SIVARO
The a2a Protocol for Agent Communication: What I Learned Building Multi-Agent Systems That Actually Work
Let me start with a confession: I spent most of 2025 building multi-agent systems where the agents couldn't talk to each other. Not because the models were bad. Because the plumbing was. My team at SIVARO was wiring together LangGraph workflows, custom microservices, and three different vector databases — and every "agent" was essentially a REST endpoint wearing a costume.
Then Google dropped the Agent2Agent (A2A) protocol in April 2025. I dismissed it as another spec. I was wrong.
By February 2026, we shipped a production system where five distinct AI agents — one for pricing, one for inventory, one for logistics, one for customer sentiment, one for fraud — coordinate across three cloud providers and an on-prem data center. The a2a protocol for agent communication is the reason it didn't collapse into a spaghetti monster.
This article is the explainer I wish I'd read in April 2025. We'll cover what A2A actually is, how it differs from MCP, and concrete code patterns you can steal.
What the Hell Is A2A, Really?
Agent2Agent protocol is an open standard for enabling communication between AI agents — regardless of the framework they're built on, the vendor that made them, or the infrastructure they're running on. It was created by Google with 50+ partners including Atlassian, Box, Cohere, Intuit, LangChain, MongoDB, PayPal, and Salesforce Google Developers Blog.
The core idea: agents expose themselves as cards. Other agents discover those cards, read the capabilities, and start a task dialogue.
It's not a runtime. It's not a framework. It's a protocol — like HTTP or SMTP but for agent-to-agent conversations.
Here's what happens mechanically:
- An agent publishes an AgentCard — a JSON document describing its identity, capabilities, and endpoints.
- A client agent fetches that card (via HTTP, usually from a well-known URL).
- The client sends an
initializerequest to establish a context. - The client sends a
message/sendrequest with a task — either a simple prompt or a structured goal. - The remote agent responds with status updates:
working,input-required,completed, orfailed. - The client can request artifacts — files, data, structured outputs — from the completed task.
That's it. Six basic message types. The entire spec fits in a page.
a2a vs MCP for Enterprise AI Agents: Stop Confusing the Two
Most people think MCP and A2A are competing standards. They're not. They're complementary, and understanding the difference will save you weeks of architectural pain.
MCP (Model Context Protocol) connects a model to a tool or data source. It's about giving an LLM the ability to do things — query a database, call an API, fetch a file. Think of it as the protocol between the brain and the hands.
A2A connects one agent to another agent. It's about delegation, task handoff, and collaboration between autonomous systems. Think of it as the protocol between two brains.
Here's the mental model I use with clients:
- You need MCP when your agent needs to talk to your systems.
- You need A2A when your agent needs to talk to other agents — potentially owned by different teams or companies.
In practice, you'll use both. In our fraud detection system, Agent A uses MCP to query our PostgreSQL replica for transaction patterns. When it identifies an anomaly, it uses A2A to hand off to Agent B — the human-review coordinator — which then negotiates with Agent C (a third-party risk scoring service) via another A2A link.
The 2026 enterprise reality: most organizations now have multiple AI agents from multiple vendors. Your Salesforce agent needs to talk to your Snowflake agent needs to talk to your custom Python agent. A2A is the only standards-based way to make that happen without point-to-point integrations that break the moment anyone updates their schema.
Why I Initially Thought A2A Was Pointless (And Why I Changed My Mind)
When the spec came out, I saw it as another case of "big tech invents a standard, everyone ignores it." I mean, how many times have we heard "the year of interop"?
But then I tried building a multi-agent system where each agent could theoretically query another agent's database directly. The result was a security nightmare. Agent A needing access to Agent B's data means Agent A needs credentials for Agent B's systems. Now you're managing cross-tenant IAM policies, you've got service accounts proliferating, and any single compromise gets you broad lateral movement.
A2A fixes this by treating each agent as a boundary. Agent A sends a task to Agent B. It doesn't get database access. It gets a result. If Agent B has to query its own database, that's Agent B's problem. The security surface stays contained.
That changed my mind. This isn't about protocols winning for technical elegance. It's about operational sanity.
