Agent2Agent Protocol

The Agent2Agent (A2A) protocol is an open standard that lets AI agents built by different vendors on different frameworks, such as LangChain or Google's Agent Development Kit, discover each other, delegate tasks, and return results. Each agent stays opaque: it advertises what it can do and accepts work through a shared interface, but never exposes its prompts, memory, tools, or model. Google announced A2A on April 9, 2025, with more than 50 technology partners and later donated it to the Linux Foundation, where IBM's Agent Communication Protocol merged into it in August 2025. Version 1.0, the first stable specification, shipped in March 2026, and in August 2026 A2A, by then backed by more than 150 organizations, joined the Agentic AI Foundation, which also hosts the Model Context Protocol.

How A2A Works#

The A2A specification defines two roles: a client agent that needs work done and a remote agent that performs it. A remote agent publishes an Agent Card, a JSON document usually served at /.well-known/agent-card.json, that lists its name, endpoints, authentication requirements, input and output formats, and skills. A client reads the card, decides whether the agent fits the job, and sends a message.

• Messages: Turns of communication with a role and one or more parts, each part holding text, a file, or structured data.
• Tasks: Stateful units of work with an ID and a status. A task moves through states such as submitted, working, input required, auth required, completed, failed, canceled, and rejected, so a remote agent can pause to ask the client a question in the middle of a job.
• Artifacts: The outputs a task produces, such as a report, an image, or a JSON record, returned separately from conversational messages.
• Streaming and push notifications: Long-running tasks send incremental updates over a stream or notify the client through a webhook when they finish, which suits jobs that take hours.

Version 1.0 defines three protocol bindings, JSON-RPC 2.0, gRPC, and HTTP+JSON, with methods such as SendMessage, GetTask, and CancelTask. It also adds version negotiation and multi-tenancy, and keeps the signed Agent Cards introduced in version 0.3, which let a client verify who published a card.

An Agent Card#

This card advertises a retail vision agent over the JSON-RPC binding. The required fields are the name, description, version, interfaces, capabilities, default input and output modes, and skills, and each skill needs an ID, name, description, and tags:

{
  "name": "Shelf Vision Agent",
  "description": "Finds empty facings and counts products in retail shelf photos.",
  "version": "1.0.0",
  "supportedInterfaces": [
    { "url": "https://vision.example.com/a2a/v1", "protocolBinding": "JSONRPC", "protocolVersion": "1.0" }
  ],
  "capabilities": { "streaming": true, "pushNotifications": false },
  "defaultInputModes": ["image/jpeg", "text/plain"],
  "defaultOutputModes": ["application/json", "image/jpeg"],
  "skills": [
    {
      "id": "shelf-audit",
      "name": "Shelf audit",
      "description": "Counts each product and lists empty facings with their shelf positions.",
      "tags": ["retail", "object-detection"],
      "examples": ["Which facings in this aisle photo are empty?"]
    }
  ]
}

A store-operations agent that reads this card knows it can send JPEG images or text and get JSON or annotated images back, and the examples field shows the kind of request the skill expects.

A2A vs. Related Protocols and Concepts#

• Model Context Protocol (MCP): Connects one agent to the tools and data it uses directly. A2A connects agents to other agents that plan and act on their own, and the two are designed to work together, with a remote A2A agent often using MCP tools internally.
• Function calling and tool use: A function call runs one operation with fixed arguments. An A2A request hands over a goal, and the remote agent decides the steps.
• AI agent orchestration: Decides which agent handles which subtask and merges their results. A2A is a transport an orchestrator can use to reach agents it does not host.
• Agent skills: Instruction folders an agent loads to learn a procedure. A2A skills in an Agent Card are advertisements of what a remote agent offers, with no instructions attached.

Applications and Security#

A2A suits agentic workflows that cross team or company boundaries: a travel agent booking through airline and hotel agents, a procurement agent negotiating with supplier agents, or a retail operations agent that sends shelf photos to a computer vision agent and passes empty-facing reports to an inventory management agent. The vision agent behind such a card can delegate perception to an Ultralytics Platform dedicated endpoint, which serves a trained YOLO26 model at a /predict URL authenticated with an API key, and return the JSON object detection results to the client as an artifact. The Universal Commerce Protocol for agentic commerce has A2A support built in.

Every hop between agents is a trust boundary. Clients authenticate remote agents through the security schemes their cards declare, such as OAuth 2.0 or OpenID Connect, verify signed cards, and treat returned messages and artifacts as untrusted input that can carry a prompt injection. The OWASP Top 10 for Agentic Applications lists insecure inter-agent communication and cascading failures among its ten risks, and production deployments add timeouts, task cancellation, per-skill authorization, and observability traces that follow a request across every agent it touches.