A2A and agent protocols
MCP answers one question: how does an agent reach a tool or a data source? A different question appears as soon as companies have more than one agent. A travel company's booking agent needs a visa check, and the visa agent belongs to a different team, runs a different framework, maybe lives at a different company. It is not a tool with a schema. It is another agent that takes a task, works on it for minutes or days, asks questions, and returns results.
A2A, the Agent2Agent protocol, is the open standard for that conversation. Google introduced it in 2025, it reached version 1.0, and like MCP it now sits under the Agentic AI Foundation. This chapter explains how it works, how it differs from MCP, and the other small standards that have grown up around agents.
Why not just wrap the visa agent as an MCP tool? What does a call to another agent need that a call to a tool does not?
Tools and agents are different things to call#
That is the answer to the question at the top. A task for another agent has a lifecycle (submitted, working, waiting for input, done, failed), can need back and forth conversation, can take hours, and produces outputs of its own. A tool call has none of that. The two protocols are complements: an agent often uses MCP to reach its tools and A2A to reach other agents.
How A2A works#
Agent Card. Every A2A agent publishes a JSON document describing itself: its name, what skills
it offers, its endpoint, which features it supports (streaming, push notifications) and how to
authenticate. Other agents discover it at a well known URL on the agent's domain, the way websites
publish robots.txt.
Task. The unit of work, with an id and a state that moves through a defined lifecycle: submitted, working, input required, auth required, and finally completed, failed, canceled or rejected.
Message and Part. A message is one turn of conversation from the client or the agent, made of parts: text, files or structured data.
Artifact. An output the agent produced for the task, such as a document, an image or structured data, kept separate from the conversation.
Messages travel over standard web technology. The specification defines equivalent bindings for JSON-RPC, gRPC and plain HTTP with JSON, server sent events for streaming progress, and webhooks for push notifications when a task takes too long to watch. Authentication uses familiar schemes declared in the Agent Card: API keys, OAuth 2.0, OpenID Connect or mutual TLS.
The other small standards#
AGENTS.md. A plain markdown file at the root of a repository telling coding agents how to work in it: how to build, test, the conventions to follow. Started by OpenAI with other coding tool makers, it is also part of the Agentic AI Foundation. It is the simplest standard of all and, for most teams, the first one worth adopting.
Skills. Several agent products load folders of task instructions and scripts on demand (a
SKILL.md describing when and how to use them), so an agent can pick up a specialised workflow
without it sitting in the prompt all the time.
The pattern across all of these: open, boring formats that let tools from different vendors work together. That is how the web became the web, and agents are following the same path.
| Choice | What you gain | What you pay | Pick it when |
|---|---|---|---|
| Expose capability as MCP tools | Simple, fast, and every agent host already supports it. | The caller does all the reasoning. No long tasks or back and forth. | Deterministic functions and data: lookups, actions, searches. |
| Expose an agent over A2A | Long running tasks, clarifying questions, and the agent keeps its own tools and logic private. | More moving parts, and less control for the caller over how work is done. | A capability that needs judgment, owned by another team or company. |
| Call another team's ordinary API | Predictable, testable, well understood. | No flexibility for requests the API did not anticipate. | Still the right answer whenever the task is well defined. |
An A2A partner is a separate system, possibly at another company, with its own failures and its own exposure to prompt injection. Treat its messages and artifacts like any external content: validate them, never let them grant permissions, and keep the lethal trifecta in mind when combining its results with private data.
Checkpoint#
1. What is the main difference between MCP and A2A?
2. What does an A2A Agent Card describe?
3. A visa agent needs one more fact to finish. What does its A2A task do?
- MCP: agent to tools. A2A: agent to agent. They complement each other.
- A2A: Agent Card, Task with states, Messages of Parts, Artifacts.
- Tasks can wait for input and run long, with streaming or webhooks.
- AGENTS.md tells coding agents how to work in a repository.
MCP connects an agent to tools and data, while A2A connects an agent to another agent. A tool is a function with a schema that returns quickly; another agent takes a task in natural language, may ask clarifying questions, can work for hours, and returns artifacts, without exposing its prompts or tools. In A2A each agent publishes an Agent Card with its skills, endpoint and auth, work happens in tasks that move through states like working, input required and completed, messages are made of parts, and outputs are artifacts, carried over JSON-RPC, gRPC or HTTP with streaming and push notifications. Both protocols now sit under the Agentic AI Foundation, alongside AGENTS.md for telling coding agents how a repository works. I would still treat another agent's output as untrusted input.