Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Agent2Agent Protocol (A2A)

developers.googleblog.com

Post reply on HN
Print view View original

191–200 of 293 posts

Re: The Agent2Agent Protocol (A2A)

#191

Post by simonw »

zambachi wrote: post #177
simonw wrote: post #19

I just published some notes on MCP security and prompt injection. MCP doesn't have security flaws in the protocol itself, but the patterns it encourage (providing LLMs with access to tools that can act on the user's behalf while they also may be exposed to text from untrusted sources) are rife for prompt injection attacks: https://simonwillison.net/2025/Apr/9/mcp-prompt-injection/

From the spec: https://modelcontextprotocol.io/specification/2025-03-26/ser... “ For trust & safety and security, there SHOULD always be a human in the loop with the ability to deny tool invocations. Applications SHOULD: Provide UI that makes clear which tools are being exposed to the AI model Insert clear visual indicators when tools are invoked Present confirmation prompts to the user for operations, to ensure a hu…

Notable that they used SHOULD there, where they use MUST elsewhere in the same document.

Thanks for the reference though, I'll quote that in my article.

Re: The Agent2Agent Protocol (A2A)

#192

Post by medbrane »

zellyn wrote: post #137
laichzeit0 wrote: post #12

Earlier quoted context omitted.

Take a look at the samples: https://google.github.io/A2A/#/documentation

Oh, that's really nice. I'd also like to see what syntax the LLM uses to _trigger_ these calls, and what prompt is sent to the LLM to tell it how to do that. I should probably just go read Goose's code…

That's dependent on the particular LLM one uses.

But it can be a json with the tool name and the payload for the tool.

Re: The Agent2Agent Protocol (A2A)

#193

Post by TeMPOraL »

efitz wrote: post #164
TeMPOraL wrote: post #147

Earlier quoted context omitted.

> What's our excuse? There exist no such thing as "out-of-band signaling" in nature. It's something we introduce into system design, by arranging for one part to constrain the behavior of other, trading generality for predictability and control. This separation is something created by a mind, not a feature of the universe. Consequently, humans don't support "out-of-band signalling either . All of our perception of re…

Today’s LLMs are not humans and don’t process information anything like humans.

That's irrelevant. What's important is that LLMs are intentionally designed as fully general systems, so they can react like humans within confines of the model's sensory modalities and action space. Much like humans (or anything else in nature), they don't have separate control channels or any kind of artificial "code vs. data" distinction - and you can't add it without loss of generality.

Re: The Agent2Agent Protocol (A2A)

#194

Post by medbrane »

a_wild_dandan wrote: post #161
mellosouls wrote: post #133

How it claims to complement/differentiate from MCP here: https://google.github.io/A2A/#/topics/a2a_and_mcp Basically (google claims): MCP enables agents to use resources in a standard way. A2A enables those agents to collaborate with each other.

I suppose Google wants us to pretend that "agents" can't be "resources." MCP is already well established (Anthropic, OpenAI, Cursor, etc), so Google plastering their announcement with A2A endorsements just reeks of insecurity. I figure this A2A idea will wind up in the infamous Google graveyard within 8 months.

But MCP doesn't claim to address agent to agent communication, right?

Re: The Agent2Agent Protocol (A2A)

#195

Post by phillipcarter »

IanCal wrote: post #181
simonw wrote: post #144

Earlier quoted context omitted.

I don't buy it. Why would I want my LLM to talk to some other LLM and introduce even more space for weird, non-deterministic bugs when I could have my LLM call a deterministic API to achieve the same thing?

Why do you assume there's a deterministic API doing the same thing?

Because there often is?

Re: The Agent2Agent Protocol (A2A)

#196

Post by medbrane »

mindwok wrote: post #171

The MCP announcement had me excited on day one. Compared to that, this is a miss for me. The capabilities it provides seem to be no more than a system prompt, which was already a mostly solved problem. What “agents” need is not a protocol for operating, they need a protocol for discovery and addressability. How do I find someone’s agent? How do I talk to it and verify its identity? Once I’ve done that, it can just be…

An endpoint implementing this protocol would describe the agent and its capabilities, including examples. So I guess you could index that and create a discovery service.

Re: The Agent2Agent Protocol (A2A)

#197

Post by phillipcarter »

A key difference between MCP and A2A that is apparent to me after building with MCP and now reading the material on A2A:

MCP is solving specific problems people have in practice today. LLMs need access to data that they weren't trained on, but that's really hard because there's a millions different ways you could RAG something. So MCP defines a standard by which LLMs can call APIs through clients. (and more).

A2A solves a marketing problem that Google is chasing with technology partners.

I think I can safely say which one will still be around in 6 months, and it's not the one whose contributors all work for the same company.

Re: The Agent2Agent Protocol (A2A)

#198

Post by bob1029 »

hliyan wrote: post #63

Are we rediscovering SOA and WSDL, but this time for LLM interop instead of web services? I may be wrong, but I'm starting to wonder whether software engineering degrees should include a history subject about the rise and fall of various architectures, methodologies and patterns.

Some of us are still building new products with XML RPC techniques.

WSDLs and XSDs done right are a godsend for transmitting your API spec to someone. I use .NET and can call xsd.exe to generate classes from the files in a few seconds. It "just works" if both sides follow all of the rules.

The APIs I work with would be cartoonish if we didn't have these tools. We're talking 10 megabytes of generated sources. It is 100x faster to generate these types and then tunnel through their properties via intellisense than it is to read through any of these vendors' documentation.

Re: The Agent2Agent Protocol (A2A)

#200

Post by [deleted] »

simonw wrote: post #19

I just published some notes on MCP security and prompt injection. MCP doesn't have security flaws in the protocol itself, but the patterns it encourage (providing LLMs with access to tools that can act on the user's behalf while they also may be exposed to text from untrusted sources) are rife for prompt injection attacks: https://simonwillison.net/2025/Apr/9/mcp-prompt-injection/

[deleted]
Post reply on HN