Foundations — Issue 28

The Unplanned Stack

The Seam Between Tools and Agents

By Nora Kaplan— May 7, 2026

Feature image for article: The Seam Between Tools and Agents

MCP and A2A are becoming the communication layer for autonomous software. MCP assumes the thing on the other end is a toolbox. A2A assumes it's an opaque peer with its own reasoning and goals. They weren't designed as a stack. They're being adopted as one.

The interesting territory is where the categories leak. MCP servers can now reason. A2A agents can wrap single deterministic functions. The boundary between "tool" and "agent" is a protocol choice, and governance frameworks are already building on it. Authorization depends on it. And it keeps dissolving at exactly the point where identity needs to propagate across it.

The Unplanned Stack

The Seam Between Tools and Agents

By Nora Kaplan— May 7, 2026

MCP and A2A are becoming the communication layer for autonomous software. MCP assumes the thing on the other end is a toolbox. A2A assumes it's an opaque peer with its own reasoning and goals. They weren't designed as a stack. They're being adopted as one.

The interesting territory is where the categories leak. MCP servers can now reason. A2A agents can wrap single deterministic functions. The boundary between "tool" and "agent" is a protocol choice, and governance frameworks are already building on it. Authorization depends on it. And it keeps dissolving at exactly the point where identity needs to propagate across it.

Protocols in Practice

What Happens Between MCP and A2A

By Rina Takahashi— May 7, 2026

Feature image for article: What Happens Between MCP and A2A

MCP and A2A handle different halves of a multi-agent workflow. Most explanations cover each protocol separately and leave it at that. The seam between the two, where a developer's real architectural decisions live, gets skipped. That boundary belongs to neither protocol. It's application code you write yourself.

This walkthrough uses a retail inventory scenario to trace what happens at each stage: an agent queries stock levels through MCP's structured tool calls, determines restocking is needed, then coordinates with an external supplier through A2A's task lifecycle. The two sides work differently in ways that matter. One gives you schemas. The other gives you state transitions and a conversation you didn't fully plan for.

Protocols in Practice

What Happens Between MCP and A2A

By Rina Takahashi— May 7, 2026

MCP and A2A handle different halves of a multi-agent workflow. Most explanations cover each protocol separately and leave it at that. The seam between the two, where a developer's real architectural decisions live, gets skipped. That boundary belongs to neither protocol. It's application code you write yourself.

This walkthrough uses a retail inventory scenario to trace what happens at each stage: an agent queries stock levels through MCP's structured tool calls, determines restocking is needed, then coordinates with an external supplier through A2A's task lifecycle. The two sides work differently in ways that matter. One gives you schemas. The other gives you state transitions and a conversation you didn't fully plan for.

Further Reading

Why the Model Context Protocol WonA useful corrective: MCP's dominance owes more to adoption timing and ecosystem gravity than to protocol design elegance.

MCP's Biggest Growing Pains for Production Use Will Soon Be SolvedMaps the specific gaps between MCP's developer appeal and its production reality, particularly around auth and stateful sessions.

Quick links

MCP Is Now Enterprise Infrastructure

Announcing the Agent2Agent Protocol (A2A)

A2A Protocol Surpasses 150 Organizations in First Year

The Orchestration of Multi-Agent Systems: Architectures, Protocols, and Enterprise Adoption

MCP in Production

MCP hit 110 million monthly SDK downloads faster than anyone expected. Thousands of servers, a Linux Foundation home, working groups with formal charters. By every adoption metric, the protocol has arrived.

But adoption velocity and production readiness measure different things. The official roadmap names enterprise gaps that remain pre-RFC. Peer-reviewed research finds most clients don't validate the tool metadata they're handed. Context windows fill up with tool descriptions before agents do any actual work.

Six cards on where MCP actually stands: the scale, the gaps, and the governance machinery trying to close the distance between them.

MCP in Production

MCP hit 110 million monthly SDK downloads faster than anyone expected. Thousands of servers, a Linux Foundation home, working groups with formal charters. By every adoption metric, the protocol has arrived.

But adoption velocity and production readiness measure different things. The official roadmap names enterprise gaps that remain pre-RFC. Peer-reviewed research finds most clients don't validate the tool metadata they're handed. Context windows fill up with tool descriptions before agents do any actual work.

Six cards on where MCP actually stands: the scale, the gaps, and the governance machinery trying to close the distance between them.