How to Implement A2A: A Practical Walkthrough
Let's get our hands dirty. Here's the minimal implementation of an A2A agent server using the official Python SDK from Google's A2A repository GitHub: a2a-python.
First, install the SDK:
bash
pip install a2a-sdk
Now, define your agent. Every A2A agent exposes an AgentCard. Here's a minimal one:
python
from a2a.types import AgentCard, AgentCapabilities, AgentSkill, AgentAuthentication, AuthenticationInfo
card = AgentCard(
name="PricingAgent",
description="Calculates optimal pricing based on demand elasticity and competitor data.",
url="https://pricing.sivaro.io/a2a",
version="1.2.0",
capabilities=AgentCapabilities(streaming=True, push_notifications=False),
skills=[
AgentSkill(
id="price_optimization",
name="Price Optimization",
description="Takes a product ID and target margin, returns suggested price.",
tags=["pricing", "retail", "optimization"],
examples=["Optimize price for SKU-4432 with 32% target margin."]
)
],
authentication=AgentAuthentication(
schemes=["bearer"],
credentials=AuthenticationInfo(token_url="https://auth.sivaro.io/token")
)
)
# Serve it via FastAPI
from a2a.server import A2AServer
from fastapi import FastAPI
app = FastAPI()
server = A2AServer(agent_card=card, app=app)
if __name__ == "__main__":
import uvicorn
uvicorn.run(app, host="0.0.0.0", port=8000)
That's the server side. Your agent is now discoverable and can receive tasks.
Now, here's the client side — how another agent sends a task:
python
from a2a.client import A2AClient
client = A2AClient(agent_card_url="https://pricing.sivaro.io/a2a")
response = client.initialize()
print(response.agent_info) # Confirms capabilities
task = client.send_task(
task_id="task-2026-09-01-001",
message={
"role": "user",
"content": "Optimize price for SKU-4432 with 32% target margin."
}
)
print(task.status) # "working"
But here's the thing: you shouldn't just fire a message and wait. Real agents need to handle long-running tasks asynchronously. A2A supports status updates via webhooks or pull-based polling. Here's how I set up polling:
python
import time
from a2a.types import TaskStatus
while task.status in [TaskStatus.WORKING, TaskStatus.INPUT_REQUIRED]:
time.sleep(2)
task = client.get_task(task.id)
if task.status == TaskStatus.INPUT_REQUIRED:
print("Agent needs more info:", task.message)
# Respond with additional data
task = client.send_task(
task_id=task.id,
message={"role": "user", "content": "Competitor price dropped. Re-run with 25% target margin."}
)
if task.status == TaskStatus.COMPLETED:
print("Artifacts:", task.artifacts)
# Each artifact has a name, mime_type, and bytes (or URI)
That's the core pattern. But — and this is where I'm going to ruffle feathers — the protocol is only 30% of the work. The other 70% is designing your agent's communication strategy.
The Hard Part: Making Agents Not Sound Like Douchebags
We tested two approaches with the logistics agent and the inventory agent.
First approach: Agent A sends raw JSON data and lets Agent B parse it. Like this:
json
{
"item_quantity": 42,
"warehouse_id": "W-7",
"on_hand": 12,
"allocated": 30,
"in_transit": 8
}
Agent B's response: "I don't understand your schema."
Second approach: Agent A sends a natural language task with a minimal structure:
json
{
"task": "Reallocate stock for W-7 to cover next week's demand for item 4432. Current on-hand is insufficient.",
"context": {
"item_id": "4432",
"warehouse_id": "W-7",
"forecast_confidence": 0.82
}
}
Agent B responds with a task it can actually execute. Because it understands the intent rather than just the data shape.
The lesson: A2A doesn't solve semantic interoperability. It only solves the transport. You still need to design for meaning.
I now structure every A2A task message like this:
- Clear intent — What do you want done? State it as a verb.
- Context window — What does the receiving agent need to know but may not have?
- Constraints — What must the outgoing response not violate (budget, timeline, compliance)?
- Expected artifact format — What shape should the result take?
Here's the template I use:
python
task_message = {
"role": "user",
"content": (
"Compute daily replenishment plan. "
"Context: Item SKU-4432 has 12 on-hand at W-7, forecast of 550 units/wk. "
"Constraints: Max order quantity 800 units, lead time 3 days. "
"Output artifact: JSON list of {date, suggested_order_qty, warehouse_id}."
