A2A vs MCP in Depth: Architecture, Security and When to Use Each

MCP connects an AI agent to tools and data. A2A connects an AI agent to other agents. That is the one-line answer, and the A2A project itself says so: "MCP is vertical. It deepens a single agent," while "A2A is horizontal. It connects agents across that boundary."

This guide goes past that summary. It compares how the two protocols discover each other, structure work, handle long jobs and secure calls, and where each stands in November 2026. If you want a three-way primer that includes function calling, start with MCP vs A2A vs function calling.

Side-by-side comparison

Different jobs, different shapes

MCP: one agent, many tools

The MCP specification defines hosts (AI apps), clients and servers. Servers offer "Resources," "Prompts" and "Tools," which are "Functions for the AI model to execute." The client may offer "Elicitation," a way for a server to ask the user for more information.

The agent sees each tool's name, description and input schema, and decides when to call it. The server does exactly what the tool says. It does not reason or plan on its own.

A2A: one agent asking another to do a job

The A2A key concepts page defines a client agent that "acts on behalf of the user" and a remote agent that "exposes an HTTP endpoint implementing the A2A protocol." The client does not see the remote agent's tools, memory or prompts. It sends messages and gets back status updates and artifacts.

This is the key design difference. In MCP, your agent drives each step. In A2A, the other agent decides how to do the job, and may itself use MCP tools behind the scenes.

Discovery

MCP: a client connects to a server's URL and lists its tools. For finding servers, there is the official MCP Registry, and the MCP project has finalized a Server Cards extension (SEP-2127) for describing servers. Our MCP Registry explainer covers listing.

A2A: each agent publishes an Agent Card, "a digital business card," listing identity, endpoint, capabilities, sign-in needs and skills. The agent discovery page gives three ways to find cards: a well-known URI, curated registries and direct configuration. A2A v1.0 adds signed cards, verified "using JWS and JSON Canonicalization," per the v1.0 notes.

Work units and long-running jobs

An MCP tool call is usually short: the agent asks, the server answers. The MCP spec lists an optional Tasks extension for "Asynchronous execution of long-running operations, with polling, mid-flight input, and durable handles."

A2A was built around long jobs from the start. A task is "A stateful unit of work initiated by an agent, with a unique ID and defined lifecycle." v1.0 task states include submitted, working, input required, auth required, completed, failed, canceled and rejected. Results come back as artifacts, which can stream in pieces.

A2A offers three delivery modes: polling, streaming over Server-Sent Events and push notifications to a client webhook.

Security models

MCP

MCP's spec sets principles: users "must explicitly consent to and understand all data access and operations," hosts "must obtain explicit user consent before invoking any tool," and tool annotations "should be considered untrusted, unless obtained from a trusted server." Remote servers typically use OAuth. Your server's scopes decide what the agent can touch.

A2A

A2A agents declare their authentication requirements in the Agent Card. The v1.0 notes add "Enhanced security scheme declarations with mutual TLS support," a flag that "Indicates whether PKCE (Proof Key for Code Exchange) is mandatory," and signed Agent Cards. Authenticated extended cards let an agent show more detail only to signed-in callers.

The trust question is different. With MCP, you trust a tool to do one defined thing. With A2A, you trust another agent's judgment, so contracts, logs and limits on what you send matter more.

Governance and status

Anthropic donated MCP to the Agentic AI Foundation on 9 December 2025. The foundation is "a directed fund under the Linux Foundation," co-founded by Anthropic, Block and OpenAI.

The AAIF announcement of 17 August 2026 says Google launched A2A in April 2025, donated it to the Linux Foundation, and that it now joins AAIF "as a hosted project." It says "A2A v1.0, the first stable specification, shipped in March 2026." The A2A releases page shows v1.0.0 on 12 March 2026 and v1.0.1 on 28 May 2026.

So in November 2026, both are stable, open and under the same umbrella. That makes "pick one" less likely and "use both" more likely.

How they work together

The A2A project's A2A and MCP page uses an auto repair shop example. Customers talk to a shop manager agent over A2A. The manager hands jobs to a mechanic agent over A2A. The mechanic uses diagnostic tools over MCP. In the page's words, "A2A handles the higher-level, conversational, task-oriented interactions," while "MCP enables the mechanic agent to use its specific, structured tools."

The same page notes that "An A2A Server (a remote agent) can expose some skills as MCP-compatible resources." But it draws the line: "A2A is about agents partnering on tasks; MCP is more about agents using capabilities."

Commerce protocols show the layering too. The Universal Commerce Protocol lists REST, MCP, A2A and embedded checkout as transports, and AP2 is built as an A2A extension.

Which one do you need?

Practical advice

• Start with MCP if you have no agents yet. It is the more common first need.
• Add A2A when a task crosses a boundary you cannot or should not open up as raw tools.
• Log both. MCP tool calls and A2A task IDs should land in the same audit trail.
• Keep humans on "input required" and "auth required" states for anything that spends money.

Next step

eSEOspace's AI agent development service helps plan multi-agent setups, and our MCP development service builds the MCP servers those agents use. Every project is scoped and quoted separately. Explore the rest of the family on the agent protocols hub or in our AI agent protocols comparison.

Frequently asked questions