating answers or the the way AI applications are working is not enough. We are also we are seeing that a application search informations read files query systems takes actions and uh the way to discover and talk uh to all these systems is the tricky part is where we are trying to ser and and understand how and where is more efficient to do that. So um traditionally and this is really uh how on how API um ecosystems has been working in the past. Uh the you needed to build custom systems uh for each um for each c and build custom introdressions to communicate with all of a database or a code repository. and having those kind of uh integrations separated and siloed. So this has raised the what the industry has called the N uh plus not plus like uh XM problem where you end up having a lot of applications and then this if you have several uh custom integrations it has been really really hard to to scale. uh but this is how APIs has been working in the past and how APIs work when calling uh different tools to retrieve data to uh connect with a database to connect with um code repository with GitHub with GitLab and so on. So with this in under this context is where sorry oh no uh no sorry about that yeah is where model context protocol uh jumps in. Uh so model context protocol is an open protocol for connecting AI applications to external systems and don't think it just to a way to connect tools like also is uh it has a a way to connect connect resources and prompts. So um just imagine as a practical example right uh if you want to uh build um a metrics report analysis on security analysis report for instance you might want to get um several metrics and you can use an MCP server uh to connect and have those tools so axons the model can execute cute but you can also uh fit them with context. So several uh urls specific URLs where there is knowledge and you can bring that through the resource section that the model context protocol has. Uh we call these uh their primitives. So they have tools, resources and prompts. Um and oh my god sorry about that. And then there is also prompts. So you can also uh fit this as a with an expert. Uh so for instance what you are seeing here is a practical example uh that I did uh with chaos um um metrics. So chaos is a Linux foundation project that specialize in software develop in in community health analytics and uh it has a lot of resources and information on how to measure community health for open source communities. Uh so I use that I use the metrics standards they have but also the context the all the information in terms of um text and context they have to become this experts to when creating this analysis report. And um as I mentioned you can feed this model context protocol also with expert reusable templates and you can get that kind of knowledge into uh into this server. So the good thing or the posit the the benefit of having MCP over um the previous examples with SER where we had N uh XM times uh custom integrations is that you just need one MCP server that can connect with uh these um data systems, the coding agents or the workflows that will have MCP clients uh that connects with this uh common language and then they can uh communicate with the database the API the repository uh through the server. So we are solving this with instead m uh xm with n plus m. So reducing uh the time and the effort of a developer to have to do this customs integrations. We are reducing a lot of this number. So organizations have noticed this. they are saying that um this is useful for them in terms of efficiency and on time and uh also is a way for them to prepare for agentic AI times and uh in the last months we have seen a lot of organizations not just software traditional software companies but uh also from the um uh semiconductor industry from finance and banking in sectors uh building MCP servers or uh starting to do prototypes with MCP servers. These are just some of them but uh you can search on the internet there has been so many uh well-known organizations from different industries uh publicly sharing this and um when we move from prototyping to production when uh organizations starts to implement these uh on a produc from the production side. The questions are no longer technical implementations. They also entails questions around risk management, around security. Um that uh questions like okay, what what is MCP? I know like perhaps with someone that has experience in open source that is super obvious but there might be people within the organizations teams within the security team with the legal team that might be having some uh issues or questions or concerns about this. Um and this this is something that questions that we are starting to to have now. And um this is also something that the community is starting to notice and is starting to solve. uh for instance MCP the last July 28th I think it was they they had the biggest revision since launch and they are uh helping and focusing more on strength the oath and open ID alignments uh for uh uh validation server identity it's uh becoming more it's becoming easier for gateways and security infrastructure to uh get better implementations with MCP servers. So yes, this is something that also the community is noticing and is helping uh for organizations to safely and put and implement this uh MCP in in their in production and move it to production. Oh my god. uh but as mentioned earlier the questions are not just technical and MCP it's open it's an open ecosystem and it anchors a living open ecosystem