Agent2Agent protocol (A2A)

Google announced A2A on 9 April 2025 with a large group of launch partners and donated it to the Linux Foundation on 23 June 2025, where it is governed as a vendor-neutral project with an Apache 2.0 reference implementation and SDKs in several languages. Version 1.0, published in March 2026 and described by the project as its first stable release, defines the data model normatively in Protocol Buffers and maps it onto three bindings: JSON-RPC 2.0 over HTTP, gRPC, and an HTTP+JSON/REST style. Streaming over HTTP uses Server-Sent Events, and long-running work can instead report back through push-notification webhooks that the client registers per task.

Discovery starts with the Agent Card, a JSON document conventionally served at /.well-known/agent-card.json following the RFC 8615 well-known-URI pattern. It declares the agent's identity and provider, its service interfaces, capability flags such as streaming or push notifications, a list of skills with descriptions and example inputs, and the security schemes a caller must satisfy (API key, HTTP bearer, OAuth 2.0 flows, OpenID Connect or mutual TLS). A richer card can be restricted to authenticated callers via GetExtendedAgentCard, and v1.0 added cryptographically signed cards over a canonicalised JSON form so that a client can verify who published a card rather than trusting whoever serves it.

Work is modelled as a Task with a server-assigned ID and a state machine: submitted, working, input-required, auth-required, and the terminal states completed, failed, canceled and rejected. The interrupted states are what make A2A suitable for multi-turn delegation, since the remote agent can pause and ask for clarification or credentials. Messages carry a role and a list of Parts, each holding exactly one of text, raw bytes, a URL or structured JSON data; outputs are returned as Artifacts, which can be streamed in chunks. Core operations include SendMessage, SendStreamingMessage, GetTask, ListTasks, CancelTask and SubscribeToTask.

The design principle is opacity: agents exchange tasks and results, never their prompts, tools, memory or chain of thought. That separates A2A from the Model Context Protocol, where a client sees each tool's schema and invokes it much like a function call; many systems use MCP inside an agent and A2A between agents. Opacity has a security cost. A remote agent's card text, status messages and artifacts are untrusted input that can carry prompt injection, and authenticating the transport says nothing about whether the delegated action should be permitted, so authorisation, rate limits and audit logging of cross-agent requests remain the integrator's responsibility.