MCP vs A2A: The Two Standard Protocols Defining the Agentic Web

During the early explosion of large language models, connecting foundation models to external software required writing custom, proprietary wrapper code for every tool and database. A developer building a GitHub integration for Claude had to write bespoke Python functions, while a developer integrating the same GitHub API with OpenAI wrote a completely different set of function calling definitions. When switching models or updating tools, the entire integration had to be rewritten.

By late 2024 and throughout 2026, the artificial intelligence industry recognized that proprietary tool integration was creating unsustainable technical fragmentation. Under the stewardship of the Agentic AI Foundation (AAIF) hosted by the Linux Foundation, leading hyperscalers, foundation model labs, and enterprise software leaders united around open standards.

The outcome is a clear architectural division of responsibilities: Anthropic's Model Context Protocol (MCP) governs vertical tool and resource binding, while the Agent-to-Agent (A2A) Protocol governs horizontal inter-agent federation across enterprise boundaries.

A side-by-side technical evaluation of protocol topology, transports, and governance:

Detailed technical specifications are available at the official Model Context Protocol Documentation and the A2A Protocol Specification.

MCP creates a clean client-host-server separation for foundation models. Instead of the model knowing how to execute code directly, it communicates with an MCP Client (such as Claude Desktop, Cursor, or an enterprise backend agent), which connects to multiple standalone MCP Servers:

• Resources: Read-only data sources that can be attached to model context dynamically. Examples include file system trees, live application log streams, or SQL schema definitions. Resources provide standardized URI schemes (e.g., postgres://db/schema/users) so models understand where data originates.
• Tools: Executable functions with strictly typed JSON schema definitions. An MCP server exposes tool definitions (e.g., create_issue, query_database, execute_docker_container). The model emits structured JSON arguments matching the schema, and the server executes the tool locally or remotely, returning structured results.
• Prompts: Standardized, server-provided prompt templates and slash commands that guide the model on how best to utilize the server's tools.

While MCP binds an agent to its immediate toolbelt, A2A solves the challenge of cross-organizational delegation. In a mature agentic economy, an enterprise agent cannot have access to external corporate internal databases. Instead, it must communicate with external partner agents:

• Capability Discovery & Manifests: Agents publish discoverable cryptographic manifests detailing their service capabilities, supported business schemas, required authentication credentials, and token pricing rates.
• Task Handshake & SLA Negotiation: Before executing work, agents perform an automated handshake to negotiate completion deadlines, maximum retry thresholds, and verification criteria.
• Cryptographic Delegation Tokens: User authorization scopes are securely delegated from the primary enterprise agent to external specialist agents using signed tokens, ensuring third-party agents only access permitted resources without exposing master credentials.

Deploying open protocols introduces new attack surfaces that enterprise security teams must mitigate:

• Indirect Prompt Injection via Resources: An attacker inserts malicious prompt injection payloads into a public web page or database record. When an MCP server reads the resource into context, the model executes unintended tool calls. Mitigation: Implementing semantic sanitizer proxies between MCP resource retrieval and model context ingestion.
• Rogue Tool Exfiltration: A compromised MCP server attempts to read environment variables or API keys. Mitigation: Running all local MCP servers inside unprivileged Docker containers or isolated WebAssembly (Wasm) runtimes with restricted filesystem and network access.
• A2A Impersonation & Replay Attacks: Malicious actors spoofing partner agent identities. Mitigation: Requiring mutual TLS (mTLS) and public key infrastructure (PKI) verifiable credentials for all inter-agent network traffic.

Leading enterprise architectures do not choose between MCP and A2A; they integrate both in a layered defense-in-depth model:

• North-South External Federation (A2A): Incoming requests from clients, suppliers, or external vendor agents enter the corporate boundary through an A2A Gateway Router that authenticates delegation tokens and enforces rate limits.
• East-West Internal Execution (MCP): The internal enterprise orchestrator breaks the task into sub-operations, dispatching local tool calls to internal MCP microservices connected to corporate ERP, CRM, and code repositories behind the firewall.