this is evolving every day every week um and if organizations are starting to use and implement it uh they need to also start thinking strategically on what they're doing the same that happened with open source software in the past where just using an open source project is not enough. We're starting to see a similar pattern also in the Aentic AI ecosystem. And yes, this might sound like a new frontiers, but the organizations might have familiar skills already in their in their teams that has been managing similar issues in the past. uh I'm talking about these open source prom offices that perhaps your organization call it different but in essence are those professionals or those teams with expertise in opensource that brings a strategy within the organizations that moves from ad hoc consumption to strategic mindset. Um and this Ospos uh have a lot of skills and has been bringing uh a lot of knowledge around how to engage with open ecosystems, how to engage with open standards, how to build a contribution strategy that matters to the organizations and to the projects they rely on. uh how they handle this crossf functional coordination with the platform team with the security team uh how they handle the dependencies. So your organizations is building an MCP server and uh is also having a lot of dependencies around it. So how is that managed? And finally, how is the organization becoming more uh interoperable and avoiding vendor locking or not avoiding vendor locking? Uh and how the systems the organization is building are more flexible or less flexible and uh being more resilient towards security incidents. for instance. So um yeah this is these are skills that the OPOS has been do doing for the last decade. Uh in fact we we have been tracking that in some research we've been doing since 2018 from the to group side and we did one in 2026. I'm going to share really premiering data because it's related to how some opos are moving and are expanding their roles. [snorts] We're seeing opos that are uh helping organizations manage AI governance, security and compliance and risk. And I think it makes total sense because of what I have been mentioning in the past on how familiar the skills the OS was having having in terms of um community engagement, ecosystem engagement and open their standards engagement relate so well within the AI agentic AI landscape. So we see that most of the opos. So um just for some context the sample size was 50 organ 51 organizations that had an Ospo. In this case we conducted the research and from we asked is does your organization have OPO or not. So this is the uh segment of those organizations with an OPO. We've seen that only 21% are minimally involved in or through adhot consultation but the rest of them the majority of these opos most more more uh moderately involved or fully responsible are somehow engaging with AI governance at some point and even though that right now the primary focus use that we saw was in around compliance and legal review and not just on aentic AI but the whole AI governance so that involves models guidance of open source AI what I've highlighted in red uh I don't know if you can see it is adoption of open protocols and standards for aentic and participation in extender external AI standards foundations like aenti foundation etc ETA um yes we're seeing that these are just like 35% of the uh organizations with OPOS that are focusing here but I think that is something that creates an opportunity for perhaps organizations start thinking how important are Ospos to bring to these conversations early and uh perhaps in a few years we can see that number growing. Um yes uh so as I was mentioning um the opus skills that these teams has been building in the last decade are something that can help also for those organizations uh uh engaging with MCP or building MCP servers uh in their products or in their services. So uh here are some examples on how um these opus skills can map uh with uh MCPS uh for instances if you if you're engaging in standards uh how to participate in the next MCP uh releases uh how to try to transfer the needs that your organization have or the challenges your organization have uh to the open ecosystem. Uh decide when and how to contribute upstream. If your organization is uh engaging with the FCP, how can you uh can you how can you move your engineers or your developers to contribute upstream and uh benefit also for the open ecosystem and so on. And I'm not saying that this is something that the OPOS will own for sure or not. The OPO is more this strategic body uh that uh do this crossf function um view. But of course always the OSPO has been uh collaborating across teams with engineering with security and of course with legal. Um so this is something really important and that I want to highlight here. The OSPO is not the place where this will happen but it's important to have this um open source lynspin and expertise uh team or group of people uh that can also connect with the open ecosystems with the upstream strategy uh and bring that knowledge back and forth in between both worlds um and across the uh the organization. So um here are five questions that um whether you're engaging with MCP or if you're an OSPO and you want to share this with your organization uh will be useful to start having uh first ask yourself and your organizations where are you using MCPS? um what are you depending on uh like okay what how is the open who is building MCPS and also how is the open-source ecosystem doing how is it moving