AI agent interoperability standards in 2026: MCP, A2A, WebMCP and what changed

Agent interoperability in 2026 runs on two open standards. The Model Context Protocol (MCP) connects an agent to tools and data. Agent2Agent (A2A) connects one agent to another. Both now share one neutral home, the Agentic AI Foundation under the Linux Foundation, and both shipped a new spec this year. Around them sit WebMCP for the browser, AGNTCY for discovery and identity, and three commerce protocols for agents that pay.

I run Gravity, an agent platform in public beta. Agents on it call tools, so these protocols decide what an agent can reach. I track MCP and A2A adoption every day in our MCP and A2A adoption census, and I read the specs, changelogs and release notes on the dates given below. Everything here is as of 9 October 2026.

The short version. MCP wins on usage by a mile: its SDKs pull 92.2 million downloads a week, against 4.5 million for A2A, per the census. A2A grows faster from a smaller base. Most teams need MCP now, and A2A only when their agent must hand work to an agent they don't run.

Key takeaways

• MCP connects agents to tools. A2A connects agents to agents.
• The MCP 2026-07-28 spec made the core stateless, so any server instance can answer any request.
• A2A reached v1.0 on 12 March 2026 and joined the Agentic AI Foundation on 27 August 2026.
• MCP SDKs out-download A2A SDKs 21 to 1, and the official MCP Registry lists 40,965 servers.
• WebMCP is in a Chrome origin trial on a draft spec that sits off the W3C Standards Track.
• "Supports MCP" is half an answer. Ask every vendor for a spec version and a transport.

What changed in agent interoperability in 2026

A year ago MCP still belonged to Anthropic, and A2A had no stable spec. Here is what happened since, oldest first.

Read the right-hand column top to bottom. The two flagship protocols grew up, moved in together and broke a few things on the way.

The map: two layers plus the edges

Interoperability happens on two layers. Agent to tool: an agent calls an API, a database or a function. Agent to agent: an agent hands a task to another agent, often one someone else built. MCP owns the first layer, A2A the second, and the rest sit at the edges. New to tool calls? Start with how agents use tools.

Model Context Protocol (MCP), the agent-to-tool standard

Anthropic introduced and open-sourced MCP on 25 November 2024. An MCP server exposes tools, each with a name, a description and a schema, and the agent's client calls them. AI agent vs MCP server draws the line between the two. The dated spec versions so far: 2025-03-26, 2025-06-18, 2025-11-25 and 2026-07-28.

What the 2026-07-28 spec changed

The Register called it the "biggest overhaul since launch". Per the changelog:

• Stateless core. No initialize handshake, no Mcp-Session-Id header. Each request carries its protocol version and client capabilities in _meta, and a server that needs state mints an explicit handle passed as a tool argument. Any instance can answer any request, so plain round-robin load balancing works.
• Multi Round-Trip Requests. Servers return an InputRequiredResult, and the client retries with the answers. Held-open streams for elicitation, sampling and roots are out.
• Routing headers. Streamable HTTP POSTs carry Mcp-Method and Mcp-Name, so gateways can route on them.
• Caching. List results carry ttlMs and cacheScope.
• Auth. RFC 9207 issuer validation. Dynamic Client Registration is deprecated in favour of Client ID Metadata Documents (DCR still works).
• Extensions. Tasks moved into an official extension, next to MCP Apps (server-shipped HTML in a sandboxed iframe) and Enterprise Managed Authorization.
• Deprecations. Roots, Sampling, Logging and the old HTTP+SSE transport. A twelve-month minimum window means nothing goes before 28 July 2027 (AAIF).

The Tier 1 SDKs (TypeScript, Python, Go and C#) supported it on release day, per the MCP blog, with Rust in beta. Homebrew implementations face what The Register called a slog. Fair word.

How big MCP is in October 2026

Big. The official MCP Registry lists 40,965 servers as of 9 October 2026, up 11,089 (37%) in 30 days, per the census. Of those, 63% are remote endpoints, and 504 are marked deprecated. The registry launched in preview on 8 September 2025 and took until January 2026 to pass 1,500. September 2026 alone added 11,902, more than its first nine months combined (10,298).

