Alex Shershebnev (Head of ML/DevOps and DevRel, Zencoder) explains that this gap becomes obvious once developers try using AI in real production systems, where even a logical-sounding model output can trigger unexpected and potentially harmful effects if it interacts directly with live infrastructure.

He warned that letting an LLM act without limits – like querying databases or deploying code – could cause serious damage, from wiping data to pushing faulty code.

The key challenge, therefore, is to bridge this intelligence gap safely.

Enter MCP – a bridge between AI and infrastructure

To address this problem, the industry has turned to the Model Context Protocol (MCP), introduced by Anthropic in late 2024. MCP standardizes how LLMs connect with external tools, APIs, and systems in a secure and transparent manner. The protocol defines two core entities:

• MCP Client – usually the LLM or AI agent that determines which tools it needs to fulfill a task.
• MCP Server – the component that exposes a curated list of available tools and safely executes operations when requested.

This structure allows LLMs to extend their functionality beyond text generation, performing actions like fetching monitoring data from Grafana, reading error logs from Sentry, or triggering CI/CD pipelines without requiring unrestricted access.

Even major players like OpenAI have adopted MCP, underscoring its growing importance as an interoperability and safety standard.

Clear parameters drive accurate tool execution

Shershebnev detailed how MCP servers present resources as tools, each defined by a name, parameters, and a clear description. The MCP client (LLM) can then select and execute the appropriate tool to retrieve or modify data.

This exchange follows a predictable, auditable flow: upon initialization, the server exposes a list of all available tools, and the LLM requests specific actions based on user input. The server executes the operation, returns the results in a standardized format, and the LLM incorporates them into its response.

Alex emphasized that MCP’s design makes it language-agnostic and easy to integrate. Developers can quickly connect their existing systems by importing a lightweight MCP library and defining tool endpoints. This opens a path for automating repetitive DevOps tasks such as branch creation, ticket management, and incident reporting.

Through live examples, he showed how MCP agents can automatically handle Jira tickets, open branches, and even query Kubernetes clusters to diagnose pod issues, all without leaving the IDE. However, these same capabilities also amplify the potential for misuse if the setup is not properly secured.

MCP servers inherit all the vulnerabilities of traditional servers

“Great power comes with great responsibility,” Alex noted when addressing MCP’s dual nature. MCP servers, while powerful, inherit all the vulnerabilities of traditional servers: package hijacking, malicious dependencies, open ports, and unpatched libraries.

On top of that, they introduce new, AI-specific risks.

The most prominent among them is prompt injection, a scenario in which a malicious payload hidden inside text, code, or a web page manipulates the LLM into performing unintended actions.

Another class of attacks he called “shadow tools” exploits naming collisions: a malicious tool is registered under the same name as a legitimate one, tricking the LLM into executing unauthorized operations. These vulnerabilities highlight how tightly coupled AI logic and system control have become, and why simple sandboxing or API tokens are no longer enough.

Alex also referenced industry data showing that even advanced AI providers detect only a portion of injection-based threats, meaning some attacks still slip through. The takeaway for developers: assume partial protection and plan defense in depth.

Deploying MCP safely requires careful controls

Alex emphasized that deploying MCP safely requires careful planning and strict boundaries: “You can’t treat MCP as just another tool in your stack. Every action an agent takes must be controlled, monitored, and limited to what is strictly necessary.”

According to him, developers should define precisely which tools are accessible to the LLM, ensuring that only allowed operations are permitted.

Agents should operate with the principle of least privilege, confined to staging or read-only environments rather than production. He also mentioned the importance of input sanitization, explaining:

Never feed raw, unfiltered content directly to the model. Use intermediary layers to clean and summarize information before passing it along. Every MCP call and response should be fully auditable, with detailed logging of tool identifiers, inputs, outputs, and timestamps.

For critical operations, such as deployments or database changes, Alex recommended incorporating human approval steps to prevent unintended actions.

MCP lets AI act in the real world – but only under controlled boundaries

Finally, Alex urged teams to combine traditional DevSecOps measures with MCP-specific precautions.

Dependency scanning, code signing, and supply-chain verification remain essential, and simulation through red-team exercises can reveal vulnerabilities from prompt injections or shadow tools before they reach production. “These measures are not optional,” he said, “they are prerequisites for responsibly integrating AI into DevOps pipelines.”

Alex concluded by reminding the audience that the MCP represents a major leap forward for AI-driven automation. It allows LLMs to interact meaningfully with the real world, enabling developers to build faster, smarter, and more context-aware systems. However, without strict governance and defensive design, the same flexibility can easily become a security liability.

MCP is not just a technical framework; it’s a blueprint for trust boundaries between human developers, AI agents, and production infrastructure:

As organizations begin adopting these tools, the line between code generation and code execution will blur, and the teams that succeed will be those who treat AI not as an omnipotent engine, but as a collaborator that must operate within precisely defined limits.

To see these principles in action, Infobip offers their own MCP servers for its communication APIs and has released an open-sourced OpenAPI MCP framework that developers can use to expose any OpenAPI-described service to AI agents securely. 

The post MCP Lets AI Actually Do Stuff Safely – But Only If You Watch It Like a Hawk appeared first on ShiftMag.

AI, just like your dog, will eagerly try to please you but its assistance can sometimes be anything but helpful. AI, just like your dog, needs a firm master, warned principal developer advocate at Atlassian Dugald Morrow.

As one of the first speakers at the Shift conference in Kuala Lumpur, he delivered a clear message: use AI wisely, not blindly. 

AI needs guidance and supervision

Morrow illustrated how much AI needs guidance and supervision by dividing AI tasks into three levels.

• On the first level, AI performs well.

This is when it’s dealing with simple, well-defined tasks such as searching for information or processing raw data. 

