Site icon Digital Thought Disruption

How to Combine MCP and A2A in One Enterprise Agent Architecture

Paul Bryant

TL;DR

MCP and A2A solve different integration problems. MCP standardizes how an agent discovers and invokes tools, APIs, resources, and data services. A2A standardizes how independent agents discover one another, exchange messages, delegate work, manage long-running tasks, and return artifacts.

A durable enterprise design does not choose one protocol and force it to do both jobs. It uses A2A across agent boundaries and MCP inside each agent’s execution boundary. Identity, discovery, gateways, policy enforcement, approval controls, and observability surround both. The result is a layered architecture where agents can collaborate without exposing their internal tools, and tools remain governed without being misrepresented as autonomous agents.

Introduction

Enterprise agent platforms are moving beyond a single model calling a few APIs. A production workflow may involve a coordinator agent, several domain agents, dozens of tools, multiple identity systems, long-running tasks, human approvals, and data that crosses organizational boundaries.

That creates two different interoperability problems.

The first is agent-to-tool connectivity. An agent needs a consistent way to discover a capability, understand its input schema, call it, and validate the result. MCP fits this problem.

The second is agent-to-agent collaboration. One agent needs to determine whether another agent can perform a task, delegate work, exchange context, monitor progress, handle clarification requests, and receive one or more artifacts. A2A fits this problem.

The protocols are complementary, but combining them is not simply a matter of enabling both SDKs. The architecture must define where each protocol starts and stops, how identity is propagated without passing tokens blindly, how agents and tools are discovered, where policies are enforced, and how one transaction is traced across both protocols.

This article presents an enterprise reference pattern for doing that deliberately.

The Boundary That Keeps the Architecture Understandable

The most important design decision is not which protocol to deploy first. It is how the organization distinguishes an agent from a tool.

A tool exposes a bounded capability. It normally has a defined input, a defined output, and a relatively narrow responsibility. A database query, ticket creation operation, document search, configuration check, or deployment action can be modeled as a tool even when the implementation behind it is complex.

An agent accepts a goal rather than only a function call. It may reason, plan, ask for clarification, select tools, maintain task state, produce multiple artifacts, or decide that it cannot safely complete the request. That autonomy and task lifecycle are what make A2A appropriate.

Decision questionUse MCPUse A2A
Is the target a bounded operation with a defined schema?YesUsually no
Can the caller treat the target as a capability rather than a collaborator?YesNo
Does the interaction require task state, clarification, or asynchronous updates?Usually noYes
Does the target choose its own internal tools or plan?Not requiredCommon
Should the target expose its internal memory or tool inventory?Not applicableNo
Is the interaction primarily delegation between independent systems?NoYes

The boundary is simple to state:

Use MCP to invoke capabilities. Use A2A to delegate outcomes.

That rule prevents two common design failures. The first is wrapping every API in an agent, which adds latency, non-determinism, and operational overhead without adding useful autonomy. The second is exposing a remote autonomous agent as if it were a synchronous tool, which hides task state, clarification, authorization pauses, cancellation, and failure semantics.

The Enterprise Reference Architecture

The architecture below separates the user-facing orchestration layer, the A2A collaboration plane, the internal MCP tool plane, and the enterprise control services that govern both.

What matters in this model is that the coordinator does not need direct access to every downstream tool. It delegates a task to the agent that owns the domain, policy context, operational knowledge, and tool set. The receiving agent uses MCP locally or through a controlled MCP gateway to perform the work.

This reduces the blast radius of the coordinator. It also lets domain teams change internal tools without changing every upstream agent, provided the A2A skill contract remains stable.

The Architecture Layers and Their Responsibilities

Experience and Entry Layer

The experience layer accepts requests from users, applications, event systems, or APIs. It authenticates the initiating principal, establishes the request context, applies intake controls, and selects the initial coordinator or domain agent.

This layer should not be allowed to invent downstream permissions. It carries the user and workload context into the agent system, but the authorization service decides what that context permits.

Typical responsibilities include request validation, rate limiting, tenant resolution, data-classification checks, abuse controls, session establishment, and creation of the root correlation identifier used throughout the workflow.

Coordinator Agent Layer

The coordinator determines whether it can answer directly, call one of its own MCP tools, or delegate to another agent through A2A. Its job is orchestration, not universal access.

A well-designed coordinator has a constrained set of responsibilities:

The coordinator should not receive broad credentials for every tool used by every downstream agent. That model turns orchestration into a privileged monolith.

