Powering Production-Ready AI Agents: Alex Salazar on Arcade’s Secure MCP Platform

Hey everyone. Welcome back here to Techron tv. Our next guest, another co-founder and CEO been talking to a bunch of them lately, but not of this company.

Let me introduce you to Alex Salazar. Alex is the co-founder and CEO of a company called Arcade. dev for those keeping in score at home.

Alex, welcome to Tech Trunk tv. It's great to have you on here. Oh man.

Thanks. Thanks for having me. Excited to be here.

Our pleasure. So, Alex, let's start, you know, I always like to give people a sense of who they're listening to, who's talking to them. Um, you know, you weren't born the co-founder and CEO of Arcade.

You actually have a a bit of a career behind you, right? Let, let's get people kind of acquainted. Where have you been?

What have you done? How did you wind up here? Yeah, no, great question.

So, uh, let's see. Uh, prior to starting the company, I briefly did a stent in venture capital. Uh, but prior to that, um, I was, uh, the head of product for Okta.

Uh, and particularly their developer products as well as all new products. So VP of product there. And then prior to that I was the, uh, co-founder, CEO of a company called Stormpath, which was an API for developers during the cloud wave.

And Okta acquired that, uh, to be, uh, part of its customer facing developer products. Uh, and then prior to Storming Path, you know, I'm a bit of a mutt. Uh, I've been a software engineer.

I've been a salesperson. I have a Stanford MBAI computer science degree. I'm, I'm like, all I'm, I'm like everything.

Uh, but uh, yeah, You bounce around there. Yeah. But That's what makes one well-rounded.

You know, I, I, uh, I've had this discussion with so many of my friends over the years, you know, liberal arts major in school, who the what a waste of time. Well, no, it's not a waste of time. It, it kind of gives you a well-rounded kind of outlook on things and experience.

I think it's so important for every CEO to have been a salesperson. Yeah. Yeah.

Incredibly. 'cause I've never met A CEO who's not a salesperson. Right.

And if you have a CEO who's not a salesperson, you're probably not gonna have a successful company. You're lipstick guy gone. So.

Yeah. No, it's all good. It's all good.

Um, so give us kind of the arcade story. What you, you, you left Okta? Yeah.

You went briefly, as you say, in a VC into venture capital. Yeah. What happened, you know, what drove you to do this?

Yeah, so, uh, and if I rewind the clock really far back, um, when Amazon AWS first came out and I saw EC2 and S3, um, you know, I was much younger and had, you know, had better hair. But, um, I remember seeing that you and me buff and being like, yeah, I remember seeing that product and being like, oh my God, this is the future platform. And it was controversial at the time that all software was gonna get built on top of, you know, cloud elastic compute.

Uh, but I made a big bet at the time and I built Storm Path and we ended up being right. We ended up calling the market, and that worked out really well. 5 turbo come out.

And when I saw that first tool calling model, I immediately had the same instinct and feeling that I had, I had with, you know, EC2 and S3, which is this is the new platform, all new software is going to get built on top of this. And I had to grab my surfboard and, and, and jump on that wave. And it was very early, this was still very controversial.

People still were debating whether or not agents were gonna be a real thing or not. And we went to go start a company to go build an agent. We were gonna do site reliability DevOps agent that was gonna help you diagnose, uh, you know, diagnose why a server had high latency.

And as we, and we got like any agent being built, we got a demo working relatively easily. It was a very cool demos, black magic. But when we tried to go from demo to production, we started to run into a lot of really big problems.

The first problem is, if you think of a diagnostic flow for a server, uh, there's a lot of steps. I mean, you know, you, you pay DevOps people and SREs a lot of money to go figure out how to intuit why a server's having high latency. And if you throw a large language model at it, it's even more difficult.

It has to make a lot of large language model calls to go, Hey, is it the server? Is the database, is it outta memory? Is it at, you know, each of those calls has a risk of a hallucination.

And so if you chain together 10 or 20 of these LLM calls to try and figure out why the server is not operating the way you want, you're gonna be hallucinating like 90% of the time. And so the product's not functional. And so we ran into that problem, people call it compounding error rates.

The second problem we ran into was we were accessing sensitive systems. We were accessing Datadog and Grafana and individual servers and individual databases. And in a demo we'd given ourselves super user access, but in production, no one's gonna give us that.

And then we discovered the hard way that in the world of agents, there was no way to do scoped privilege access. And so as we went to go solve this problem for the agent that we were building, we realized we were gonna have to invent a way of solving both of these problems. And we got lucky.

It was the same answer for both, which was we were going to call the large language model less, not more. And to do that, we were gonna push a lot of the logic into what people call the tool layer. Now, the tool layer at the time was nascent.

I mean, the number of people even talking about tools was very small. And we had in our mind that if we created a separate runtime where all of the, all of this, all this logic could exist separate from the large language model, it could be deterministic, you know, you could trust it. And that would allow us to do complicated operations that would allow us to do authenticated and authorized operations without leaking any sensitive information back to large language model.

And when we built that layer, all of a sudden our demo was black magic, and it worked. People couldn't believe it. People thought we, people thought we were lying to them.

People thought we were, you know, hard coding things into the demo. And when we showed them that we weren't, their minds were blown. And that's when we realized we built something more important than the SRE agent we had originally sought to build.

And so that led us to go build Arcade. Now, so what is Arcade? Um, arcade is an end-to-end MCP execution platform, which is a lot of jargon, but what that means is we make it really easy for your AI agents to connect securely to other systems, whether it's APIs, databases, code, or some other system out there.

We make it very, very easy. Uh, we handle all the authentication and authorization between the agent and that system. We have a bunch of out of the box connectors that have all been optimized for large language model, tool selection and parameter prediction.