• On the second level, AI can still perform, but often inconsistently.

This occurs when tasks grow more complex and require understanding the relationships between pieces of data – in other words, when analysis demands some degree of knowledge.

• On the third and most challenging level, AI fails.

This stage involves deep reasoning, judgment, and the creation of entirely new content – and here, the house of cards begins to fall apart. Yet our expectations for its ability to generate content remain enormous.

Despite appearing capable, AI lacks true wisdom

Although it appears capable, AI lacks the necessary wisdom, it works well within known data but struggles to go beyond it, Morrow explains. He even offers a diagnosis of AI: 

AI actually suffers from the Dunning-Kruger effect. It’s always willing to answer a question, but sometimes it’s not quite capable of doing so. 

He even goes a step further comparing AI to a dog: 

It’s got boundless enthusiasm, gleefully doing whatever you ask, though the results are often questionable or sometimes brilliant. We all know dogs have incredible senses – some can even sniff out cancer. Yet they can also do very silly things, just like AI can hallucinate or miss obvious facts.

What’s the cost of delegating everything to AI? 

This comparison works pretty well, although we could just as easily say that we’re the lazy dogs, demanding AI to do things instead of us.  

Morrow, who has a very interesting CV, having helped build submarine combat systems (for Collins-class submarines) and later an air traffic control system for Canada, in his exposé posed a question we’ve all asked ourselves: What’s the cost of delegating everything to AI? 

He offered a few answers to that, and they are not flattering.

While using AI in generating content you don’t become as familiar with that content as you would have if you generated the content manually. And you can’t evaluate if your content is of a high quality or not, he said. 

He warned the developers in the room that in their code may be hidden bugs or performance issues that they would have thought about if they had created it alone. 

Also he pointed out that overuse of AI erodes our skills to create: 

We all heard the practice makes perfect. You can’t learn tennis by just watching it or asking someone else to do it for you.  

96% of companies haven’t seen major AI gains yet

It’s tempting to use AI, but it’s really not necessary everywhere. How addicted we’ve become to LLMs and how often they fail to meet our expectations is shown in a recent Atlassian report. 

Although 62% of executives say that AI makes them more efficient, 37% say that it has wasted their teams’ time. Among the 12,000 people who participated in the research, 42% admitted that they trust AI too much. Perhaps the most striking finding from the report is that 96% of companies haven’t seen any dramatic improvements from AI yet. 

Therefore, Morrow proposes a managed AI approach, which means using artificial intelligence with the right level of human oversight, depending on the complexity and importance of the task.  

As we all know, not every task should be handed over entirely to AI.  

However, some rudimentary ones, like extending existing code patterns or fixing small bugs can be. In those cases, AI can safely work almost independently, since it’s simply repeating known patterns.  

He gave example of his own presentation which he made using Atlassian’s cloudapp development platform: 

The “spot image” didn’t display and showed a 404, so I used Robodev. It didn’t create a new image—just found the correct one and updated the code instantly. Since it was a simple, repetitive task, I trusted AI to handle it reliably.

When AI needs a firm master

But if AI has a task to build something entirely new, master has to be there. In this case Morrow advises breaking the work into smaller parts or defining a detailed specification before asking AI to generate code. That way, human stay in control of structure and intent. 

This is even more important when AI is asked to do complex algorithms.  

Developers should first define and document the algorithm in detail (inputs, outputs, logic) and then let AI complete it, suggests Morrow because that’s how AI has enough context to succeed. Otherwise, he claims, the good output is highly unlikely. 

He showed the code for his presentation and explained how he used AI to extract parts of a large SVG file for different slides, providing detailed descriptions and documentation for the extraction algorithm. 

To conclude, everything he said makes sense. The managed AI approach he advocates is essentially about balancing automation with human judgment. Rather than blindly delegating tasks to AI, developers should determine the appropriate level of guidance and oversight for each situation. As Morrow puts it: 

AI is like your dog. It’s a wonderful tool, but you need to manage it.

The post Lessons from Atlassian: AI is Like Your Dog, It Needs a Firm Master appeared first on ShiftMag.

Infobip Shift, one of Europe’s leading developer conferences, is making its Asian debut on November 4th, 2025!

In partnership with Cradle, Malaysia’s startup ecosystem builder, we’re bringing developers, founders, and innovators from across ASEAN together in Kuala Lumpur – building connections, sparking ideas, and shaping the future of software.

“By bringing Shift to Malaysia, we’re giving Southeast Asian developers the chance to learn, connect, and join the same conversations shaping tech in Europe and the US,” says Stipe Cigic, Head of the Infobip Shift team:

The city has a fast-growing, diverse tech community, full of talent, curiosity, and energy – but without many events that truly bring developers together in one place.

Everything is AI. Are you ready?

Whether you’re working with AI at scale or exploring it for the first time, Shift KL brings together developers, researchers, and founders to share knowledge and insights.

From copilots and LLMs to agentic workflows and ethical challenges, AI is reshaping how software is built – and Shift KL is where you can see it in action and discuss what it means for your work.

World-class experts including Tejas Kumar (Developer Advocate, IBM), Dugald Morrow (Principal Developer Advocate, Atlassian), and Joyce Lin (Lead Tech Educator, LMArena) will share their perspectives on the latest AI trends and practical ways to apply them.

For Shift, it’s also a way of staying true to what we’ve always stood for: connecting developers wherever they are, and building a global community that keeps learning and growing together.

Shift KL will also be third event on a third continent in the same year!

Get your ticket!

Calling all developers, tech aficionados, and industry experts!

The first 10 applicants to complete the form get free tickets, and the next 10 receive a 30% discount for Shift Kuala Lumpur 2025!

The post Shift is Coming to Asia – and We’re Giving Away 10 Tickets! appeared first on ShiftMag.