//1 Liner: Agents are going multiplayer. We read the A2A protocol (agent-to-agent communication, Google then Linux Foundation) as the anchor, with two shipping examples (@Claude in Slack, Paradigm's open-source Centaur). The real question: when agents go multiplayer, who owns the agent, what can it access, and can it go multiplayer ACROSS organizations? Two regimes split the room: trusted settings (inside or between known companies, shipping now) and trustless open markets (cross-org, crypto-native, still early). [a2a-protocol.org]
//UPDATES (June 2026): A2A: Google Apr 2025, donated to the Linux Foundation Jun 2025, spec v1.0 in 2026 (three transports, signed Agent Cards, multi-tenancy). MCP (Anthropic, Nov 2024) is the tool-layer standard. Claude Managed Agents Apr 2026, Claude Tag Jun 2026, Centaur (Paradigm) May 2026. Payment rails (x402, ACP, AP2, MPP) are mostly shipped; agent identity (ERC-8004 still Draft, Microsoft Entra Agent ID in preview) is not. Net read: rails are ready, trust is not.
//So What: (i) Interop is becoming a standard, not a feature. A2A makes an agent a first-class peer to discover, authenticate, and delegate to, not a wrapped "tool." It is the missing layer above MCP. (ii) Today's "multiplayer" means many humans share one agent inside a trust boundary (Claude Tag, Centaur), not agents negotiating across orgs. Knowing which a vendor means changes the risk picture. (iii) The blocker for true cross-org markets is no longer payments. It is identity, reputation, and liability. Whoever solves trust, not transport, unlocks the open market.
//Key Innovation: A2A standardizes only the wire between agents. An agent publishes an Agent Card (a JSON "business card" at a well-known URL) listing its endpoint, skills, and required auth. A client reads the card, opens a stateful Task, and exchanges Messages over standard transports, getting streamed updates and Artifacts back. The remote agent's memory, tools, and reasoning stay opaque. A2A is the horizontal axis (agent to agent); MCP is the vertical axis (agent to its own tools). They compose. See Section 1.
//Stakeholders + Incentives: (i) Google + Linux Foundation: a vendor-neutral interop standard so no single cloud owns the agent network (Apache 2.0; AWS, Cisco, Microsoft, Salesforce, SAP, ServiceNow on board). (ii) Anthropic: owns the tool standard (MCP) and ships the trusted-setting agent (Claude Tag); notably no A2A, coordination stays in one trust boundary. (iii) OpenAI: MCP plus AGENTS.md plus ACP (commerce); no stated A2A position. (iv) Paradigm + Tempo: self-hosted agent infra (Centaur) plus a machine-payments protocol (MPP). (v) Microsoft / Coinbase + Ethereum Foundation: racing to own agent identity, Entra Agent ID for the enterprise (trusted), ERC-8004 for cross-org (trustless).
//Context/Background: An agent is a model plus tools plus skills plus credentials plus an environment plus memory. Individual agents are good; collaboration is the missing piece. MCP (Anthropic, 2024) solved agent-to-tool. A2A (Google, 2025) targets agent-to-agent: how one agent finds, authenticates, and delegates to another. Open debate worth airing: do we need a new protocol, or is one agent with good MCP servers enough? A2A adoption has lagged MCP. The counter: the moment work crosses an org boundary, "just call its API" is exactly the N-by-N integration problem A2A exists to kill.
//Core Trade-offs: (i) Trustless vs trusted: open markets push trust OUT into protocols and cryptoeconomic guarantees; trusted settings assume the parties trust each other and harden the agent-to-credential boundary instead. (ii) Visible vs private: public execution (Claude Tag's live checklist) gives auditability and is what makes it multiplayer, but the task is not confidential and a connected tool's reach is shared channel-wide. (iii) Vendor-hosted vs self-hosted: Anthropic's sandbox is zero-ops but your repos, logs, and policy leave your boundary; Centaur on your own Kubernetes keeps them in at the cost of running it. (iv) Agent holds keys vs credential isolation: Centaur never lets the agent see a secret (a firewall injects credentials in-flight), so a prompt-injection compromise cannot exfiltrate them.
//Deep Dives:
//Section 1: A2A protocol, how it works Open standard for agents to discover, authenticate, and delegate work to each other across frameworks and vendors. Google announced it Apr 2025 with 50+ partners, then donated it to the Linux Foundation Jun 2025 (Apache 2.0). Stable spec v1.0 (2026): three transports, signed Agent Cards, multi-tenancy.
