MCP vs A2A: the difference, with a working architecture

MCP connects an agent to its tools. A2A connects applications and other agents to an agent. They sit on opposite sides of the same process, so a production agent usually speaks both.

How do they compare?

	MCP	A2A
Direction	Agent calls out	Caller calls in
Callee	A tool	An autonomous agent
Discovery	Tool list	Agent card
Typical call	Read a CRM record	Ask the research agent for an analysis

How does serving over A2A look?

With the Cortex SDK, host.New builds the server and Handler() exposes POST /a2a (JSON-RPC) and GET /.well-known/agent.json:

h, err := host.New(ctx, host.Config{
	Agent:    host.Agent{Name: "hello"},
	Provider: provider,
	Token:    "tok",
})

A caller gets text with client.Say, or typed output with client.Ask[T], which sends a schema reflected from T and decodes the answer.

How do tools arrive through MCP?

Tools are named <server>__<tool>. Per-turn mcpHeaders reach the MCP call and never the model, which keeps a user's token out of the prompt.

What are the security differences?

A2A is a normal authenticated API: bearer token or JWT, and the card stays public. MCP is the riskier side, because a server's descriptions and schemas reach the model. Grant servers per agent, and remember that a stdio server inherits the process environment in Cortex.

How does it scale?

Turns run in process by default. With connectors/cluster, they go through a NATS JetStream work queue, and a per-conversation lock keeps each conversation's turns in order.