SIVARO
A2A Agent Discovery and Routing Setup: The 2026 Buying Guide
You've built the agents. Now they can't find each other.
I've spent the last eighteen months at SIVARO watching teams deploy multi-agent systems on AWS, and the pattern is always the same. They nail the model prompting. They build beautiful tooling. Then they hit the wall: how does Agent B know Agent A exists, and how does a request even get there?
The a2a agent discovery and routing setup is the unglamorous layer that makes or breaks production AI systems. Nobody writes blog posts about service discovery for LLM agents. But get it wrong, and you're debugging timeout storms at 2 AM. Get it right, and your system scales without drama.
Here's what we'll cover. We'll compare the practical options for agent discovery and routing in 2026: open protocol implementations, managed AWS services, and the DIY approaches that still make sense. I'll tell you exactly what we've tested at SIVARO, what broke, and what I'd buy today.
Let's be clear about one thing first: most teams treat this as an infrastructure problem. They're wrong. It's an organizational problem wearing an infrastructure costume.
What Actually Is A2A Agent Discovery?
Agent2Agent (A2A) is the protocol Google released in 2025 for letting AI agents communicate securely. By September 2026, it's the de facto standard for inter-agent communication, especially in enterprise stacks. The specification defines how agents advertise their capabilities, how they discover each other, and how they route tasks.
Discovery is the step where one agent asks "who can handle invoice extraction?" Routing is what happens after: "Great, Agent C can — send the task there."
The official A2A spec has evolved considerably. The 2025 versions were modest. The 2026 iterations added proper authentication flows and, crucially, better discovery mechanisms. But the protocol only defines the shape of discovery. It doesn't tell you how to implement it at scale on AWS.
That gap is where teams get stuck.
Why Discovery Fails in Production (From Real Deployments)
At SIVARO, we onboarded a fintech client in March 2026 — let's call them LedgeR. They had 40 agents handling everything from KYC checks to fraud scoring. Their agents talked to each other fine in staging. In production, they had a 23% error rate on cross-agent calls.
The culprit wasn't the protocol. It was their routing table.
They'd hardcoded agent endpoints in environment variables. Every deployment was a blessing — here's what happens when you hardcode agent registry entries:
python
# The naive approach that breaks in production
AGENT_REGISTRY = {
"kyc_agent": "http://kyc-service.internal:8080",
"fraud_agent": "http://fraud-scorer.internal:9090",
}
When the fraud agent scaled to three replicas, only the first one got traffic. When the KYC agent was redeployed and got a new IP, the registry pointed to a dead endpoint. Classic.
The fix wasn't more code. It was centralizing discovery.
Your Options for A2A Agent Discovery and Routing Setup in 2026
You have four practical routes. I've tested all of them with production workloads. Here's the honest breakdown.
Option 1: AWS Cloud Map + Custom Agent Registry (The DIY Foundation)
AWS Cloud Map has been around since 2018, and it remains the backbone of most agent discovery setups I see in production. You register agent instances as service resources, and Cloud Map handles the health checks and DNS-based discovery.
For an A2A setup, you'd do something like this:
typescript
// Using AWS Cloud Map SDK to register an agent instance
const cloudmap = new AWS.ServiceDiscovery();
await cloudmap.registerInstance({
ServiceId: "srv_kyc_agent",
InstanceId: "kyc-agent-v3-replica-2",
Attributes: {
AWS_INSTANCE_IPV4: "10.0.4.82",
AWS_INSTANCE_PORT: "8080",
A2A_CAPABILITY: "kyc_verification",
A2A_VERSION: "2026.08",
},
}).promise();
That looks simple because it is. The complexity arrives when you need intelligent routing — routing based on capability matching or workload, not just DNS round-robin.
What works: Cloud Map gives you service discovery with health checks integrated into ECS and EKS. It's cheap, it scales, and it's boring in the good way.
What doesn't: It does DNS-level discovery. It doesn't understand A2A capabilities. Your routing logic has to pull instance attributes and do the semantic matching itself.