Core objects: Agent Card (JSON at https://{domain}/.well-known/agent-card.json: identity, endpoint, skills, security schemes; signed in v1.0). A2A Client (acts for the user, initiates contact). A2A Server / remote agent (opaque HTTP endpoint; tools and reasoning never exposed). Task (stateful: submitted, working, input/auth-required, then a terminal completed/failed/canceled/rejected; immutable once terminal). Message / Part / Artifact (a turn / a content piece / a concrete output). Transports: JSON-RPC 2.0, gRPC, or HTTP+JSON, all over HTTPS; updates via polling, SSE streaming, or push webhook. Discovery: well-known URL, registry, or direct config. Security: OAuth 2.0, OpenID Connect, API keys, or mTLS, declared in the Agent Card.
flowchart LR
Client["CLIENT AGENT<br/>(A2A Client, acts for the user)"]
Card["Agent Card<br/>/.well-known/agent-card.json<br/>endpoint, skills, auth"]
subgraph Remote["REMOTE AGENT (A2A Server, opaque)"]
Task["TASK<br/>submitted, working,<br/>input/auth-required, completed"]
Tools["Tools / Data"]
Task -->|MCP| Tools
end
Hook["Client Webhook"]
Client -->|"1. GET agent-card.json (discovery)"| Card
Card -->|"2. endpoint, skills, auth schemes"| Client
Client -->|"3. send Message (JSON-RPC/HTTPS + creds), creates Task"| Task
Task -->|"5. SSE status updates"| Client
Task -->|"6. Artifacts on completion"| Client
Task -->|"7. push notification (async)"| Hook
A2A = the wire BETWEEN agents. MCP = the wire from each agent DOWN to its tools. (Editable source: diagrams/a2a-flow.mmd, diagrams/a2a-flow.excalidraw.) Canonical framing: A2A is the shop manager talking to other agents; MCP is each mechanic using its tools. You use both.
//Section 2: Trusted settings (shipping now) Both examples mean the same thing by "multiplayer": many humans share ONE persistent agent. Neither is agents-across-orgs. Claude Tag (@Claude in Slack), Anthropic, Jun 2026 (beta, Opus 4.8): one shared agent identity per channel; anyone can tag it and steer a running session. Runs in an Anthropic-hosted sandbox, NOT your infra. An org Owner sets it up and connects tools via service-account credentials (Access bundles, spend limit). It acts under its own identity, not the tagger's; execution is public to the channel. Drawbacks: Owner-gated setup; public execution means the task is not confidential and a connected tool's reach is shared with the whole channel. Centaur (Paradigm + Tempo), open-sourced May 2026, Apache-2.0 OR MIT: a self-hosted runtime for multiplayer, secure agents, in Slack or via API. Runs on your own Kubernetes, so repos, logs, and secrets stay inside your boundary. The agent never holds secrets: an isolated secrets manager plus a network firewall (iron-proxy) inject credentials in-flight, so a compromised or prompt-injected agent cannot exfiltrate them. No MCP, no A2A, no TEE. Same shape (shared agent, in Slack, human-visible, credential-conscious), opposite hosting choice. This is the centaur approach (our framing, not Paradigm's): a human and an AI as one unit, human in the loop by visibility and interrupt-to-steer.
//Section 3: Trustless open markets (still missing) Payments (mostly shipped): x402 (Coinbase, HTTP 402 + USDC), ACP (OpenAI + Stripe, agent checkout), AP2 (Google, signed Intent/Cart Mandates, extends A2A and MCP), MPP (Tempo + Stripe, rail-agnostic HTTP 402). Caveat: "ACP" is three protocols (Agentic Commerce by OpenAI+Stripe; Agent Communication by IBM, folding into A2A; Agent Client by Zed); we mean the commerce one. Identity and reputation (not shipped): ERC-8004 "Trustless Agents" (on-chain identity/reputation/validation registries, extends A2A) is a Draft EIP; Microsoft Entra Agent ID is in preview. The real bottleneck: identity, reputation, and liability, not transport. If a stranger's agent transacts with yours and gets it wrong, who is accountable? No mature answer yet.
//Discussion (to drive the room): Who owns the agent (sets up its skills)? Who manages it (vendor-hosted or self-hosted)? How easy to switch? Does everyone see its work, or only the operator? Where does execution happen? How are agents discovered and (eventually) traded? Is infra the bottleneck? And looking out: local vs cloud agents; the blur between humans, workflows, skills, and services; RL loops where the agent's environment learns your expertise; what is a good benchmark? The bet: trusted settings ship first (Claude Tag, Centaur, Entra), trustless markets follow once identity and reputation catch up to the payment rails. Pick your quadrant.
//Sources: A2A what-is-a2a · spec · vs MCP · LF. Claude Tag docs · news. Managed Agents docs. Centaur post · repo. Rails x402 · ACP · AP2 · MPP · ERC-8004 · Entra ID.