In the week to 8 October 2026, the TypeScript SDK pulled 31.3 million npm downloads (up 334% year on year) and the Python SDK 60.9 million on PyPI (up 472%). In December 2025 Anthropic counted 97 million-plus a month. Now it's 92.2 million a week. The maintainers put all Tier 1 SDKs at "close to half-a-billion downloads a month".

There's one caveat. Downloads count CI runs and dependency installs, so they measure how deeply the SDKs are built into software. They don't count people. The other signals agree anyway: 34,043 public GitHub repos carry the mcp-server tag, and 22 of the 23 AI vendors the census tracks have a dated MCP announcement. DeepSeek is the exception.

Who governs MCP now

The AAIF does, since 9 December 2025. Anthropic, Block and OpenAI co-founded it. As of 9 October 2026 it hosts six projects, A2A among them, and its platinum members are AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft and OpenAI. The practical payoff is the feature lifecycle policy: a public twelve-month window before anything deprecated can be removed.

Agent2Agent (A2A), the agent-to-agent standard

MCP gives an agent tools. A2A gives it colleagues. Google announced A2A on 9 April 2025 with 50+ partners, and the Linux Foundation took it in on 23 June 2025 with AWS, Cisco, Google, Microsoft, Salesforce, SAP and ServiceNow. Use it when work crosses a boundary, say a sales agent passing a deal to another company's finance agent. The patterns are in multi-agent systems explained.

From v0.3 to a stable v1.0

v0.3 shipped on 30 July 2025 (GitHub release) with gRPC and, per Google, signed agent cards. v1.0.0 followed on 12 March 2026, then v1.0.1 on 28 May. The Linux Foundation calls v1.0 "its first stable specification". It added multi-protocol support, enterprise multi-tenancy, modernized security flows, Signed Agent Cards and a migration path.

That path matters. Agents built on v0.3 have to migrate, and registries keep both alive for now: Google Cloud's Agent Registry accepts the 1.0 schema, with its supportedInterfaces list, next to the 0.3 one. More on that stack in my Gemini agent analysis.

Reading a real Agent Card

A client discovers an agent by fetching /.well-known/agent-card.json (v1.0.0 spec). This one is trimmed from the sample in the v1.0 specification:

{
  "name": "GeoSpatial Route Planner Agent",
  "description": "Provides advanced route planning, traffic analysis, and custom map generation services.",
  "supportedInterfaces": [
    {"url": "https://georoute-agent.example.com/a2a/v1", "protocolBinding": "JSONRPC", "protocolVersion": "1.0"},
    {"url": "https://georoute-agent.example.com/a2a/grpc", "protocolBinding": "GRPC", "protocolVersion": "1.0"},
    {"url": "https://georoute-agent.example.com/a2a/json", "protocolBinding": "HTTP+JSON", "protocolVersion": "1.0"}
  ],
  "provider": {"organization": "Example Geo Services Inc.", "url": "https://www.examplegeoservices.com"},
  "version": "1.2.0",
  "capabilities": {"streaming": true, "pushNotifications": true, "extendedAgentCard": true},
  "securitySchemes": {
    "google": {"openIdConnectSecurityScheme": {"openIdConnectUrl": "https://accounts.google.com/.well-known/openid-configuration"}}
  },
  "security": [{"google": ["openid", "profile", "email"]}],
  "defaultInputModes": ["application/json", "text/plain"],
  "defaultOutputModes": ["application/json", "image/png"],
  "skills": [
    {"id": "route-optimizer-traffic", "name": "Traffic-Aware Route Optimizer", "tags": ["maps", "routing", "traffic"]}
  ]
}

supportedInterfaces gives one URL per binding (JSON-RPC, gRPC, HTTP+JSON), each with its protocolVersion. capabilities says the agent streams and pushes notifications, and extendedAgentCard means an authenticated client can fetch a fuller card. securitySchemes and security say how to authenticate, here with OpenID Connect. skills is what a coordinating agent reads before it delegates.

