Agent Interoperability: A2A Alongside MCP
Why It Matters
Section titled “Why It Matters”Local tool use and remote agent collaboration are different boundaries. A remote agent should be treated as an external service with a declared capability, its own identity and authority, explicit task state and an observable contract—not as a function call that happens to return text.
A2A models the interaction around four core objects:
- Agent Card: a machine-readable description of the remote agent’s identity, endpoint, skills, supported interfaces and authentication requirements. It enables capability discovery before delegation.
- Task: the stateful unit of work with a lifecycle, identifier and optional context. It gives a handoff a durable place for status, cancellation and recovery.
- Message: a turn of communication used to start a task, request clarification or provide further input. It is not the reliable container for task outputs.
- Artifact: an output of the task, such as text, structured data or a file, composed of typed parts. Artifacts should carry provenance and validation metadata in the surrounding system.
MCP and A2A Together
Section titled “MCP and A2A Together”An orchestrating agent can use MCP to read local context or call a controlled tool, then use A2A to delegate a task to a specialist agent. The specialist may use its own MCP servers internally. The boundary should make clear which agent is responsible for each action, which principal authorised it, which tools were available and which artifacts came back.
For an end-to-end trace, propagate a trace and span context across the A2A request, task updates, MCP calls and artifact delivery. Record agent-card version, task and context IDs, message IDs, skill, authority, policy decisions, retries, latency, status transitions and artifact hashes. Redact secrets and sensitive payloads while retaining enough structured evidence to reconstruct who asked for what, where it ran and why the result was accepted.
Streaming and push notifications are useful for long-running or event-driven work, but they add delivery and security concerns. Authenticate webhook requests, validate the expected task ID and source, make notification handling idempotent, protect against replay and SSRF, and reconcile missed events by reading task state. Do not confuse a live stream with durable delivery.