MCP and A2A — One Year Under the Linux Foundation

The two protocols that matter most to agentic systems in 2026 no longer belong to the vendors that created them. The Model Context Protocol, originally announced by Anthropic in November 2024, was donated by Anthropic in December 2025 to the newly-formed Agentic AI Foundation, a Linux Foundation directed fund co-founded with Block and OpenAI. The Agent-to-Agent protocol, announced by Google at Cloud Next in April 2025, was donated to the Linux Foundation in June 2025. One year on, the substrate of agentic AI is governed neutrally. This is the most consequential structural change in the category since the protocols themselves shipped.

This piece is a reading of what the move means. The technical content of the protocols is well-documented elsewhere; we have written about MCP and A2A specifications themselves in earlier issues. What we want to do here is sit with the governance question. What does it mean that two of the largest model labs in the world chose to give away the protocols that connect their products to everyone else’s? What changes about the architectural conversation when the standards body is neutral and the participants are competitors? What does the next year look like?

The bare facts

Before reading the politics, the facts.

Event	Date	What happened
MCP announced	November 2024	Anthropic publishes the spec and reference SDKs
OpenAI adopts MCP	March 2025	Agents SDK, Responses API, and ChatGPT desktop ship MCP support
A2A announced	April 9, 2025	Google introduces the protocol at Cloud Next, releases under Apache 2.0
A2A donated to LF	June 2025	Google contributes the protocol to the Linux Foundation
AAIF founded	December 2025	Linux Foundation creates the Agentic AI Foundation; Anthropic donates MCP
Google adds MCP	Q1 2026	Gemini API and Vertex AI Agent Builder ship MCP support
MCP SDK downloads	March 2026	97 million monthly, roughly 970x growth over 18 months
A2A v1.0	2026	Released with Signed Agent Cards; AP2 payments extension ships

The founding members of the Agentic AI Foundation are Anthropic, Block, and OpenAI as co-founders, with supporting participation from Google, Microsoft, AWS, Cloudflare, and Bloomberg. Production A2A deployments are now documented at Microsoft, AWS, Salesforce, SAP, and ServiceNow; the launch supporters list at announcement also included Atlassian, Box, Cohere, Intuit, LangChain, MongoDB, PayPal, Salesforce, SAP, ServiceNow, and Workday.

The IDE-side adoption tells a parallel story. MCP now ships natively in Claude, ChatGPT, Gemini, Cursor, Windsurf, Zed, JetBrains AI Assistant, the Vercel AI SDK, and the OpenAI Agents SDK. The phrase “MCP-native” has become baseline rather than differentiator.

Why this is architecturally interesting

The architectural reading is straightforward. MCP and A2A are, between them, the two halves of what an agentic substrate has to do. MCP is the agent-to-tool path: a single agent reaches out to files, APIs, databases, and model context. A2A is the agent-to-agent path: multiple agents discover each other, exchange tasks, and stream partial results across organizational boundaries. The architectural diagram of an agentic system in 2026 is, increasingly, a small triangle: model on one side, MCP on a second, A2A on the third.

The interesting property of having both protocols under one foundation is that the boundary between them stops being a vendor question and becomes a spec question. Before AAIF, the question “is this thing I am calling a tool or an agent” had at least four different vendor answers, all of which were politically loaded. After AAIF, the question is a working-group problem with a single set of stewards, which is the right shape for it to take.

The line between MCP and A2A is, today, still being negotiated. A long-running MCP server starts to behave like an agent. A narrow A2A agent starts to behave like a tool. The Linux Foundation’s stewardship lets that negotiation happen in a place where no single vendor is paying for the chairs. That is what neutral governance is for.

Two design patterns we expect to consolidate in 2026, now that the political layer is settled:

A2A-on-MCP layering. Several public proposals describe A2A as a particular kind of MCP server with additional lifecycle and discovery semantics. This is, in our reading, the architecturally cleanest outcome. MCP stays narrow and durable. A2A becomes a higher-layer protocol whose transport is MCP and whose extensions cover the streaming, cancellation, and identity semantics that statelessness cannot support.
Signed identity primitives migrating downward. Signed Agent Cards, introduced in A2A v1.0, are the first credible identity primitive in either protocol. The architectural pressure to push them into MCP — so that a tool server can verify the agent calling it — is going to grow. We expect a formal proposal in this direction within twelve months.

Why this is politically interesting

The political reading is the more important one. The story most people will tell themselves about this moment is “Anthropic and Google did something generous, isn’t that nice.” That story is wrong in a specific way and the wrongness is informative.

Companies do not donate the protocols that connect their products to the rest of the world out of charity. They do it because the alternative — letting a competitor own the substrate — is strategically worse than letting nobody own it. The Linux Foundation pattern is precisely the pattern of competitors voluntarily disarming on a specific layer of the stack because they each calculate that they win more by competing in the layers above than they would by trying to dominate the substrate.

We have seen this exact move before. The textbook example is Kubernetes. Google’s container-orchestration stack was donated to the Cloud Native Computing Foundation in 2015 for the same reason: Google could not afford to let Amazon or Microsoft become the proprietary owner of container orchestration, and a neutral substrate was a better outcome for Google than a substrate owned by anyone else. The CNCF outcome is now the standard model: competing vendors share a base, compete in differentiated offerings, and the customer wins by not having to pick a master. AAIF is the agentic-AI version of the same move.