Adoption, honestly measured

Start with the Linux Foundation's one-year claims. Supporters grew "from more than 50 to over 150", the core repo passed 22,000 stars, and SDKs are production-ready in five languages.

The census measures use. A2A SDKs pull 4.5 million downloads a week to MCP's 92.2 million, so 21 to 1. The A2A Python SDK is up 1,308% year on year, faster than either MCP SDK. GitHub has 593 repos tagged a2a-protocol (1,998 tagged a2a) against 34,043 tagged mcp-server. Of 23 tracked vendors, 8 ship A2A, all alongside MCP. Anthropic, OpenAI, Mistral and xAI have no A2A announcement the census could find.

Stars run the other way: 26,078 on A2A's spec repo, 9,411 on MCP's. Stars measure attention. Downloads measure use.

A2A's road from Google to the AAIF

On 29 August 2025, per the census timeline, IBM Research's Agent Communication Protocol (ACP) merged into A2A under LF AI & Data. On 27 August 2026, A2A was "accepted as a Growth Stage project" at the AAIF, next to MCP. The announcement counts over 150 backing organizations and names clouds (Google Cloud, AWS, Microsoft Azure), SaaS vendors from ServiceNow to SAP, and frameworks such as LangGraph and CrewAI. Google created A2A. It no longer steers it alone.

MCP vs A2A: which do you need?

They do different jobs. Read this as a scope check.

• Use MCP alone when one agent, or a few you control, needs tools and data. That's the common case.
• Add A2A when your agent must hand work to an agent another team or vendor runs. AI agent orchestration explained covers the coordinator side.
• You need neither when a webhook, a scheduled sync or a plain API call does the job. These integration patterns compare them.

For the longer rivalry, IBM's ACP included, read the protocol wars post.

WebMCP, making websites callable

WebMCP, a proposed web standard, lets a website expose structured tools to agents in the browser, so an agent calls a function where it used to guess which button to click. Declarative: annotate a standard HTML form. Imperative: define tools in JavaScript. The draft spec puts registerTool(), getTools() and executeTool() on a ModelContext interface.

Same idea as MCP, different place. MCP servers run on a backend. WebMCP tools run in the page the visitor already has open, with that visitor's session.

Status: a Draft Community Group Report dated 8 October 2026, which says "It is not a W3C Standard nor is it on the W3C Standards Track." Its editors come from Microsoft and Google. Chrome runs the origin trial from Chrome 149, and Chrome's docs put both APIs behind the tools permissions policy. They call it "primarily designed for local browser workflows with a human in the loop".

Site owners: test it, but hold off on building around it. The cheaper step today is the llms.txt generator, which checks your robots.txt against 14 AI crawlers.

AGNTCY, discovery and identity underneath

AGNTCY is the plumbing under multi-agent systems. Cisco open-sourced it in March 2025, with LangChain and Galileo, and it became a Linux Foundation project on 29 July 2025 with Cisco, Dell Technologies, Google Cloud, Oracle and Red Hat. Its parts: discovery through the Open Agent Schema Framework (OASF), cryptographically verifiable identity, messaging over SLIM, and observability.

It complements both flagship protocols. Its directories list A2A agents and MCP servers, and SLIM can carry their messages; a library in the AGNTCY GitHub org, slim-a2a-go, runs A2A over SLIM. As of 9 October 2026 it stays a separate Linux Foundation project. Read its specs if you run many agents across teams.

The commerce layer: AP2, ACP and UCP

Three protocols cover agents that buy:

• AP2 (Agent Payments Protocol). Google, 17 September 2025, for "agent-led payments across platforms". Backed by 60+ organizations including Adyen, American Express, Mastercard and PayPal, and usable as an extension of A2A and MCP.
• ACP (Agentic Commerce Protocol). Stripe and OpenAI, 29 September 2025, a "merchant-friendly open standard" that launched with Instant Checkout in ChatGPT.
• UCP (Universal Commerce Protocol). Google, 11 January 2026, covering "the entire shopping journey". Co-developed with Shopify, Etsy, Wayfair, Target and Walmart, with 20+ endorsers including Stripe and Visa. ucp.dev lists AP2, A2A and MCP support built in.

