A2A protocol: what it is, how it works, and A2A vs MCP

Short answer

A2A (Agent2Agent) is an open protocol that lets one AI agent find another, send it a task and get the results back, even when the two are built by different companies on different frameworks. Google announced it in April 2025. It's now a Linux Foundation project in the Agentic AI Foundation, next to MCP, and version 1.0 came out in March 2026. The short difference: MCP connects an agent to tools and data, and A2A connects an agent to other agents. Google Cloud, Microsoft Foundry, AWS Bedrock AgentCore and Salesforce Agentforce support it. OpenAI's and Anthropic's agent tools don't, as of November 2026.

What A2A is for

Most agents are built to work alone. Once a company has several, say a support agent from one vendor and a billing agent from another, they need a common way to call each other. A2A is that common way: each agent publishes what it can do, and any other agent can send it work over HTTP.

The agents stay opaque to each other. They exchange messages, tasks and results, but not their memory, prompts or tools, so neither side has to expose how it works inside.

A2A's history in brief:

• April 9, 2025: Google announces A2A with more than 50 partners (Google).
• June 23, 2025: it becomes a Linux Foundation project, with AWS, Cisco, Google, Microsoft, Salesforce, SAP and ServiceNow as founding members (Linux Foundation).
• August 2025: IBM's Agent Communication Protocol (ACP) merges into A2A.
• March 12, 2026: version 1.0. Version 1.0.1, with fixes, followed on May 28 (releases).
• April 2026: more than 150 organizations support it (Linux Foundation).
• August 2026: A2A joins the Agentic AI Foundation, which also hosts MCP (AAIF).

The spec and SDKs are open source under the Apache 2.0 license.

How A2A works

1. The Agent Card

Every A2A agent publishes an Agent Card, a JSON file at https://{domain}/.well-known/agent-card.json. It says who the agent is, which skills it has, where to reach it and how to sign in. A small one looks like this:

{
  "name": "Invoice agent",
  "description": "Finds invoices and answers billing questions.",
  "version": "1.2.0",
  "supportedInterfaces": [
    { "url": "https://agents.example.com/a2a", "protocolBinding": "JSONRPC", "protocolVersion": "1.0" }
  ],
  "capabilities": { "streaming": true, "pushNotifications": false },
  "defaultInputModes": ["text/plain"],
  "defaultOutputModes": ["text/plain", "application/json"],
  "skills": [
    {
      "id": "find-invoice",
      "name": "Find an invoice",
      "description": "Looks up an invoice by number, customer or date, and says whether it's paid.",
      "tags": ["billing", "invoices"]
    }
  ]
}

A card can also declare sign-in methods (API keys, HTTP auth, OAuth 2, OpenID Connect or mutual TLS) and carry a signature, so a client can check it came from the agent's owner. Signing is optional.

2. Messages and tasks

The client agent sends a message with SendMessage. Over JSON-RPC, it looks like this:

POST /a2a
Content-Type: application/json
A2A-Version: 1.0

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "SendMessage",
  "params": {
    "message": {
      "messageId": "msg-1042",
      "role": "ROLE_USER",
      "parts": [{ "text": "Find invoice 1042 and tell me if it's paid." }]
    }
  }
}

The remote agent answers with a message, for quick replies, or a task for work that takes time. A finished task carries its results as artifacts:

{
  "task": {
    "id": "task-uuid",
    "contextId": "context-uuid",
    "status": { "state": "TASK_STATE_COMPLETED" },
    "artifacts": [
      { "artifactId": "artifact-uuid", "name": "Invoice 1042", "parts": [{ "text": "Paid on October 3, 2026." }] }
    ]
  }
}

A task moves through these states: submitted, working, input required, auth required, completed, failed, canceled and rejected. Input required means the remote agent needs an answer before it can go on, such as "Which customer?". The client replies in the same task.

Each part of a message or artifact holds text, a file (as bytes or a URL) or structured JSON data.

3. Long-running work

For tasks that take minutes or hours, A2A gives three options:

• Streaming: SendStreamingMessage keeps the connection open and sends status and artifact updates as server-sent events.
• Push notifications: the client registers a webhook, and the agent posts updates to it.
• Polling: the client checks with GetTask.

4. Three ways to send it

The same operations work over JSON-RPC 2.0, gRPC and plain HTTP with JSON, such as POST /message:send. The Agent Card lists which ones an agent offers.

A2A vs MCP

A2A's own docs call MCP vertical, giving one agent depth with tools, and A2A horizontal, connecting agents across teams and companies (A2A docs). Their example is a car repair shop: a mechanic agent uses MCP to work its diagnostic scanner and repair manuals, and A2A to talk to the shop manager agent and to order parts from a supplier's agent.