A2A Collaboration Plane

The A2A plane carries task-oriented communication between independent agents. It is where the coordinator discovers an agent’s declared skills, confirms supported interaction modes, sends a task, receives progress updates, handles multi-turn clarification, and retrieves final artifacts.

The A2A Agent Card is the discovery contract. In an enterprise environment, it should be treated as a signed and governed service manifest, not as an automatically trusted advertisement. Public cards can expose a limited capability view, while authenticated extended cards can reveal additional approved skills to authorized clients.

A2A is also the correct place to preserve long-running task semantics. A downstream agent may return immediately, stream progress, expose a task for polling, or send asynchronous notifications. The caller should not have to pretend that every delegated outcome is a single synchronous function response.

Agent Runtime Boundary

Each domain agent owns its internal reasoning loop, state model, prompts, memory policy, tool selection, and exception handling. A2A does not require that internal implementation to be exposed to the caller.

This boundary is valuable for both security and organizational ownership. A finance agent can be operated by the finance platform team, a security agent by the security automation team, and an infrastructure agent by the platform engineering team. Each can maintain its own MCP servers, tool policies, evaluation suite, release cadence, and support model.

The A2A contract remains focused on what the agent can do, not how it does it.

MCP Tool Plane

The MCP plane provides structured tool and resource access inside an agent’s execution domain. MCP servers expose tools with names, descriptions, input schemas, and optional output schemas. Clients can list available tools and invoke the selected operation.

In production, the MCP plane should be curated. An agent should not be allowed to connect to any server it can find. Approved MCP servers belong in a registry with ownership, trust level, allowed environments, data classification, required scopes, network policy, version, and review status.

The MCP gateway or broker can then apply controls such as:

MCP standardizes the interaction, but the enterprise still owns the policy.

Shared Enterprise Control Layers

Identity, authorization, policy, discovery, secrets, approvals, and observability should be shared services with protocol-specific adapters. They should not be duplicated independently inside every agent and MCP server.

Shared does not mean one physical component. It means one control model, consistent policy vocabulary, common evidence, and clearly defined ownership.

Identity Must Survive Both Protocol Boundaries

The hardest part of combining MCP and A2A is not message formatting. It is preserving trustworthy identity and authorization context across a chain of independent actors.

At minimum, the system may contain four identities:

These identities are related, but they are not interchangeable.

Separate User Context from Workload Identity

The user identity answers who initiated the request. The workload identity answers which software component is making the current call. Both matter.

A delegated request should be able to say, in effect, that the infrastructure agent is acting because the coordinator delegated a task initiated by a specific user, under a specific tenant and policy context. It should not claim that the infrastructure agent is the user, and it should not erase the coordinator from the chain.

This distinction improves policy decisions and incident investigation. It also prevents every downstream system from receiving the user’s original bearer token.

Issue Audience-Bound Tokens Per Hop

Each protected service should receive a token intended for that service. A token issued for the A2A server should not be forwarded to an MCP server, and a token accepted by an MCP server should not be passed through unchanged to an underlying API.

The safer pattern is token exchange or fresh token acquisition at each boundary:

Every hop should have a narrower audience, shorter useful lifetime, and only the scopes required for that step. The delegation record should preserve who initiated the request, which agent delegated it, what purpose was approved, and how far delegation may continue.

Keep Authorization Decisions Local to the Resource

Central policy services are useful, but the resource still needs to enforce the result. The A2A server must authorize access to its skills and tasks. The MCP server must authorize tool discovery and invocation. The downstream API must authorize the action on the target resource.

A gateway can deny a request early, but it should not be the only enforcement point. Otherwise, direct network paths, configuration errors, or gateway bypasses become authorization bypasses.

Treat Human Approval as a First-Class State

Some requests cannot be authorized entirely by static scopes. Production changes, financial commitments, data exports, account modifications, and destructive infrastructure operations may require a human decision.

A2A supports task interruption and continuation patterns that fit this need. The domain agent can pause the task when authorization is required, return the reason and requested action, and resume only after the client supplies approved authorization. The underlying MCP tool call should not occur until the approval evidence is validated.

Discovery Needs Two Catalogs, Not One Unfiltered Marketplace

MCP and A2A both involve discovery, but they discover different things.

A2A discovery locates agents and their skills. MCP discovery locates servers, tools, prompts, and resources available to an agent. Combining these into one flat directory makes policy and ownership harder to understand.