Protocol Scale

110 Million Monthly Downloads in Sixteen Months

At the April 2026 MCP Dev Summit, lead maintainer David Soria Parra opened with a number that landed hard: 110 million SDK downloads per month. Thousands of community-built servers now cover the integrations enterprises reach for first, from GitHub and Slack to Postgres, Stripe, Docker, and Kubernetes. The adoption curve outpaced React's.

Enterprise Gaps

Four Production Problems Acknowledged but Not Solved

The official roadmap names what's missing with unusual candor: audit trails that feed compliance pipelines, SSO-integrated auth to replace static secrets, defined gateway and proxy behavior, and configuration portability across clients. All four remain pre-RFC. Acknowledged as problems, not yet proposed as solutions.

Context Bloat

Tool Metadata Fills the Window Before Work Starts

Each tool schema runs roughly 200 tokens. Wire up a handful of MCP servers and you've burned 20,000 to 30,000 tokens on metadata alone, before the agent does anything useful. Atlassian's Rovo Dev team measured a 94-tool setup consuming 17,600 tokens, then compressed it to 500. The protocol-level response is progressive discovery: load tool definitions only when they're actually needed.

Skills Extension

Tools Describe Capabilities, Skills Teach How to Combine Them

Tool schemas tell an agent what it can call. They say nothing about which tools to combine, in what order, or under what constraints. The Skills Over MCP Working Group (SEP-2640) is building an extension that lets servers bundle multi-step workflow instructions alongside their tools. Domain knowledge that travels with the server, not maintained separately in prompt engineering.

Security Surface

Tool Poisoning Remains the Primary Attack Vector

A peer-reviewed study published May 2026 tested seven major MCP clients and found five lacked static validation of server-provided metadata. The spec doesn't require it. Malicious instructions embedded in tool descriptions remain the most prevalent vulnerability, and "rug pull" mutations, where approved tools quietly change behavior post-installation, already have documented CVEs.

Open Governance

Linux Foundation Home, Formal Working Groups, Succession Plans

Under the Linux Foundation, MCP formalized working groups (SEP-1302) and succession procedures (SEP-2085). Next: a contributor ladder from community participant to core maintainer, plus delegation authority so working groups can accept proposals in their domain without bottlenecking on full core review.

A2A Adoption

The agent ecosystem has been circling a coordination problem for the past year: how do autonomous systems built by different teams, on different frameworks, with entirely different internal architectures work together without collapsing into bespoke integration? Google's Agent2Agent protocol is one answer, and it's gaining traction faster than most protocol efforts manage.

Now under Linux Foundation governance and approaching its first anniversary, A2A has moved from announcement to production standard with unusual speed. The adoption numbers tell part of the story. The design choices tell the rest, particularly what the protocol deliberately keeps hidden between collaborating agents and where it draws the line against MCP's complementary role.

Here's the landscape at the one-year mark.

A2A Adoption

The agent ecosystem has been circling a coordination problem for the past year: how do autonomous systems built by different teams, on different frameworks, with entirely different internal architectures work together without collapsing into bespoke integration? Google's Agent2Agent protocol is one answer, and it's gaining traction faster than most protocol efforts manage.

Now under Linux Foundation governance and approaching its first anniversary, A2A has moved from announcement to production standard with unusual speed. The adoption numbers tell part of the story. The design choices tell the rest, particularly what the protocol deliberately keeps hidden between collaborating agents and where it draws the line against MCP's complementary role.

Here's the landscape at the one-year mark.

Production Scale

One Hundred Fifty Organizations, and Not in Pilot

A2A launched in April 2025 with 50-odd partners. A year on, 150 organizations are running it in production, routing live tasks between agents. Atlassian, Salesforce, SAP, ServiceNow, and PayPal are among them, spanning supply chain, financial services, and IT operations. The emphasis on "production, not pilot" is deliberate and worth noting.

Framework Integration

Six Major Frameworks Now Speak A2A Natively

Google ADK, LangGraph, CrewAI, LlamaIndex Agents, Semantic Kernel, AutoGen. All six ship with native A2A support. Any agent built on these frameworks can be exposed as an A2A server. SDKs cover Python, JavaScript, Java, Go, and .NET, which is most of the surface area that matters.

Opacity Principle

Collaboration Works Because Agents Stay Opaque

A2A's most interesting design commitment: agents never expose their internal memory, proprietary logic, or tool implementations to each other. They coordinate by exchanging tasks and results, not by opening the hood. Data privacy and IP protection aren't bolted on. They're structural consequences of treating every agent as a black box.

Open Governance

Google Built It, Then Gave It Away