Agent protocol

How it works

An agent protocol answers three questions for the two sides of a connection:

1. What can you do? One side publishes a description. An MCP server shows its tools. An A2A server publishes an Agent Card.
2. What is the message format? MCP uses JSON-RPC 2.0. A2A has JSON-RPC, gRPC and HTTP+REST bindings.
3. What is the unit of work? MCP has a tool call. A2A has a task. UCP has a checkout session.

Why agent protocols are a security issue

An agent protocol moves the trust decisions to the software that uses it.

Three risks follow:

• Untrusted descriptions. MCP tells hosts to think of tool descriptions as untrusted. A bad description starts MCP tool poisoning.
• Identity is not in A2A messages. A2A says “identity information is handled at the protocol layer, not within A2A semantics”. It relies on established web security practices.
• Credentials in a chain. A2A warns that credentials in messages can go across chains of agents. This is one type of insecure inter-agent communication.

In practice

An AI agent usually uses more than one protocol. The paper by Yang and colleagues (2025) puts MCP in a “context-oriented” class and A2A in an “inter-agent” class.

Protocol	From	Date	Task
Model Context Protocol (MCP)	Anthropic, at this time Agentic AI Foundation	in the Foundation 9 Dec 2025	tools and data
Agent2Agent protocol (A2A)	Google, at this time Linux Foundation	April 2025	agent to agent
AP2	Google, with more than 60 organizations	17 Sep 2025	payments by agents
Agentic Commerce Protocol	Stripe and OpenAI	29 Sep 2025	checkout
UCP	Google, with Shopify, Etsy, Wayfair, Target, Walmart	11 Jan 2026	discovery to checkout

Numbers from the owners:

• The Linux Foundation reported “more than 10,000 published MCP servers” on 9 December 2025.
• More than 100 technology companies were behind A2A when it went to the Linux Foundation on 23 June 2025.
• A2A version 1.0.0 is the latest released version of the specification.

Why a purchase needs its own protocol

Google says that payment systems think that a human will to push “buy” on a trusted surface. An agent breaks that rule. AP2 gives three questions:

1. Authorization. Did the user give the agent authority for this purchase?
2. Authenticity. Does the message show what the user really wants?
3. Accountability. Who is responsible for a bad or fraudulent transaction?

AP2 uses “Mandates”, signed records of what the user approved. An Intent Mandate keeps the first instruction or the rules, such as a price limit. A Cart Mandate keeps the accurate items and price.

Stripe says that with the Agentic Commerce Protocol, the business stays “the merchant of record”. A UCP seller publishes a JSON manifest at /.well-known/ucp. UCP is “compatible with” AP2 and works through APIs, A2A or MCP.

Where definitions disagree

A class or one specification. This page uses “agent protocol” for the full class, as the paper by Yang and colleagues does. A different specification has the name “Agent Protocol”. It is a REST API in OpenAPI with endpoints for tasks and steps, from AGI, Inc.

Two protocols named ACP. The Agent Communication Protocol from IBM was for messages between agents. It merged into A2A in August 2025, and its team stopped active development. The Agentic Commerce Protocol from Stripe and OpenAI is a different protocol, for checkout. Find which ACP a source means.

Questions and answers

What is the difference between MCP and A2A?

MCP connects one AI agent to tools and data. An MCP server gives resources, prompts and tools to the software that uses the model. A2A connects one agent to a different agent. Each A2A server publishes an Agent Card of its skills, and the other agent sends it tasks. An agent can use MCP for its tools and A2A to give work to a second agent.

What is an agentic commerce protocol?

An agentic commerce protocol is an agent protocol for a purchase. It lets an AI agent start a checkout and pay a seller with no web page. Google says UCP covers the steps from discovery to checkout. Stripe and OpenAI made the Agentic Commerce Protocol in September 2025. Google made AP2 for the payment step in September 2025, and UCP in January 2026.

Does an agent protocol make an AI agent safe?

No. A protocol sets the format of the messages, not their content. The MCP specification says that MCP "cannot enforce these security principles at the protocol level". The A2A specification says identity is handled at the protocol layer, not in A2A semantics. It relies on established web security practices.