The Agent Catalog

The agent catalog should store or index approved Agent Cards and enterprise metadata such as:

The well-known Agent Card endpoint is useful for protocol discovery, but enterprise callers should normally resolve agents through a trusted catalog or gateway. The catalog can validate signatures, apply allowlists, detect unauthorized card changes, and prevent direct trust in arbitrary endpoints.

The MCP Server and Tool Catalog

The MCP catalog should focus on executable capabilities:

The tool catalog should be scoped to the receiving agent. A finance agent does not need to see every infrastructure remediation tool, and a customer service agent should not discover privileged security operations merely because they exist.

Discovery Is a Policy Decision

Dynamic discovery is operationally useful, but discovery should never equal authorization. Finding an Agent Card does not grant permission to invoke the agent. Listing an MCP tool does not grant permission to call it.

The catalog answers what exists and what it claims to support. The policy system answers whether the current identity, task, tenant, environment, and purpose may use it.

Gateways Should Enforce Boundaries, Not Rewrite Semantics

An enterprise deployment will often place gateways in front of both A2A endpoints and MCP servers. The gateway provides a stable control point for identity integration, routing, rate limits, network policy, threat detection, schema validation, and telemetry.

The mistake is building one generic gateway that treats A2A messages and MCP tool calls as interchangeable JSON traffic.

A protocol-aware design has separate policy paths.

A2A Gateway Responsibilities

MCP Gateway Responsibilities

The same gateway platform may implement both paths, but the policy objects, telemetry fields, and failure handling should remain protocol-aware.

A Realistic End-to-End Request Flow

Consider an operations assistant asked to investigate a production service degradation and prepare a remediation plan.

The coordinator agent can understand the request, but it should not hold direct access to every monitoring system, deployment platform, incident tool, and infrastructure API. It delegates the investigation to an operations domain agent.

The A2A task owns the investigation lifecycle. The MCP calls are implementation details inside the operations agent’s boundary. The final remediation action is a separate governed step, not an automatic consequence of diagnosis.

This distinction improves rollback, auditability, and change control. It also lets the operations agent replace one monitoring platform with another without changing the coordinator’s A2A contract.

Data, Context, and State Should Be Minimized at Every Hop

Multi-agent systems can easily copy the same prompt, conversation history, retrieved documents, and tool outputs across multiple services. That creates privacy, cost, retention, and prompt-injection risks.

The coordinator should send the receiving agent only the context required to complete the delegated task. The receiving agent should return structured artifacts and evidence rather than its full internal reasoning state or complete tool transcript.

A useful separation is:

Do not make full prompt and response capture the default observability strategy. Sensitive content should be opt-in, redacted, access-controlled, and retained for a defined purpose.

Observability Must Connect A2A Tasks to MCP Tool Calls

A2A and MCP produce different operational signals. The observability model must connect them without flattening them.

The root trace should begin at the user or application request. A2A spans should represent agent selection, delegation, task state changes, streaming, retries, and artifact transfer. MCP spans should represent server discovery, tool listing when relevant, tool invocation, latency, error status, result size, and downstream dependency calls.

At minimum, capture:

SignalA2A fieldsMCP fieldsShared fields
Identitycaller agent, target agent, user contextMCP client, MCP server, tool callertenant, workload identity, delegation chain
Operationsend message, get task, subscribe, cancellist tools, call tool, read resourceoperation outcome, retry count
Statetask ID, context ID, task staterequest ID, tool result statusroot trace ID, parent span ID
Performancequeue time, task duration, stream gapstool latency, downstream latencyend-to-end latency, timeout budget
Costagent model usage, task retriesmodel or tool cost where applicabletotal request cost
Governanceselected skill, artifact classificationselected tool, side-effect classpolicy decision, approval ID

A useful trace hierarchy looks like this:

The trace should answer operational questions quickly: Which agent accepted the task? Which MCP tools were used? Which policy allowed the calls? Where did latency accumulate? Was a retry or delegation loop involved? Which artifact supported the final recommendation? Which human approved the action?