towards um if you're building something can this be become upstream and what is the strategy to contribute upstream in the organization Where should we participate uh to help uh through contributions, working groups, issues? And uh finally, are we helping with vendor locking? How resilient are we to changes? Um how open is the uh identity infrastructure or organization is building? So here are my final remarks. Um the first is treat MCP adoption beyond a technical implementation beyond a protocol adoption that is super important. But uh if if we are talking about organization implementations and moving to and and scaling this uh you need to take care also on the security risks on the regulatoratory landscape that is happening like with the EU AI AI act uh with the ISO standards going on that touches uh perhaps this kind of um this kind of uh landscape. Uh so it's important also to have this strategy and governance mindset around um also participate early uh before uh using this becomes a dependency uh and it will be then easier to analyze and finally bring the OSBO if You already are not doing that into the security conversations into the engineering conversations early because they might have certain knowledge on how open ecosystems work that perhaps all the teams are not have not think about it and uh it can it can prevent certain uh bad things in the future. Um and always cross collaboration has always to better outputs. Um and just to also end up um this and other com other kinds of topics similar around aentic AI are conversations that we are starting to have into a working group that is an open for everyone that is interested to to collaborate that is called aentic AI to empower opus working group this is under the tud group and uh we meet bi-weekly on August we're doing a small break but uh we will keep having we do so and tell sessions. So organizations that are engaging in akai uh are there sharing their demos, their prototypes, their experience under TAM house rules and then we have a group conversations and then we try to bring that knowledge back to build like a a sir guide uh with the group to uh anonymously to share like best practices and and share what we are discovering. So you're more invited more than welcome to to join this these meetings and um I'll be now happy to take any Q&A you have for me if I have time. Thank you so much. Any questions? >> I don't know if I Oh, okay. >> Thank you for your nice presentation. Uh why you are using MCP instead of API? >> Can you repeat please? Why >> why you are using uh MCP instead of API? >> Why MCP instead of API? Okay. Yeah. So uh MCP is useful when you want to connect uh a model into the whole uh workflow and you want to build an AI workflow that has a model around and what I mentioned about the analogy on the M plus MMX is exactly what I was mentioning because uh let me check. Yeah. So here you can just uh have one MCP for the whole like one common language instead of having several custom integrations like what that is the case with APIs that but also as I mentioned that this is this is useful when you want to uh integrate like a model or several models like you want to connect with several uh AI models in the whole pipeline and not just using like APIs in in all the like beyond that. Yeah. I I don't know if that answer to your question or Yeah. >> Hi Anna, how are you? >> Yeah, good >> good. Um the uh so I like the diagram you had there with the MCP sort of enabling all all the different communications. Um uh for organizations that want to uh like you know create downstream developer ecosystems that use AI. So say I'm a happen to be a uh you know like a chipset vendor. Um, but if I want my customers or users or external developers to be able to use AI to um in their own development process, so like I want them to develop software for our platforms and use AI to develop their software so they can like get access to um specifications or APIs or information about our chips. Like what other approaches have you seen other than MCP or do you think MCP is like the way to get access to this sort of data and services and systems or Yeah. >> So can you repeat the last part? uh is MCP do do you have sort of any other alternative approaches or do you think sort of MCP has uh one as like the way to interact with these AI tools when you want to give them access to to data >> um so I I I don't want to say like MCP is the way but it's true that for instance if you're look if if you organizations are looking for a open and no vendor looking way to do that integration. I think MCP is a a a good choice because it's open protocol and it's a it's a a open um that it's like the it says that it's like the UCB universal UCB of uh AI aents and it's being widely adopted by organizations. So I don't want to say that that is the way but it's true that is wellestablished it's open um and it's back up by a thriving community. So it has a lot of pros and benefits. That that is what I can say. [snorts] Any other questions? And I know that questions usually comes later. So I s there my uh ex Twitter. I'm also if you look at Anna Himenez Santa Maria on LinkedIn, I'm also quite active. So, if you have any questions that you want to ask later, feel free to send me a DM and I'll happy to answer those there. You can also, if you have taken screenshots and you want to tag me, feel free also to do so. Okay. Okay, so I think we are going to out of time in a few seconds. So, thank you so much and hope to see you doing through the whole conference. Thank you.