Spring AI and MCP Governance for Enterprise Java

Enterprise Java teams have largely solved the AI integration problem. Spring AI reached production readiness in 2025 and version 2.0 in 2026, while the Model Context Protocol (MCP) now sees an estimated 28% of Fortune 500 companies deploying it. But as UberConf 2026 made clear, the next challenge is governance: security advisories spiked 1,700% in April 2026, and critical CVEs in Spring AI vector stores and RAG pipelines show that production AI requires more than just easy API calls.

What happened

Spring AI, the Spring Framework's abstraction layer for LLM integration, reached GA with version 1.0 in May 2025 and released version 2.0 in May 2026, requiring Spring Boot 4.0. MCP, introduced by Anthropic in November 2024 and now governed by the Linux Foundation, has crossed 97 million monthly SDK downloads and is deployed by an estimated 28% of Fortune 500 companies.

The rapid adoption has expanded the attack surface. In April 2026, security advisories submitted to the Spring team spiked by more than 1,700% compared to historical averages. Broadcom responded with the largest set of Spring security updates in the framework's 23-year history. Two notable vulnerabilities: CVE-2026-47835 allowed SQL injection through Spring AI vector store interfaces via specially crafted filter strings, affecting Spring AI versions 1.0.x through 1.1.x. CVE-2026-22738 was a Spring Expression Language injection flaw in RAG pipeline implementations that enabled remote code execution in proof-of-concept code.

Research from Veracode in spring 2026 found that security pass rates for AI-generated Java code remain stuck at approximately 55% across five critical vulnerability categories, nearly identical to two years earlier. Java performed worse than other languages, attributed to AI models being over-trained on legacy Java patterns from public repositories.

On the infrastructure side, JDK 21 Project Loom virtual threads are now treated as settled infrastructure for I/O-bound AI workloads. Virtual threads eliminate the need for reactive programming when handling thousands of simultaneous LLM API calls, as the JVM parks blocking threads instantly without OS context switches. However, virtual threads provide no benefit for CPU-bound tasks like local model inference or tokenization at scale.

The conference also featured Embabel, a new JVM-based framework applying Goal-Oriented Action Planning (GOAP) and Domain-Integrated Context Engineering (DICE) to enforce preconditions and invariants before agents act, aiming to make AI agent behavior auditable.

Why AI builders should care

For teams building AI products on Java, the integration story is mature. Spring AI's auto-configuration model lets you switch AI providers by changing a dependency and a property. MCP standardizes tool connections so one server per resource works with any MCP-compatible agent. But the governance layer is not yet production-ready. Only about 5% of MCP servers currently run in production rather than on developer laptops, a gap that reflects unresolved auth and governance friction.

The core takeaway: you can now build AI into your Spring Boot app in minutes, but deploying it safely at scale requires policy-driven guardrails, centralized authentication, and auditable agent lifecycles. The Veracode finding that roughly half of AI-generated Java code contains known vulnerabilities when produced without explicit security prompting is the empirical argument for why these controls are not optional.

Practical implications

First, plan your migration from Spring Boot 3.5 to Spring Boot 4.0 and Spring AI 2.0. Spring Boot 3.5 reached end of life on June 30, 2026, meaning organizations running it without extended support no longer receive security patches. The migration path clears exposure from documented vulnerabilities in Spring Security and Spring Cloud Gateway.

Second, address authentication for MCP-based agents. OAuth 2.1 token lifecycles do not match the duration of long-running agent sessions, and per-server per-user consent prompts