An Illustrative Policy Configuration

The following YAML is not a protocol standard. It is an example of the policy metadata an enterprise control plane could use to govern an A2A-to-MCP workflow.

agent_policy:
  coordinator: operations-coordinator
  allowed_delegations:
    - target_agent: operations-domain-agent
      allowed_skills:
        - investigate-service-degradation
        - prepare-remediation-plan
      max_delegation_depth: 2
      max_task_duration_minutes: 30
      require_signed_agent_card: true

identity:
  preserve_user_context: true
  require_workload_identity: true
  token_strategy: audience_bound_per_hop
  prohibit_token_passthrough: true

mcp_policy:
  agent: operations-domain-agent
  allowed_servers:
    - observability-mcp
    - deployment-readonly-mcp
    - incident-management-mcp
    - remediation-mcp
  tools:
    remediation-mcp:
      execute_change:
        side_effect: destructive
        require_human_approval: true
        allowed_environments:
          - production
        max_invocations_per_task: 1

observability:
  propagate_trace_context: true
  capture_prompt_content: false
  capture_tool_arguments: redacted
  retain_policy_evidence_days: 90
  retain_task_metadata_days: 30

The values that matter are not the YAML keys themselves. The important design choices are visible: delegation is constrained, Agent Cards must be trusted, tokens are issued per audience, token passthrough is prohibited, the domain agent receives only approved MCP servers, and a destructive tool requires human approval.

Deployment Patterns for Different Enterprise Boundaries

Centralized Agent Platform

A centralized platform team operates the entry gateway, agent registry, MCP registry, policy service, and observability pipeline. Domain teams publish agents and MCP servers into the shared platform.

Best fit: Organizations early in adoption that need strong standardization and a small number of platform-approved runtimes.

Advantages: Consistent controls, easier support, shared tooling, simpler onboarding, and centralized evidence.

Tradeoffs: The platform team can become a bottleneck, and domain-specific policies may be forced into a generic model.

Federated Domain Architecture

Each business or technical domain operates its own agent runtime and MCP tool plane. A shared A2A catalog, identity federation, policy vocabulary, and telemetry standard connect the domains.

Best fit: Large organizations with established domain ownership and different data, regulatory, or release requirements.

Advantages: Local autonomy, smaller blast radii, domain-specific tooling, and independent release cycles.

Tradeoffs: Stronger conformance testing, identity federation, catalog governance, and cross-domain incident processes are required.

Partner and External Agent Boundary

Internal agents communicate with supplier, customer, or partner agents through an external A2A gateway. Internal tools remain hidden behind internal MCP boundaries.

Best fit: Supply-chain coordination, managed services, partner workflows, and cross-company task delegation.

Advantages: Partner agents can collaborate without receiving direct access to internal tools or implementation details.

Tradeoffs: Trust establishment, data minimization, residency, contract versioning, artifact validation, and external incident handling become critical.

The external A2A gateway should terminate partner trust, validate Agent Cards, constrain skills, inspect artifacts, and prevent external identities from reaching internal MCP endpoints directly.

Failure Modes That Look Convenient During a Pilot

Modeling Every Agent as an MCP Tool

This works for a short demo because the caller sees one callable interface. It fails when the remote system needs clarification, long-running state, streaming progress, cancellation, authorization pauses, or multiple artifacts.

Use an MCP tool wrapper only when the capability is intentionally narrow and tool-like. Do not use it to hide a complex independent agent lifecycle.

Modeling Every Tool as an A2A Agent

An API call does not become more enterprise-ready because it is wrapped in an autonomous agent. The extra model call may increase latency, cost, and non-determinism while obscuring a perfectly good schema.

Keep deterministic capabilities as MCP tools unless autonomous planning or collaboration is genuinely required.

Passing the Original Token Through the Entire Chain

Token passthrough collapses trust boundaries and makes audience, attribution, revocation, and least privilege harder to enforce. Each hop should obtain a token intended for the next resource.

Trusting Discovery Metadata Automatically

A discovered Agent Card or MCP server description is a claim, not proof. Validate signatures where supported, resolve through trusted catalogs, enforce network policy, and require ownership and review metadata.

Letting the Coordinator Accumulate Every Permission

A coordinator with access to every tool becomes a high-value target and an operational bottleneck. Delegate to domain agents that hold narrowly scoped access to their own MCP plane.

Losing Trace Context at the Protocol Boundary

Without shared correlation identifiers, operations teams see an A2A task in one system, several MCP calls in another, and downstream API events somewhere else. Preserve trace context and delegation identifiers across all hops.

Logging Everything for Debugging

Full prompts, task histories, tool arguments, and artifacts can contain secrets, regulated data, customer content, or exploitable instructions. Capture metadata by default and sensitive content only under explicit policy.