And we give you a really nice SDK to go build your own MCP servers if you have to. So it's funny, we record text on gang every morning in the studio, further down the stage over there. Yeah.

Different set. We had this discussion today. Someone said, what, what was it?

Uh, it it was something like, you know, MCP serve as a ubiquitous and they're never going away. Well, that, that's a pretty bold statement for something that just came out like in January, you know, um, what is, is arcade then sort of an MCP server on steroids? Is it, you know what Yeah.

What is it over and above that? Yeah, so let, let, well, I mean, let's take a step back and talk about what MCP even is, right? So I think part of the problem, there's a lot of confusion in the industry as to what MCP is, right?

MCP is a communications protocol, so it's like HGTP, uh, it's like USB, it is not the USB stick. It is not the web app. It is not the MCP server.

Uh, those are all implementations of a system that is speaking the protocol. So we act, we actually started the company before MCP existed. Uh, we, so we, we like to say we're pre MCP, um, we had our own protocol.

So the only thing that materially changed for us was we swapped out the protocol once a standardized protocol came out. The real hard work is not the protocol. The real hard work is you have to go build this MCP server and expose it to your agent in a way that is going to be consistent, accurate, and secure.

And if you're building something that's gonna work in production, it's also gotta be scalable and governable. Um, and so where we come in is we're think of us like the control plane or, you know, if I really go back in time, think of us like, like the, the, the, the enterprise service bus that all of these MCP servers are going to plug into and then all the agents can communicate to. And so instead of us directly wiring in every single MCP server into every single agent, and then we're, and then having to have every single agent implement all of its own user authentication and authorization, they can all just hook into one, one layer and then any agent can access it very, very easily.

So we make it all very, very simple. Um, I joke to clients, uh, our, some of our bigger customers that if, if Okta and MuleSoft had a next generation baby for the agent world, that's what, that's what we are. Um, we, we have, we have.

I like it. Yeah. So it's the service bus with an authorization layer built in.

Excellent. And now, I guess the authorization, is it using what, what, what, what kind of protocols is that authorization using? Yeah, so that's the magic is there's so many people in the industry that are trying to sell you all these new solutions.

Uh, and one of the, one of the really frustrating ones for me who comes from identity is, you know, people talk about non-human identity. Oh, the agents this like new class of user, we need to treat it really differently. And, and in practice that doesn't work, uh, because the agent's doing work on behalf of users 90% of the time.

And so the best answer that I have found is what we do is, how we got to this problem statement is you treat the agent like an application. Turns out the industry knows how to do application security. We've been doing it for decades.

And, and since it's doing work on behalf of the user, we've known for at least 10, 15 years how to do delegated user authorization via OAuth. And so we are protocol agnostic on the authentication authorization side, but OAuth solves majority of the problems we see in the field. And so our first big innovation was bringing OO in to agent world.

That, that, that is where a lot of, that's where we filed a lot of our patents. Um, and that's where we've done a lot of work in MCP, you know, MCP doesn't, doesn't yet, as of as of today, doesn't yet have the ability to do delegated user authorization at the tool level. Can this agent perform this action on behalf of this user?

That's not yet in the spec, but it's coming imminently. We're the ones that contributed that to the spec. Got it.

Got it. Makes a lot of sense. Now, um, let's talk about who you're, you know, the personas of users here for for arcade.

Yeah, it's a great question. Um, it's anyone trying to build an agent. If you're trying to build an agent, you're going to need to figure out how to make it talk to other services.

'cause if it can't connect to something, then it's just a chat bot. And that's very different. And, and if you want to do anything interesting, anything meaningful to do a workflow automation, it's getting to talk to something that is probably secured and has some degree of authentication and authorization attached to it.

We make that very easy. Um, and then beyond the developer or AI engineer trying to build that agent, it's their leadership stack all the way up that has the same problem statement, just maybe sounds a little different 'cause they're thinking about it in at a higher level all the way up to a CIO who's thinking through, Hey, how am I gonna have an entire agent practice in my organization that I can still somehow manage and control and make sure that we're not gonna get breached. Alright.

dev A-R-C-A-D Dev, um, is this product, you know, ga at this point, are you still, is it commercially available? Yeah, Yeah. Product product's been commercially available since January.

Um, it, it's, you know, we've got tons of customers. I mean, I think we get like, you know, close to a thousand signups a month, the product's free to start playing with. So it is, it is used based pricing, it's metered pricing, so you can start for zero and you only pay for what you use.

And then for, you know, larger enterprise organizations, we can deploy this in their own VPCs their own environments. So nobody is forced into a multi-tenant public cloud service. Um, you know, we can deploy this in our own environments and it's great.

We've got tons of customers that are really happy. Very cool, man. Alex, it sounds like you got a a another tiger by the tail here with this.

It's certainly timely, timely, uh, you know, technology thing as, as we are exploring this, you know, we were, we were talking this morning, you know, are we in an AI bubble or whatever, right? I mean, when 50% of your nation's GDP is tied into AI and data centers, I think the Times ran an article today, there's actually an AI economy and then the rest of the economy, right? Yeah.

Uh, it's a good time to be in here, right? So good for you, man. I think you made the right move getting outta VC back, back into it.

Yeah, I think, I think for Interesting times, I think, yeah, I think for everybody who knew me well, they, they, they thought it was a matter of time. And so, uh, the moment that saw the opening, I, We, we call that a pit stop, right? That's a pit stop, man.

All right. Hey, I wish you a lot of success. Come back and keep us posted on Arcade.

Okay. Hey, Thank you so much, Adam. Hey, talk soon.

All right. Alex Salazar, co-founder, CEO of Arcade Dev. That's arcade dev.

Check it out here on Text Drunk tv. We'll be back in a moment.