Option 2: A2A Gateway Services on AWS Marketplace
This is where the ecosystem went vertical in 2026. Several vendors now offer "A2A Gateways" — managed proxies that handle discovery and routing as a service layer. (We evaluated Portkey and Kong's AI Gateway, plus two smaller players we eventually abandoned.)
These gateways work like this:
- Your agents register capabilities with the gateway.
- Requesting agents query the gateway with a natural language task description.
- The gateway uses the A2A protocol's
agent-carddiscovery mechanism to match. - Routing happens with load balancing, retries, and circuit breakers.
What works: Portkey's gateway cut our client's error rate from 23% to 4% in a week. The retry logic is genuinely smart, and it understands A2A's capability cards natively. It saved LedgeR from building routing logic themselves — which I estimate would've taken six engineer-weeks.
What doesn't: Cost, for one. Managed gateways run $0.50 to $2.00 per 1K requests on top of your compute. If you're handling millions of agent-to-agent calls daily, that adds up. Also, adding a proxy layer adds 5–15ms latency per hop. Sometimes that matters.
Option 3: MCP-Based Discovery (The Alternative Protocol)
Model Context Protocol (MCP) continues to be the tool-connection standard. But for agent-to-agent communication, I've become skeptical.
Here's the a2a vs mcp for ai agents on aws question people ask me monthly:
| Aspect | A2A | MCP |
|---|---|---|
| Primary purpose | Agent-to-agent | Agent-to-tool/data |
| Discovery | Capability cards | Server resource listing |
| Authentication | Built-in (JWT, OAuth) | Transport-dependent, incomplete |
| State | Stateless tasks | Mostly stateless |
| Maturity in 2026 | High, enterprise-adopted | High, but for different job |
For discovery and routing specifically, A2A wins. MCP gives you a list of tools on a server. A2A gives you structured agent cards with capabilities, authentication requirements, and routing hints.
Don't let anyone sell you MCP as an A2A replacement. They serve different layers. If you're choosing between them for multi-agent orchestration on AWS, choose A2A and use MCP inside each agent for tool access.
Option 4: The Roll-Your-Own Registry on DynamoDB (For When You Must)
There are cases where you need to go fully custom. You have niche routing logic — cost-based routing, data-sovereignty constraints, latency-based routing. We tested this route with a logistics client in June 2026 who needed routing based on geographic data residency.
A DynamoDB-backed registry with a lookup service is straightforward:
python
# Simplified discovery lookup using DynamoDB
import boto3
dynamodb = boto3.resource("dynamodb")
registry_table = dynamodb.Table("a2a-agent-registry")
def discover_agents(capability: str, region: str = None):
if region:
# Query with a composite key for region-scoped agents
response = registry_table.query(
IndexName="CapabilityRegionIndex",
KeyConditionExpression="capability = :cap AND region = :r",
ExpressionAttributeValues={
":cap": capability,
":r": region,
},
)
else:
response = registry_table.query(
IndexName="CapabilityIndex",
KeyConditionExpression="capability = :cap",
ExpressionAttributeValues={":cap": capability},
)
return [item["agent_url"] for item in response["Items"]]
This works. We deployed it in five days. But it only worked because we had a team comfortable with distributed systems. Get the consistency model wrong and you'll have routing loops. DynamoDB's eventual consistency can cause agents to discover stale endpoints under load.
My honest take: roll your own only if a managed gateway can't meet a specific compliance or latency constraint. Otherwise, you're rebuilding what the A2A working group has already standardized.
The Routing Layer: Where the a2a Agent Discovery and Routing Setup Gets Hard
Discovery is the easy half. Routing is the hard half.
Specifically, the intelligent routing — where you need the request to go to the "right" agent instance or a chain of agents. Here are the patterns we've validated at SIVARO.