Allowing Unbounded Delegation

Agents that can freely delegate can create loops, excessive fan-out, cost spikes, and unclear accountability. Enforce maximum depth, maximum parallel tasks, time budgets, cost budgets, and approved target agents.

A Phased Implementation Path

Establish the Protocol Boundary

Inventory current agents, APIs, tools, workflows, and integration points. Classify each target as a tool-like capability or an independent agent. Document exceptions where the choice is ambiguous.

Define the decision rule before teams begin publishing endpoints. Otherwise, each product team will make a different interpretation and the architecture will drift.

Build the Governed MCP Tool Plane

Start with a small number of high-value MCP servers behind clear ownership and policy. Require schemas, scoped identities, approval classification, output validation, logging, and lifecycle metadata.

Do not begin with unrestricted dynamic server discovery. Begin with an allowlisted registry and a small number of trusted agents.

Add A2A for Cross-Agent Delegation

Expose one or two domain agents through A2A. Publish governed Agent Cards, define stable skills, validate task lifecycle behavior, and test clarification, cancellation, timeout, failure, and authorization-required states.

The first A2A pilot should demonstrate a real delegation boundary, not two copies of the same agent calling one another.

Integrate Identity and Policy Per Hop

Introduce workload identities for every agent and server. Issue audience-bound tokens per resource. Preserve user context separately from workload identity. Add delegation-depth limits, tenant restrictions, data-classification rules, and approval evidence.

Test denied paths as seriously as successful paths.

Add End-to-End Observability and Evaluation

Propagate trace context across the entry gateway, A2A calls, agent runtimes, MCP calls, and downstream APIs. Create dashboards for latency, failure, task state, tool usage, cost, policy denials, and approval delays.

Evaluate the complete workflow, not only each model. A successful domain agent is not enough if the coordinator selects it incorrectly, context is lost, or the MCP tool produces an unsafe side effect.

Scale by Domain, Not by Tool Count

Expand one governed domain at a time. Add the domain agent, its A2A skills, its MCP server set, its policy owners, its evaluation suite, its support runbook, and its observability views as one operational unit.

This produces a manageable enterprise agent fabric instead of a large collection of disconnected protocol endpoints.

Ownership and Operating Model

CapabilityPrimary ownerOperational responsibility
A2A protocol profileEnterprise architecture or agent platform teamVersions, bindings, card standards, interoperability testing
Agent catalogAgent platform team with domain ownersRegistration, signature validation, lifecycle, ownership metadata
MCP registry and gatewayPlatform engineering or integration teamServer approval, tool policy, routing, egress, compatibility
Identity and token serviceIdentity and security teamsWorkload identity, token issuance, audience, revocation, federation
Policy decision serviceSecurity governance with domain policy ownersDelegation, skills, tools, data, environment, approvals
Agent runtimeDomain product teamPrompts, models, state, tool selection, evaluation, support
MCP serversOwning application or platform teamTool schemas, downstream integration, validation, least privilege
ObservabilityPlatform operations and SRETrace continuity, dashboards, alerts, retention, incident evidence
Human approvalsBusiness and operational control ownersApproval criteria, segregation of duties, evidence, escalation

Ownership should follow the trust boundary. The team that owns the domain agent should own its behavior and MCP tool set. The central platform should own interoperability and shared controls, not every domain decision.

Decision Checklist

Before approving a combined MCP and A2A design, confirm that the architecture can answer these questions:

A design that cannot answer these questions is not ready for broad dynamic discovery or autonomous execution.

Conclusion

MCP and A2A fit together because they preserve two different abstractions. MCP lets an agent use a capability through a structured tool or resource interface. A2A lets an independent agent delegate a goal to another agent that owns its own reasoning, state, tools, and operational boundary.

The enterprise architecture should reflect that separation. A2A belongs between agents. MCP belongs between an agent and the tools inside its execution domain. Identity, discovery, gateways, policy, approvals, and observability must cross both layers without erasing their different semantics.

The practical starting point is not a large agent marketplace. It is one governed workflow with a clear coordinator, one domain agent, a small approved MCP tool plane, audience-bound identity at each hop, and a trace that proves what happened. Once that pattern is secure, observable, and operable, it can be repeated by domain.

The goal is not to connect everything to everything. The goal is to create controlled delegation between agents while keeping tool access narrow, explainable, and owned.

External References

Exit mobile version