Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Agent2Agent Protocol (A2A)

developers.googleblog.com

Post reply on HN
Print view View original

91–100 of 293 posts

Re: The Agent2Agent Protocol (A2A)

#91

Post by qwertox »

simonw wrote: post #19

I just published some notes on MCP security and prompt injection. MCP doesn't have security flaws in the protocol itself, but the patterns it encourage (providing LLMs with access to tools that can act on the user's behalf while they also may be exposed to text from untrusted sources) are rife for prompt injection attacks: https://simonwillison.net/2025/Apr/9/mcp-prompt-injection/

Should security be part of the protocol? Both the host and the client should make sure to sanitize the data. How else would you trust a model to be passing "safe" data to the client and the host to pass "safe" data to the LLM?

Re: The Agent2Agent Protocol (A2A)

#92

Post by whalesalad »

skeledrew wrote: post #85
whalesalad wrote: post #52

Earlier quoted context omitted.

Agreed. At the end of the day we are talking about RPC. A named method, with known arguments, over the wire. A simple HTTP request comes to mind. But that would just be too easy. Oh wait, that is what all of these are under the hood. We are so cooked. from fastmcp import FastMCP mcp = FastMCP("Demo ") @mcp.tool() def add(a: int, b: int) -> int: """Add two numbers""" return a + b This is an example of fastmcp. Notice…

It's just another layer of abstraction so one doesn't need to think about HTTP at all, which would bring in irrelevant baggage.

but at the end of the day MCP is HTTP lol

Re: The Agent2Agent Protocol (A2A)

#93

Post by mindcrime »

whalesalad wrote: post #92
skeledrew wrote: post #85

Earlier quoted context omitted.

It's just another layer of abstraction so one doesn't need to think about HTTP at all, which would bring in irrelevant baggage.

but at the end of the day MCP is HTTP lol

That's not quite right. MCP can run over http, but it doesn't have to.

Re: The Agent2Agent Protocol (A2A)

#94

Post by rvz »

zb3 wrote: post #43

> Hiring a software engineer can be significantly simplified with A2A collaboration. Holy shit.. NO!

See how they didn't choose lawyers, bankers, or government civil servants?

Analysts, digital artists, customer service support and journalists of all levels have already been replaced.

Software engineers (of all levels) are the next knowledge workers to be replaced by agents.

Re: The Agent2Agent Protocol (A2A)

#95

Post by smusamashah »

In the video example, I am kind of baffled that LLM is being trusted to pick candidates for the role.

How much guarantee does Google's LLM/agent provide that it didn't hallucinate (read wrong info) in any of the steps including parsing job description and than matching that with profile of candidates?

I don't understand when these LLMs are presented to solve real life problems as if an LLM is like a sane person doing their job.

Re: The Agent2Agent Protocol (A2A)

#96

Post by nonethewiser »

whalesalad wrote: post #52
zellyn wrote: post #3

It’s frustratingly difficult to see what these (A2A and MCP) protocols actually look like. All I want is a simple example conversation that includes the actual LLM outputs used to trigger a call and the JSON that goes over the wire… maybe I’ll take some time and make a cheat-sheet. I have to say, the endorsements at the end somehow made this seem worse…

Agreed. At the end of the day we are talking about RPC. A named method, with known arguments, over the wire. A simple HTTP request comes to mind. But that would just be too easy. Oh wait, that is what all of these are under the hood. We are so cooked. from fastmcp import FastMCP mcp = FastMCP("Demo ") @mcp.tool() def add(a: int, b: int) -> int: """Add two numbers""" return a + b This is an example of fastmcp. Notice…

I dont fully understand. The protocol uses HTTP and has a JSON schema. But there are more specifications outside of that. How do you specify those things without a new protocol? Or is the argument that you dont need to specify those things?

Re: The Agent2Agent Protocol (A2A)

#97

Post by alphazard »

Can anyone comment on whether this or MCP are at all well designed? Is there any sort elegance to them? Or is it exactly what I would expect from a multi-corporation committee: lots of different ways to do the same thing, use case bloat, complicated to implement, complicated to test, etc.

Re: The Agent2Agent Protocol (A2A)

#98

Post by ramoz »

simonw wrote: post #19

I just published some notes on MCP security and prompt injection. MCP doesn't have security flaws in the protocol itself, but the patterns it encourage (providing LLMs with access to tools that can act on the user's behalf while they also may be exposed to text from untrusted sources) are rife for prompt injection attacks: https://simonwillison.net/2025/Apr/9/mcp-prompt-injection/

the interface is light, but we're taking this in a direction to better secure/govern MCP

https://github.com/eqtylab/mcp-guardian/

https://www.eqtylab.io/blog/securing-model-context-protocol

Re: The Agent2Agent Protocol (A2A)

#99

Post by slt2021 »

simonw wrote: post #19

I just published some notes on MCP security and prompt injection. MCP doesn't have security flaws in the protocol itself, but the patterns it encourage (providing LLMs with access to tools that can act on the user's behalf while they also may be exposed to text from untrusted sources) are rife for prompt injection attacks: https://simonwillison.net/2025/Apr/9/mcp-prompt-injection/

great writeup! so what's the solution?

is it only use pre-vetter "Apple Store" of known good MCP integrations from well known companies, and avoid using anything else without proper review?

Re: The Agent2Agent Protocol (A2A)

#100

Post by delusional »

ziddoap wrote: post #65
AndrewKemendo wrote: post #30

These protocols are to put handlers between you and your own data so they can sell it back to you via “search.” Companies who are betting their future on LLMs realized a few years ago that the data they can legally use is the only long term difference between them, aka “moat.” Now that everyone has more or less the same public data access, and a thin compute moat is still there, the goal is to transfer your private t…

> so they can sell it back to you via “search.” > transfer your private textual data to them Who is "they" (or "them") in these sentences? It's an open protocol with 50 partner companies, which can be used with AI agents from ~anyone on ~any framework. Presumably you can use this protocol in an air-gapped network, if you'd like. Which one of the 50 partner companies is taking my data and building the moat? Why would…

I think the point the above poster is trying to make is that the point here is that they don't want to share the data. Instead google (and atlassian/SAP/whoever) would like to make an "open" but limiting interface mediated through their agents, such that you can never get actual access to the data, but only what they decide you get to have.

To put it bluntly, the point of creating the open interface at this level, is that you get to close off everything else.

Post reply on HN