)
}
You'll thank me later when the receiving agent is a third-party vendor with no idea how your internal systems are structured.
The Enterprise Reality Check: Authorization, Discovery, and Trust
This is where most a2a protocol for agent communication tutorials go soft. They show you cute demo with two agents on localhost. You need to understand production hardening.
Discovery. In production, you can't hardcode URLs. We use a lightweight registry — a simple PostgreSQL table storing agent cards. Each agent registers itself on startup, and clients query the registry for the right card. This is the only way to avoid breaking every invocation when you redeploy your pricing agent to a new instance.
Authentication. A2A supports bearer tokens, OIDC, and mutual TLS per the spec. Use OIDC if you can. Every agent in our fleet gets a service account identity. Tokens are scoped per-agent, never per-team.
Authorization. This is the part everyone gets wrong. Treat your agents like humans. Don't give the logistics agent access to read customer PII if it doesn't need it to do its job. Check the agent's skills and capabilities in the card, and only route tasks to agents whose declared capabilities match the requested operation.
We also test adversarial scenarios monthly. What happens when a compromised agent tries to escalate? A2A's spec doesn't solve this — your IAM architecture does. Don't skip it.
Idempotency. A2A tasks can be retried, so design agents that are idempotent. If the same task ID arrives twice, the agent should return the cached result, not execute twice. We've seen production incidents from forgetful agents executing duplicate payment reconciliation tasks. Store task IDs and statuses in a database. Check before executing.
Case Study: The 6-Agent Orchestration at SIVARO
I'll share one hard-won example from my own work. In 2026, we built a customer escalation flow for a B2B SaaS client with 4,000+ enterprise customers.
The flow involves six agents:
- Triage Agent — Receives all customer support tickets. Classifies priority and intent.
- Sentiment Agent — Monitors the tenor of the conversation, flags churn risk.
- Knowledge Retrieval Agent — Pulls relevant docs, past tickets, and internal wikis via MCP connectors.
- Technical Analysis Agent — For bug reports. Analyzes logs, stack traces, repro steps.
- Escalation Agent — Decides whether a human needs to be involved. Owns the SLA clock.
- Resolution Agent — Drafts responses and patches.
Every single handoff between these agents uses A2A. The messaging looks like:
- Triage → Technical Analysis: "Analyze this trace. Determine if this is a regression from the 2.4.1 release."
- Sentiment → Escalation: "Churn risk score 0.74. Recommend priority 1 human review within 15 minutes."
- Technical Analysis → Resolution: "Root cause found. Here's a verified patch. Artifact:
fix_patch_v2.diff."
We hit a real problem in the first month: circular dependencies. The Technical Analysis Agent needed info from the Knowledge Retrieval Agent, which needed context from the Triage Agent, which... you get the picture. We fixed it by enforcing a rule: each agent can only initiate tasks to agents with lower rank in a pre-defined DAG. Cycles were forbidden.
This made the orchestration predictable. Debugging became tracing through a defined pipeline, not untangling a spider web.
The system now processes 2,300+ tickets per week. The escalation agent catches 94% of high-risk issues before a human even looks at the ticket. Without A2A, we'd have built a custom queueing system and essentially created our own proprietary protocol that nobody else could use. That's the thing I keep telling engineering teams: you will build a protocol anyway. The question is whether you build one that 50+ vendors support or one that only your ops team hates.
Who Should Use A2A Today — and Who Shouldn't
Let's be honest. A2A isn't for everyone.
Adopt it if you are:
- Building multi-agent systems where agents span engineering teams or vendors.
- Preparing for a future where your company's agents need to interoperate with external agents (e-commerce, supply chain, finance).
- Standardizing how AI tasks are delegated and tracked across your stack.
Don't adopt it if:
- You're experimenting with a single agent doing a single well-scoped workflow. A simple function call is fine.
- Your agents run within one process and share memory directly. A2A would just be overhead.
At SIVARO, we made the call in mid-2026: all new agent-to-agent communication in shared infrastructure must be A2A. No exceptions. It was a hard rule, but it forced good separation of concerns.