Backers overlap. Stripe co-developed ACP and endorses UCP, and Adyen, American Express and Mastercard back both AP2 and UCP. None of the three is an AAIF project as of 9 October 2026, though the AAIF lists an Agentic Commerce working group.

Where fragmentation still bites

Convergence is the headline. Five problems remain:

1. Both flagship specs asked for migrations within five months. A2A v1.0 landed in March, MCP 2026-07-28 in July. Any SDK or homebrew server can sit on either side of either line.
2. "Supports MCP" is ambiguous. It can mean 2025-11-25 or 2026-07-28, stdio or remote (63% of registry servers are remote).
3. Names collide. There are two ACPs. WebMCP shares MCP's tool model but acts with the visitor's own browser session.
4. The attack surface grows. Every reachable tool can be misused, and MCP Apps now render server HTML inside the host. Read the incidents I log and these security practices before granting write access.
5. Commerce overlaps. AP2, ACP and UCP all target agent purchases, and a merchant may need more than one.

What to ask a vendor in October 2026

Seven questions, each with what a good answer sounds like:

1. Which MCP spec version do you support? A dated string, 2025-11-25 or 2026-07-28, and a move date if it's the older one. "The latest" doesn't count.
2. Are your MCP servers local, remote or both? The transport by name, who hosts it, and sign-in through Client ID Metadata Documents with RFC 9207 validation.
3. Which deprecated features do you still use? A list (Roots, Sampling, Logging, HTTP+SSE) and a plan that lands before 28 July 2027.
4. Can I see your Agent Card? A working /.well-known/agent-card.json URL with v1.0 interfaces, or a dated upgrade plan.
5. Can I bring my own MCP servers and call outside agents? Yes, demonstrated with ones you pick. That's the exit test; platforms with no vendor lock-in goes deeper.
6. How are tool permissions scoped and logged? Per-tool scopes, human approval for anything that writes, spends or sends, and a call log you can export.
7. If agents pay, which commerce protocol? AP2, ACP or UCP by name, with a reason.

Then ask yourself whether you need an agent protocol at all. For fixed trigger-and-action jobs, the automation platform picker ranks Zapier, Make, n8n and 13 others.

The bottom line

MCP gives an agent tools. A2A gives it colleagues. Both now sit in one foundation with final specs from this year, and MCP leads on usage 21 to 1.

Gravity is in public beta and its agents call tools, so every changelog here lands on my desk too. The vendor questions above are ones I expect to answer myself.

The protocols are settled enough to bet on. The versions aren't settled enough to assume. Pin the version. Check the transport. Read the card.

Frequently asked questions

What are AI agent interoperability standards?

They are open protocols that let AI agents connect to tools, websites and other agents without custom code for each pairing. The two main ones in 2026 are the Model Context Protocol (MCP), for agent-to-tool connections, and Agent2Agent (A2A), for agent-to-agent delegation. WebMCP, AGNTCY and the commerce protocols AP2, ACP and UCP cover the browser, discovery and identity, and payments.

What is the difference between MCP and A2A?

MCP connects one agent to tools, APIs and data, where each tool has a name, a description and a schema. A2A lets one agent delegate work to another agent, which it discovers through an Agent Card at /.well-known/agent-card.json. As of 9 October 2026, MCP SDKs out-download A2A SDKs 21 to 1. Many systems run MCP alone and add A2A only when agents from different teams or vendors must work together.

Is A2A still Google's protocol?

Google created A2A and announced it in April 2025. It became a Linux Foundation project in June 2025, and on 27 August 2026 it was accepted as a Growth Stage project at the Agentic AI Foundation, alongside MCP. Its first stable spec, v1.0, shipped on 12 March 2026. Google is now one of more than 150 backing organizations, and governance sits with the foundation.

What changed in MCP in 2026?

