diego bianqui

AI agent protocols: MCP, A2A, AG-UI, A2UI, AP2 and UCP

Agents talk to people, to other agents, to tools and to markets. Each of those layers now has its own open protocols. Here is the map.

By Diego Bianqui · Updated

Four layers of agent interaction

Until recently every agent framework invented its own way to connect to tools, to other agents and to user interfaces. Open protocols are replacing those one-off integrations. The easiest way to understand them is by who the agent is talking to.

Agent protocols by interaction layer
LayerLeading protocolsWhat they solve
Human ↔ AgentAG-UI, A2UIStreaming the agent's state to the user and generating dynamic interfaces.
Agent ↔ AgentA2A (ACP merged into it), ANPCooperation, task delegation and negotiation between different agents.
Agent ↔ ToolsMCPA universal, secure connection to data, files and third-party APIs.
Agent ↔ EconomyAP2, UCPAutonomous payments, spending limits and commercial transactions.

Agent ↔ Tools: Model Context Protocol (MCP)

MCP is the most widely adopted of these protocols. Introduced by Anthropic in November 2024, it defines how an AI application (the host, through an MCP client) connects to MCP servers that expose tools, resources and prompts. Write a server once — for a database, a file store or a SaaS API — and any MCP-compatible agent can use it. MCP is now hosted by the Agentic AI Foundation, a directed fund of the Linux Foundation.

MCP solves the integration problem, not the trust problem. Every MCP server you connect extends what your agent can do and who it trusts. Treat servers as supply-chain components: review them, pin versions, scope their credentials and watch what they return.

Agent ↔ Agent: A2A, ACP and ANP

Agent2Agent (A2A), launched by Google in April 2025 and now governed under the Linux Foundation, lets independent agents discover each other and collaborate. Each agent publishes an Agent Card describing what it can do; work is exchanged as tasks with a defined lifecycle, over JSON-RPC and HTTP. The agents don't need to share memory, tools or even a framework.

IBM's Agent Communication Protocol (ACP) took a REST-based approach to the same problem. In August 2025 ACP merged into A2A under the Linux Foundation, and its team now contributes to A2A — so for new work, A2A is the one to adopt. (Don't confuse it with the unrelated Agent Client Protocol for connecting coding agents to editors, which shares the acronym.)

The Agent Network Protocol (ANP) is an open-source effort aimed at agents meeting on the open internet rather than inside one organization. It builds on decentralized identifiers (DIDs) for agent identity and lets agents negotiate how they will communicate.

Human ↔ Agent: AG-UI and A2UI

AG-UI, the Agent–User Interaction Protocol, standardizes the stream of events between an agent back end and a user-facing application: messages as they are generated, tool calls in progress, state updates and requests for human input. It lets a front end show what an agent is doing in real time, and let the user step in.

A2UI (Agent-to-User Interface), an open-source project from Google, lets an agent describe an interface — a form, a card, a list of choices — as declarative JSON that the client renders from its own catalogue of trusted components. The agent never sends executable code. AG-UI and A2UI are complementary: one carries the conversation and state, the other describes rich UI inside it.

Agent ↔ Economy: AP2 and UCP

The Agent Payments Protocol (AP2), announced by Google in September 2025 with a large group of payments and technology partners, addresses a hard question: how does a merchant or a bank know an agent is allowed to pay? AP2 uses mandates — cryptographically signed records of what the user authorized, such as an intent with limits or a specific cart — so every agent-initiated payment carries verifiable proof of consent.

The Universal Commerce Protocol (UCP), introduced by Google in January 2026 and developed with major retailers and commerce platforms, covers the wider shopping journey: product discovery, checkout and post-purchase support. It is designed to work alongside A2A, AP2 and MCP rather than replace them.

Security: every protocol is a new trust boundary

  • Authenticate both ends. Know which agent, server or client you are talking to, and verify it cryptographically where the protocol allows.
  • Scope credentials per connection. An MCP server or a remote agent gets only what its task needs.
  • Treat everything received as untrusted data — tool results, agent messages and UI events alike.
  • Log every cross-boundary call. Interoperability without traceability is a liability.

These map directly to the OWASP Top 10 for Agentic Applications, notably insecure inter-agent communication (ASI07) and agentic supply-chain vulnerabilities (ASI04). Protocol choices belong in your harness design, not just your integration backlog.

Related guides

Sources

Working on agents in production? Get in touch.