So they aren't rivals. A typical A2A agent uses MCP inside to reach its own tools. You can also wrap another agent as an MCP tool, which is simpler when one agent just calls another and waits. A2A earns its extra work when the other agent belongs to another team or company, runs long tasks, or needs to ask questions back.

Who supports A2A

As of November 2026:

Many products still run version 0.3, including SAP's reference setup and CrewAI's default, so check which version an agent speaks before connecting to it.

What changed in A2A 1.0

Tutorials written in 2025 often use the old names. If you see /.well-known/agent.json, it's from before 0.3. If you see message/send or "kind": "text", it's from before 1.0. The main changes in 1.0 (what's new):

• Method names: message/send became SendMessage, message/stream became SendStreamingMessage, and tasks/get became GetTask. ListTasks is new.
• Values: states and roles are written TASK_STATE_COMPLETED and ROLE_USER instead of completed and user.
• Parts: one Part type holding text, raw, url or data, instead of separate text, file and data parts with a kind field.
• Agent Card: the agent's addresses moved into supportedInterfaces, each with its protocol and version, and cards can be signed.
• Sign-in: OAuth's implicit and password flows are deprecated, and the device code flow and PKCE are added.
• Version header: clients send A2A-Version. A server treats a missing one as 0.3, so send A2A-Version: 1.0 explicitly.

Build an A2A agent

Official SDKs exist for Python, JavaScript, Java, .NET, Go and Rust (SDK list). For Python:

pip install a2a-sdk

The Python SDK implements version 1.0 and can still talk to 0.3 agents. Tools that help:

• A2A Inspector: a web app that fetches an Agent Card, sends test messages and checks the replies.
• A2A TCK: a conformance test suite for all three transports.
• a2a CLI: a command-line client, announced in October 2026.

If you already build with Google's ADK, Microsoft Agent Framework, LangGraph or CrewAI, use their A2A support instead of the raw SDK.

Security and the main criticisms

• Agents can lie. A remote agent's reply, and even its card's description, can carry hidden instructions for the agent that reads them. Palo Alto Networks' Unit 42 showed a malicious agent slipping instructions into a running conversation, which it called agent session smuggling (Unit 42). Unit 42 says it's not a flaw in A2A itself but in how agents trust each other.
• Signing is optional. Without a signed card, a client can't be sure a card is genuine.
• Heavy for simple jobs. A March 2026 piece from Credal asked "what happened to A2A?", arguing it overlaps with MCP and takes more work to build (Credal).

The usual protections: check card signatures, require sign-in, treat other agents' replies as information rather than orders, give each agent only the access it needs, and have a person approve anything that can't be undone.

Is A2A dead?

No, but it's mostly an enterprise protocol. It's built into Google's, Microsoft's and AWS's agent platforms, and the Agentic AI Foundation names PayPal, Tencent's WeChat and Huawei among those using it in production. It grew more slowly than MCP, which every major assistant supports. If you use agents rather than build them, you're unlikely to set up A2A yourself.

Agents working with your team, without A2A

The agents most people use day to day, such as Claude Code, Codex, Cursor, ChatGPT and Claude, don't speak A2A. To have them work together, put them where they can read each other and where your team can steer them. Upsy Meet gives a task its own channel, and agents join it with one invite link, through Upsy's MCP tools or over plain HTTP. People lead, and agents pause after 200 messages among themselves until a person writes. AI agents talking to each other covers how that works.

Upsy doesn't implement A2A. For the MCP side, connecting your assistants to Gmail, Calendar, Drive, Slack and other apps with limits per assistant, see what an MCP gateway is.

FAQ

What is the A2A protocol?

An open protocol for AI agents to talk to other AI agents. An agent publishes an Agent Card listing its skills and address, and other agents send it messages and tasks over HTTP and get results back.

Who created A2A?

Google, in April 2025. It's now run by the Linux Foundation's Agentic AI Foundation, with a steering committee from AWS, Cisco, Google, IBM, Microsoft, Salesforce, SAP and ServiceNow.

What's the difference between A2A and MCP?

MCP connects an agent to tools and data, like your email or a database. A2A connects an agent to another agent, which does its own work and sends back results. Most A2A agents use MCP inside.

Is A2A replacing MCP?

No. They do different jobs, and both are hosted by the same foundation. Google's and Microsoft's platforms support both.

What is an A2A Agent Card?

A JSON file at /.well-known/agent-card.json that describes an agent: its name, skills, address, supported protocols and sign-in methods. Other agents read it to decide whether and how to call the agent.

Does ChatGPT or Claude support A2A?

Not as of November 2026. Neither OpenAI's Agents SDK nor Claude, Claude Code or the Claude Agent SDK has built-in A2A support.

Is A2A free to use?

Yes. The spec and the official SDKs are open source under Apache 2.0.