Pattern 1: Static Capability Matching
Every agent publishes an A2A agent card, as specified in the protocol:
json
{
"name": "kyc-verification-agent-v3",
"description": "Handles identity document verification for KYC workflows",
"url": "https://kyc-agent.internal.example.com/a2a",
"capabilities": {
"tasks": ["kyc_verify", "document_check"],
"inputModes": ["text", "image"],
"validation": {
"acceptedCountries": ["US", "CA", "UK"]
}
},
"security": {
"auth": "jwt",
"audience": "internal-services"
}
}
You store these cards in your registry. At request time, your router queries the registry. Let's say you need KYC verification for a Canadian customer. The router fetches all agents with the kyc_verify capability, filters on acceptedCountries containing "CA", and picks one.
This is straightforward. It's also static. It breaks when you have two identical agents with different current loads, or when one agent is about to be decommissioned.
Pattern 2: Dynamic Load-Based Routing
This is where managed gateways earn their keep. We stress-tested Portkey, Kong, and our own DIY setup with 500 requests per second across 20 agent instances in July 2026.
The DIY setup failed. Round-robin DNS through Cloud Map sent traffic to saturated agents. Our retry logic created thundering herds when unavailable agents came back.
The gateway handled it. Portkey's weighted routing and circuit breaker logic, configured via their API, smooths spikes and redirects traffic within 300ms when an agent degrades:
javascript
// Portkey gateway routing config (simplified)
const routingConfig = {
strategy: "weighted-round-robin",
weightBy: "response-time",
circuitBreaker: {
failureThreshold: 5,
resetTimeout: 30,
},
retry: {
attempts: 3,
backoff: "exponential",
},
};
If you're running fewer than 10 agents, dynamic routing is overkill. If you're running more than 10, you'll want it.
Pattern 3: Semantic Task Decomposition and Chained Routing
This is the frontier in late 2026. You don't just route a request to one agent. You route it through a sequence.
Here's a real example from a healthcare logistics client we built with: a "schedule_patient_visit" task. The router decomposes it: appointment booking agent → insurance verification agent → transport routing agent. Each step's output feeds the next.
A2A's task object supports this via nested tasks and messageId correlation:
python
# Simplified orchestrator for chained agent routing
def route_complex_task(task_description: str, registry_client):
# Step 1: Decompose
plan = decompose_task(task_description) # LLM-based planner
results = {}
for step in plan:
# Step 2: Discover an agent for each step
agent = registry_client.discover_best(
capability=step["required_capability"],
context=results, # pass prior step outputs
)
# Step 3: Execute with the agent's A2A endpoint
result = call_a2a_agent(agent.endpoint, task={
"content": step["prompt"],
"context": results,
})
results[step["id"]] = result
return results["final"]
This is powerful. It's also where things fail spectacularly. A single bad discovery response during chaining stalls the entire pipeline. We observed cascading timeouts in one architecture that went undiscovered because the planning agent generated different step names for the same task across runs.
For chained routing, use the gateway, if only for the tracing and observability that a gateway brings.
AWS-Native Options vs. Third-Party Gateways in 2026
There's an assumption that every workload on AWS should use AWS-native services. That's a nice story for sales calls. It's not always true.
These AWS services might fit your a2a agent discovery and routing setup:
Amazon EventBridge Pipes — Surprisingly good for stateless fan-out patterns. You can trigger Agent B when Agent A finishes. We used EventBridge Pipes for event-driven workflows where agents announce completion events.
Amazon Bedrock AgentCore — Launched in late 2025, AgentCore includes a managed agent registry. But its routing is limited to Bedrock-powered agents. If you're using Anthropic's Claude through Bedrock exclusively, it's a solid option. It's not flexible enough if you're mixing models or providers.
AWS App Mesh — Service mesh for routing. Works but overkill for most A2A scenarios. You don't need layer-4 mTLS and traffic splitting when what you mostly need is "find the right agent and handle retries."
Third-party gateways (Portkey, Kong, LiteLLM Enterprise) bring protocol-level intelligence. They understand A2A. They parse capability cards. They handle authentication semantics. These are the tools the AWS-native stack lacks.
My position: AWS-native works if you're all-in on Bedrock and have simple routing needs. Go with a third-party gateway if you have heterogeneous agents, complex chaining, or need cross-cloud discovery. This matches what we've seen with over 30 production deployments this year.