The interesting thing about AAIF, relative to CNCF, is the speed. CNCF took several years to consolidate around Kubernetes. AAIF arrived with two protocols already at scale and two of the largest model vendors as co-founders. The agentic field has compressed the timeline of every previous infrastructure category, and AAIF is the most visible artifact of that compression.

The corollary is that the protocols are now harder to fork. A vendor that wanted to build a closed alternative to MCP in 2025 had to argue with one company. A vendor that wants to do the same in 2026 has to argue with a foundation backed by Anthropic, OpenAI, Block, Google, Microsoft, AWS, and Cloudflare. The political moat is now larger than the technical moat. This is how standards become permanent.

What is actually unresolved

The settled-substrate framing should not be confused with a solved-substrate claim. Several questions are still open, and the working groups are going to spend most of 2026 on them.

Identity, beyond Signed Agent Cards. Signed Agent Cards are a meaningful first step toward agent identity, but the spec leaves several adjacent problems open. Key rotation, revocation lists, agent reputation, and the question of how a tool server should react when an agent presents a card whose signing chain has changed are all currently underspecified. Identity is the problem that determines whether agentic systems are deployable in regulated environments, and the working group’s posture on it will determine when enterprise adoption is real versus aspirational.

Tool sprawl and trust. Ninety-seven million monthly MCP SDK downloads is a number that hides a real quality problem. There is no central trust registry comparable to npm or PyPI; server quality varies enormously, and the security posture of a randomly-chosen MCP server is, in 2026, an open question. The closest thing to a trust signal is “shipped by the host vendor as a default integration,” which is a low bar.

Auth that is not bearer-token paste. Most current agents still authenticate to tools by passing a bearer token through the protocol, which works but is not what you would design if you were starting fresh. The protocol gap is a real OAuth/OIDC flow scoped per-tool with the host as the policy-decision point. The working group is aware. The work has not, to our reading, shipped.

The MCP/A2A boundary. As above. The protocols overlap and the working groups have not yet committed to a long-term architectural relationship. We expect a formal layering proposal in 2026. We do not have a strong prediction about whose proposal wins.

Cost accounting. Neither protocol has a native cost primitive. The calling host accounts for costs by tracking what it knows about, which works for first-party tools and breaks for third-party agents. We have written about this before. The need for a cost primitive grows the more A2A deployments mature.

Implementation notes

The practical reading, for someone shipping an agentic product in mid-2026:

Implement MCP for tools. The protocol is small, the host coverage is good, and the abstraction is durable. There is no remaining reason to ship a vendor-specific tool-calling layer in a new product. If you are still doing this, you have an architecture problem.
Implement A2A for agent-to-agent. If your product talks to other agents, A2A is the right wire. The 150-plus organizations supporting it as of May 2026 make it the only credible choice for cross-vendor agent interop.
Treat the substrate as substrate. MCP and A2A are infrastructure now, not differentiation. Your moat has to live above them — in the product surface, the workflow shape, the customer relationship, the audit and identity layer, the workforce metaphor your operator buys into. Founders who are still pitching “our better tool protocol” are pitching against a Linux Foundation governance structure, which is a hard pitch.
Track the working groups. The most consequential architectural decisions of the next twelve months are being made in AAIF working materials. The decisions arrive in your roadmap several months after they are made in the working group. The lag is shorter than it sounds.

Web4OS positions itself as a participant in this open substrate rather than a closed alternative — its CEO/specialist topology sits on MCP for tools and is moving toward A2A for cross-team agent exchange. Whether the bundled-product abstraction holds in production at scale remains to be tested. The substrate underneath it is no longer in question.

What we are watching

The Review is following AAIF working materials across 2026. The questions we will be writing about, in order of likely consequence:

The identity layer beyond Signed Agent Cards. Specifically, the proposals on key rotation, revocation, and the host’s role as policy-decision point.
The MCP/A2A layering proposal. Whichever architectural commitment wins here will shape the agentic substrate for the rest of the decade.
A trust registry for MCP servers. This is the gap that, until closed, makes “97 million monthly downloads” a smaller signal than it sounds.
The audit extension. Enterprise adopters are asking for it. Working-group materials suggest it is being scoped. We expect a draft in 2026.
AP2 in production. The Agent Payments Protocol, as a formal A2A extension, lets agents settle payments without humans in the loop. The first production AP2 deployments are the leading indicator for whether agentic systems can be trusted with money. They will not all go well.

The bottom line

The protocols that connect agents to tools and agents to other agents are now governed by a neutral standards body backed by the labs that built them. This is the most important architectural fact about agentic AI in 2026, and it is the most underdiscussed. The product layer will keep generating headlines. The working-group materials will keep producing the decisions that actually shape the field.

The interesting thing about a settled substrate is not that the substrate is settled. It is that the conversation moves up the stack. Identity, audit, workforce surfaces, pricing, governance — the layers above MCP and A2A — are now where the architectural fights live. The Review will be reading the working-group materials, the founder pitch decks, and the production deployments in parallel across the rest of 2026, and reporting back when the lines move. Most of the lines are going to move.

For readers who want to follow the publication’s editor on the standards side, Andrew Rollins’ analysis of the same shifts on LinkedIn is the shortest path to the working-group reading we are doing here.