MCP vs A2A: which protocol does what?

Discovery runs through an Agent Card, a JSON document at /.well-known/agent-card.json that lists the agent’s supported interfaces and their protocol versions, its capabilities (streaming, push notifications, an extended card), its security schemes, its skills and its provider, with an optional signature. In 1.0 a card may be signed with JSON Web Signature over a canonicalised card, and clients should verify at least one signature before trusting it. Older clients still look for /.well-known/agent.json, and the Copilot Studio documentation still references that path.

Work moves as tasks. A message is one turn with a role; a task is the unit of work with an id and a lifecycle; artifacts are its outputs; a context id groups related tasks. The states are submitted, working, input required, auth required, and the terminal completed, failed, canceled and rejected. The two interrupted states are how a remote agent asks the caller, or a person, for more information or credentials mid-task. Long-running work streams status and artifact events until a terminal state, or the remote agent posts updates to a webhook.

The 1.0 operations are SendMessage, SendStreamingMessage, GetTask, ListTasks (new, with cursor pagination), CancelTask, SubscribeToTask, push-notification configuration and GetExtendedAgentCard; the 0.3 names were message/send, tasks/get and so on. Three bindings (JSON-RPC, gRPC and HTTP with JSON) share one model defined in a2a.proto, errors use google.rpc.Status, and clients send an A2A-Version header. Production must use TLS, credentials travel in headers on every request, OAuth implicit and password flows were removed in 1.0, and a tenant field lets one endpoint serve many tenants. Agents stay opaque: they collaborate on declared capabilities and never share memory, prompts or tools.

Unit 42 was explicit that the research revealed no vulnerability in the protocol itself; the problem is an agent that treats another agent’s output as instructions. Its mitigations are out-of-band human approval for sensitive actions, context grounding that ends a drifting session, signed Agent Cards and real-time visibility of agent activity. Four further risks follow from the spec. Signing is optional, so an unverified card could belong to an impostor. In-band credential exchange can pass credentials along a chain of agents, so use delegated, scoped tokens (Foundry’s on-behalf-of auth, AgentCore Identity) instead of sharing secrets. Versions are fragmented: 1.0 renamed every operation and state, while Foundry runs 1.0 with 0.3 in preview, the AWS tutorial pins the 0.3 SDK, and the Copilot Studio documentation shows 0.3-style payloads. Managed platforms have gaps, such as Foundry-to-Foundry A2A being text only, with no streaming and tasks kept for 60 days.

Accountability also moves. Copilot Studio’s documentation puts responsibility for data flows, quality, permissions, observability and human oversight on the maker who connects an outside agent, and the Linux Foundation named authentication and audit trails as the next frontier after 1.0. Adoption numbers need the same care: the foundation’s April 2026 release counted 150 or more supporting organisations and named industries without naming a production customer. A supporter count and a deployment count are different numbers.