The 2026-07-28 spec, final on 28 July 2026, made the core stateless: no initialize handshake, no Mcp-Session-Id header, and any server instance can answer any request. Servers that need input from the client now return an InputRequiredResult, and the client retries with the answers. Tasks, MCP Apps and Enterprise Managed Authorization became official extensions. Roots, Sampling, Logging and the old HTTP+SSE transport are deprecated, with removal no earlier than 28 July 2027.

What is WebMCP, and can I use it today?

WebMCP is a proposed web standard that lets a website expose structured tools to AI agents in the browser, declared on HTML forms or defined in JavaScript. You can test it in Chrome through an origin trial that starts with Chrome 149. The spec is a Draft Community Group Report dated 8 October 2026, and it is neither a W3C Standard nor on the W3C Standards Track. Chrome describes it as designed primarily for local browser workflows with a human in the loop.

How many MCP servers are there?

The official MCP Registry listed 40,965 servers on 9 October 2026, up 37% in 30 days, according to our daily MCP and A2A adoption census. Counts depend on who counts and what qualifies: in December 2025 Anthropic reported more than 10,000 active public MCP servers, which is a different measure from registry listings. About 63% of today's registry entries are remote endpoints, and 504 are marked deprecated.

Do I need A2A if I already use MCP?

Not at first, in most cases. If your agents only call tools and data you control, MCP covers the job. Add A2A when your agent has to hand work to an agent another team or vendor builds and runs, discovered through its Agent Card. Check versions on both sides, because agents built on A2A v0.3 need a migration to talk v1.0.

Sources

• Gravity: MCP and A2A adoption census (updated daily; figures as of 9 October 2026)
• Gravity: AI agent incidents database
• Anthropic: Introducing the Model Context Protocol (25 November 2024)
• Anthropic: Donating the Model Context Protocol and establishing the Agentic AI Foundation (9 December 2025)
• GitHub: modelcontextprotocol/modelcontextprotocol releases (checked 9 October 2026)
• Model Context Protocol Blog: the 2026-07-28 specification release (28 July 2026)
• Model Context Protocol: Specification 2026-07-28 changelog (28 July 2026)
• Agentic AI Foundation: MCP 2026-07-28, What's Changing and How to Migrate (21 July 2026)
• The Register: Model Context Protocol prepares to break with its stateful past (23 July 2026)
• Agentic AI Foundation: Projects (checked 9 October 2026)
• Agentic AI Foundation: Members (checked 9 October 2026)
• Agentic AI Foundation: home page and working groups (checked 9 October 2026)
• Linux Foundation: Linux Foundation launches the Agent2Agent Protocol Project (23 June 2025)
• GitHub: a2aproject/A2A releases (checked 9 October 2026)
• Linux Foundation: A2A protocol surpasses 150 organizations and lands in major cloud platforms in its first year (9 April 2026)
• A2A Project: A new chapter for A2A, joining the Agentic AI Foundation (27 August 2026)
• A2A Project: Agent2Agent protocol specification v1.0.0 (12 March 2026)
• Google Cloud: Gemini Enterprise Agent Platform release notes, Agent Registry GA (18 June 2026)
• W3C Web Machine Learning Community Group: WebMCP, Draft Community Group Report (8 October 2026)
• Chrome for Developers: WebMCP origin trial (9 June 2026)
• Chrome for Developers: WebMCP documentation (published 18 May 2026, updated 7 October 2026)
• Linux Foundation: Linux Foundation welcomes the AGNTCY project (29 July 2025)
• GitHub: agntcy/oasf releases, v1.1.0 (10 July 2026)
• GitHub: AGNTCY organization (checked 9 October 2026)
• Google Cloud: Announcing the Agent Payments Protocol (AP2) (17 September 2025)
• Stripe: Stripe powers Instant Checkout in ChatGPT and releases Agentic Commerce Protocol codeveloped with OpenAI (29 September 2025)
• Google: New tech and tools for retailers to succeed in an agentic shopping era (11 January 2026)
• Universal Commerce Protocol: ucp.dev (checked 9 October 2026)