Security Considerations: Nobody Talks About
Discovery and routing are attack surfaces. An agent registry is essentially a phonebook with API keys.
Here's what matters in production:
Mutual TLS between agents. With A2A in 2026, the protocol now specifies mTLS support via the X-Certificate header. Implement it at the service mesh level if you can.
JWT validation at each agent. The A2A security working group mandate in August 2026 says all agents must validate JWT claims — issuer, audience, scope. A lot of implementations skip the audience check. That's how lateral movement happens.
Registry access controls. Your DynamoDB-backed registry in Option 4 needs strict IAM policies. We nearly shipped an agent registry with a public-read policy attribute in a test environment.
json
{
"Effect": "Allow",
"Action": "dynamodb:Query",
"Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/a2a-agent-registry",
"Condition": {
"ArnLike": {
"aws:PrincipalArn": "arn:aws:iam::123456789012:role/production-agent-role"
}
}
}
Your registry is only as secure as the metadata it exposes. Agent endpoints often sit on internal networks, but discovery responses can leak internal IP structure if you're not careful. Sanitize those responses — no need to reveal container IDs or availability-zone specific IPs.
An A2A Protocol for Multi Agent Systems Tutorial: The Minimal Setup
Let me give you a condensed tutorial that gets you from zero to running agents on AWS in under an hour. This is the pattern we recommend for teams starting fresh.
Prerequisites: Two ECS services (Agent A and Agent B). An A2A endpoint implementation in Python or Node.js. That's it.
Step 1 — Each agent publishes its agent card.
python
# app.py - Simple A2A agent endpoint using FastAPI
from fastapi import FastAPI, HTTPException
from pydantic import BaseModel
app = FastAPI()
AGENT_CARD = {
"name": "invoice-processor",
"description": "Extract and validate invoice data",
"capabilities": {"tasks": ["invoice_extraction"]},
}
class TaskRequest(BaseModel):
messageId: str
task: str
payload: dict
@app.get("/.well-known/agent-card")
async def get_agent_card():
return AGENT_CARD
@app.post("/a2a/task")
async def handle_task(request: TaskRequest):
# Process the task
return {"result": {"status": "completed", "data": processed_data}}
Step 2 — Register each agent at startup.
python
import boto3
cloudmap = boto3.client("servicediscovery")
def register_agent(service_id: str, instance_id: str, ip: str, port: int):
cloudmap.register_instance(
ServiceId=service_id,
InstanceId=instance_id,
Attributes={
"AWS_INSTANCE_IPV4": ip,
"AWS_INSTANCE_PORT": str(port),
"capability": AGENT_CARD["capabilities"]["tasks"][0],
},
)
Step 3 — Query for the right agent when you need one.
python
def discover_agents(capability: str):
response = cloudmap.discover_instances(
NamespaceName="my-agents",
ServiceName="agent-services",
QueryParameters={"capability": capability},
)
return [inst["attributes"] for inst in response["Instances"]]
That's the core. You'll need health checks, retry logic, and authentication. But those are enhancements — the above gets you a working A2A agent discovery and routing setup for a modest number of agents.
Decision Time: What Should You Buy or Build?
Let me give you an answer based on your team and scale of operations.
Scenario A: You have under 10 agents and one team owns all of them.
Run the tutorial above. Use Cloud Map + a lightweight router. Don't buy a gateway. You're not at the scale where managing discovery will break you, and you'll learn the protocol better by building it once.
Scenario B: You have 10–50 agents, multiple teams, or 1M+ agent calls per day.
Buy a managed gateway. Test Portkey first — their A2A support is the most mature, and their observability is excellent. At 1M calls/month, their pricing is competitive. The 4% → 0.5% error-rate improvement you get from smart retries and circuit breakers could be a hard ROI justification for your CFO.
Scenario C: Your agents span multiple clouds or you have strict data residency requirements.