The API Mess You'll Actually Care About
Here are the 4 methods you'll use daily. The full protocol has more, but these carry 90% of the traffic:
initialize— Client asks the agent for its capabilities. Cheap, stateless.message/send— The workhorse. Sends a task, returns a task object.message/reply— Sends a follow-up message on the same task, used when agents are negotiating.get_task— Pulls status for a task ID. Use for polling, not spamming.
And here's my personal anti-pattern list. I've seen all of these in the wild:
- Polling with 1-second intervals. Use webhooks when available, or poll at 5-10 seconds for long tasks.
- Sending giant artifacts inline in the task message. A2A supports artifact URIs. Don't stuff 20MB of JSON into a message; hand over a pre-signed S3 URL.
- Treating A2A like RPC. If your messages look like function signatures with typed parameters, you're missing the point. A2A's job is to give agents the freedom to reason about a task. If you want strict typed RPC, use gRPC.
What's Coming Next
As of September 2026, the A2A spec is solid for text-based task delegation. Streaming responses across agents are possible via the streaming capability flag, but adoption is inconsistent. In my experience, most agent servers you encounter won't support streaming. Prepare for pull-based status checks.
The harder challenges — semantic negotiation, conflict resolution, and automated trust scoring — are still open research areas. There's no negotiate method in the A2A spec, and I doubt there ever will be. That's fine. Protocols should be thin. The intelligence lives in the agents, not the transport.
If you're building agent ecosystems now, my advice: start with A2A as your backbone, but design your agents to be resilient when the protocol fails. Timeouts, retries, and manual fallback to human handoff are not "edge cases." They're the main event.
Frequently Asked Questions
Q: Is A2A a replacement for LangChain or other agent frameworks?
No. A2A is a communication protocol, not an orchestration framework. Your LangChain, CrewAI, or custom Python agents can communicate via A2A while still doing all of their internal reasoning however they like. Think of A2A as the contract between agent processes, not the glue inside a single agent.
Q: Can A2A agents be deployed on different cloud providers?
Yes. This is one of the core design goals. As long as each agent exposes the A2A endpoints over HTTP(S), they can run on AWS, GCP, Azure, on-prem, or even on a Raspberry Pi in someone's data center. We've done cross-cloud deployment successfully.
Q: How does A2A handle privacy and data residency?
A2A doesn't handle it for you. The protocol just moves bytes. You're responsible for encrypting traffic in transit (TLS, always), for token-based authorization (OIDC, bearer tokens), and for choosing where your agents run when they process sensitive data. Don't assume the protocol provides governance.
Q: What's the difference between A2A and MCP again?
MCP connects a model to a tool. A2A connects an agent to another agent. MCP is for building agents; A2A is for connecting them. You'll often use MCP inside an agent (e.g., to query a database) and A2A between agents (e.g., to hand off a task).
Q: Is A2A production-ready?
Yes — if you're willing to build the supporting infrastructure. The protocol itself is stable. But you'll need to build discovery, monitoring, and security around it. Treat it like Kubernetes: the protocol is the easy part; the operational layer is the work.
Q: Do I need to register my agent somewhere?
No central registry exists. Agents expose their AgentCard at a well-known URL, and clients query that URL. The standard way is to place the card at /.well-known/agent.json on the agent's domain, but you can also send it in the initialize response or store it in your own registry.
Q: What language SDKs exist?
Google maintains official SDKs for Python and JavaScript. There are community SDKs for Go, Java, .NET, and Rust emerging. The spec is simple enough that implementing a minimal client in any language takes a few hours.
The Bottom Line
The a2a protocol for agent communication solves a real problem: how to get AI agents working together without coupling their implementations. It's not the sexiest technology — it's plumbing. But plumbing is usually what makes or breaks production systems.
If you're building multi-agent systems in 2026, you have two choices. Build your own ad-hoc protocol and own every integration forever. Or use A2A and get interop with every vendor that decides to follow the standard. I made the second choice at SIVARO, and I haven't looked back.
Start simple. Expose one agent. Write one client. See what breaks. Then expand.
You'll be glad you did.
Nishaant Dixit — Founder of SIVARO. Building data infrastructure and production AI systems since 2018. Built systems processing 200K events/sec.