Opening

DevFest Milano / 10 October 2026

Agents
Speak
Protocol

Why standards are the
real infrastructure of AI

CoverAn agent connects to models, tools, other agents, users, an IDE and context through separate boundaries.AGENTModelsToolsAgentsUsersIDEContext

Stefano Maestri & Alessio Soldano

Opening

We have worked on both sides of the boundary

The previous wave

Alessio
Soldano

Apache CXF / WS-*
RESTEasy / REST

Shared contracts

The current wave

Stefano
Maestri

A2A Technical Steering Committee
Linux Foundation

Independent agents

Our agents need to talk to other people's systems

History

Different decade, familiar integration problem

Networks

Connect
different systems

TCP/IP

Services

Agree on
an interface

WSDL + SOAP
REST APIs

Editors

Reuse
integrations

LSP

Agents

Meet the
same problems

Models / tools / peers

Move repeated decisions into a shared contract

History

A lens for this talk

The simplest protocol
that reduces the most
uncertainty wins

How many decisions disappear from the application?

The thesis

What can we replace without rewriting the agent?

ReplaceThe application and shared interface stay fixed while implementation A changes to implementation B.Your applicationIntegration staysShared contractBoundaryImplementation AReplaceable sideImplementation BSame interfaceKEEPKEEPSWAP

Keep the contract. Change the implementation

The map

Standards emerge at different boundaries

MapThree primary boundaries: models through Open Responses, capabilities through MCP, counterparts through A2A. Five additional boundaries: users, knowledge, operations, IDE, payments.ModelsOpen ResponsesCapabilitiesMCPCounterpartsA2AAGENTUsersAG-UI / A2UIKnowledgeFiles / Skills / PluginsOperationsOTel GenAIIDEACPPaymentsx402

What do you want to make replaceable?

Model boundary

One model contract, several providers

ModelsA shared model interface allows one agent integration to reach compatible providers and local models. Provider support must be checked.Your agentModel adapterOpen ResponsesShared interfaceProvider ACompatible subsetProvider BCompatible subsetLocal modelCompatible subset
Typed itemsSemantic streamingTool invocation

Open Responses ≈ POSIX for model APIs

Tools boundary

Every new tool multiplies the wiring

WiringThree applications and four capabilities: twelve pairwise integration surfaces compared with seven endpoints around a shared interface. This is an idealized count, not development cost.N × MN + MApp 1App 2App 3Tool 1Tool 2Tool 3Tool 43 × 4 = 12 integration surfacesMCPApp 1App 2App 3Tool 1Tool 2Tool 3Tool 43 + 4 = 7 protocol endpoints

A shared interface changes the shape of integration

Tools boundary

MCP gives capabilities a common interface

McpAn AI host owns model, policy and user experience. Its MCP client connects to a server that exposes primitives and adapts an existing domain API.HOST / AI APPLICATIONUser / policyModelMCP clientMCPMCP serverTools / resources / promptsDomain APILogs / deploys

Expose the capability once. Reuse the integration

JSON-RPC 2.0 / stdio or Streamable HTTP

Tools boundary

Three primitives, three control patterns

Tools

Act

Model typically selects

Read service errors
Resources

Know

Application supplies context

Service topology
Prompts

Start

User selects a template

Investigate an incident

The host retains policy and consent

Tools boundary

Each endpoint adds more possible connections

NetworkCompatible hosts share an MCP integration point. Adding another capability provider creates more possible connections without a bespoke adapter for each host.COMPATIBLE HOSTSCAPABILITY PROVIDERSMCPShared interfaceChat appIDE hostAgent runtimeRepositoryObservabilityOne more server

Ecosystem creates the network effect

From access to delegation

Same incident. A different request

“Read the latest
payment errors”

“Investigate the payment failure
and send me a diagnosis”

Who owns the work on the other side?

Agents boundary

A2A addresses an independent counterpart

A2AThe incident coordinator addresses a remote payments agent. An Agent Card describes the endpoint. Model, tools and memory remain internal to the payments team.Client agentIncident coordinatorA2APAYMENTS TEAM / OWN BOUNDARYRemote agentOwns the diagnosisAgent CardDiscoveryInternal implementationModel / tools / memory
Agent CardMessages / TasksArtifacts

Agree on the work. Keep internals private

Agents boundary

A task can outlive a single response

TaskIllustrative A2A task: submitted, working, input-required. The client supplies more input, the task resumes working and completes with a diagnosis artifact.submittedworkinginput-required“Correlation ID?”Client supplies inputcompletedDiagnosis + evidenceArtifact

Track work, exchange input, receive artifacts

Illustrative path / input-required is a pause, not completion

The architecture

Capability access + outcome delegation

TogetherThe incident coordinator accesses logs through MCP and delegates a diagnosis to a payments agent through A2A. The remote agent can use MCP for its own tools. Each integration crosses a different boundary.Incident agentYour applicationLogs / deploysMCP serverMCPA2APAYMENTS TEAMPayments agentOutcome: diagnosisPrivate model / context / strategyPayments toolsMCP