You'll need a hybrid approach. Use the A2A protocol's fetch agent card flow when you need cross-cloud discovery. Implement a regional DynamoDB registry if you need data residency. This is the hardest — we spend the most consulting time in this zone.
Scenario D: You have no agents yet.
Start with the A2A guide and Google's first-party A2A docs. Get a working POC before buying infrastructure.
What I Would Do Differently (Lessons Learned)
Back in March 2026, I advised a retail client to use AWS-native tools exclusively. We used Cloud Map plus a custom-built router on ECS. It worked fine for three weeks.
Then they onboarded four new agents from an acquired company. The new agents exposed A2A endpoints but weren't in Cloud Map. They had a different capability format. The routing logic broke.
I thought this was a technology problem. It turns out it was an operational problem. There was no governance for how new agents got registered. Nobody owned the routing layer.
The fix wasn't a better router. It was process.
Before you pick any infrastructure, establish:
- Who owns agent registration.
- What the capability-card schema looks like (go with the official A2A spec, not custom).
- How schema changes get communicated.
- What the health-check criteria are for removing a misbehaving agent.
If you skip this, your a2a agent discovery and routing setup will fail — no matter which technology you choose.
FAQ
Q: What on earth is the a2a agent discovery and routing setup cost on AWS for a small project?
A: Nearly nothing if you DIY. Cloud Map costs about $0.10 per service per hour plus $0.10 per 1,000 DNS queries. For a small setup, you're paying pennies. (Note: None of this covers the EC2 or ECS compute running the agents.) Managed gateways are pricier — expect $190/month minimum for a serious setup from Kong or Portkey. That said, the time saved on implementing reliable retries and circuit breaker logic usually pays for it.
Q: Is the A2A protocol production-ready?
A: Yes. The spec reached 1.0 in late 2025. It's now adopted by over 60 vendors and major public cloud providers. It continues to receive updates — the authentication layer got its biggest overhaul this summer. The Linux Foundation will take over governance in 2027.
Q: How do I handle authentication between agents?
A: The 2026 A2A spec supports OAuth 2.1, JWT bearer tokens, and mTLS. For internal agents on AWS, I recommend OIDC-based JWT from IAM roles. For external agents, mTLS via the AWS Certificate Manager. Mesh-grade security requires mTLS. And for most startups, JWT validation on a per-agent basis is the first step.
Q: Do I need a gateway if I use Amazon Bedrock AgentCore?
A: Not necessarily. AgentCore has a managed discovery and routing function, but only if all agents use Bedrock. If you're using, say, a custom fine-tuned open-source model deployed on SageMaker or EKS, AgentCore can't route to it — your Bedrock agent will have to call your other agents via raw HTTP. This is the reality gap I keep hitting with clients.
Q: What is the performance metric I should watch for routing?
A: Don't watch average latency. Watch P95 latency and error rate. When services begin to fail and retries trigger, the P95 will spike dramatically. The managed gateways I've seen keep P95 under 1 second, while DIY stacks barely stay under 3 seconds during partial failures. Error rate is your true north. If it crosses 1%, something is wrong with discovery or routing.
Q: Is the A2A spec compatible with MCP?
A: They operate on different layers — A2A for agent-to-agent, MCP for agent-to-tool. Both protocols are designed to complement each other. For a clear picture of this, read Google's official documentation on the differences. Use both in a production setup without friction, provided your router understands both as distinct layers.
Final Verdict
Don't buy the fanciest router. Buy the setup that matches your team's ability to operate it.
If I were starting at SIVARO in 2026 on a fresh multi-agent project, I would buy a managed gateway — Portkey — after the first month of building. During that month, I'd use my DIY A2A setup to learn the protocol and figure out what I needed.
The core insight: the a2a agent discovery and routing setup is not a feature, it's an architecture decision that touches every part of your system. Choose your registry and router based on your team's ability to handle distributed systems. If in doubt, go managed. The debugging you'll save will pay for itself.
Nishaant Dixit — Founder of SIVARO. Building data infrastructure and production AI systems since 2018. Built systems processing 200K events/sec.