MCP Invoke a capability

A2A Delegate an outcome

Users boundary

Let the user follow and guide the work

UiAG-UI carries event and state exchange between agent backend and frontend. A conceptual incident panel gives the human a choice. A2UI describes components; MCP Apps supplies tool UI within a host. These are separate optional contracts.Agent runtimeWork in progressAG-UIFrontendEvents + stateINCIDENT PANELEvidence collectedNext action?Inspect recent deployAsk for more evidence

AG-UI
Events & shared state

A2UI
Declarative components

MCP Apps
Tool UI inside a host

Knowledge boundary

A shared meaning can fit in a file

.md

AGENTS.md

Project instructions

Convention
/

Agent Skills

SKILL.md + resources

Load detail when needed
{ }

Agent Plugins

Manifest + reusable parts

Package / check client support

Interoperability starts when implementations agree on meaning

Operations boundary

Follow one request across boundaries

TraceA conceptual trace groups model, tool and remote agent activity under one request. Services must be instrumented and propagate context; no duration is measured in this illustration.ONE REQUEST / CORRELATED CONTEXTIncident investigationModel callTool accessRemote delegationConceptual trace / no measured durations

OpenTelemetry GenAI semantic conventions

Propagate context / instrument each service / pin the convention version

IDE boundary

Change the coding agent, keep the editor

AcpAgent Client Protocol separates editor integration from coding agent implementation. Compatible agent A can change to agent B while the editor keeps the shared interface.Your editorDevelopment experienceACPAgent Client ProtocolCoding agent ACompatible implementationCoding agent BCompatible implementationKEEP THE CLIENTSWAP THE AGENT

Agent Client Protocol ≈ the LSP pattern

Sessions / progress / permissions / cancellation

Epilogue

The next boundary: money

402

Payment Required

A long-reserved HTTP status
gets a machine-readable payment contract

Paymentx402 conceptual sequence: client requests a resource, server returns 402 with terms, client authorizes and retries, server verifies and settles before delivery.Agent / clientRequest resource402 + termsPayment requirementsAuthorize + retrySigned payment payloadServer verifies & settles, then delivers the resource

x402 / request, terms, authorize, verify & settle, deliver

The bets

Adopt where replacement matters

Start from a need

MCP

Reusable tool integrations

A2A

Independent agent delegation

Evaluate the contract

Compatibility

Common subset
Extensions
Independent implementations

Keep the rest on your radar

One boundary
at a time

Introduce a standard when
the integration pain is real

Closing

We have seen this before

Replace what is
on the other side.
Keep your applicationAgent

That is when a protocol becomes infrastructure

Discussion

Grazie! Questions?

Which boundary
hurts in your system?

Stefano Maestri
maeste.it

Alessio Soldano
aladinodigitale.it

Sources & further reading

QR to maeste.it/speaking/agents-speak-protocol.html
Slides & feedback
maeste.it/speaking/
agents-speak-protocol.html
Appendix

Choose the interaction contract

Question MCP A2A
What does the caller need? Access to a capability Work from an independent counterpart
Main building blocks Tools, resources, prompts Agent Card, messages, tasks, artifacts
Does state decide the choice? No: implementations can keep state No: direct responses are possible
Can an agent sit behind it? Yes, exposed as a capability Yes, addressed as a remote agent
What must still be designed? Domain semantics, policy, errors Outcome, evidence, limits, trust

Choose by the contract needed by the caller

Appendix

A shared protocol still needs a trust model

Identity

Who is calling?

Authentication
Delegated identity

Authority

What is allowed?

Least privilege
Host policy / consent

Evidence

What can we trust?

Validate inputs and outputs
Assess the result

Discovery describes a peer. It does not establish trust

Appendix

Three UI contracts, different responsibilities

Contract What it standardizes What the client owns
AG-UI Agent/frontend event and state exchange Application experience and event handling
A2UI Declarative component and data descriptions Supported catalog and rendering
MCP Apps Interactive UI supplied by MCP tools UI hosting, isolation and permissions

Compose what you need. No mandatory full stack

Appendix

x402: authorization before settlement

Payment DetailIllustrative x402 V2 exact payment: request; 402 Payment-Required; authorize; retry with Payment-Signature; server verifies and settles, optionally using a facilitator; resource and Payment-Response.CLIENTSERVERFACILITATOR(optional)Request resource402 + PAYMENT-REQUIREDRetry + PAYMENT-SIGNATUREVerify / settleSettlement resultResource + PAYMENT-RESPONSESign authorization

V2 headers: PAYMENT-REQUIRED / PAYMENT-SIGNATURE / PAYMENT-RESPONSE

Appendix

Test replacement, not just protocol support

  1. Connect two independent implementations
  2. Exercise the common capability subset
  3. Check errors, permissions and lifecycle
  4. Identify private extensions and semantics
  5. Replace one side and measure what changes

Compatibility is something you demonstrate