MCP, A2A, AP2: The Agent Protocol Stack Quietly Shipped While Everyone Was Fighting About Benchmarks

# MCP, A2A, AP2: The Agent Protocol Stack Quietly Shipped While Everyone Was Fighting About Benchmarks

Something weird happened in the last three weeks. While the AI internet was busy arguing about whether DeepSeek V4 counts as "real" AGI and whether Apple vibe-coding is a scandal, the actual infrastructure for an autonomous agent economy just... showed up.

Not a whitepaper. Not a "we're exploring." Shipped code, donated to standards bodies, with major companies already using it internally.

Let me lay out what arrived.

The Stack Is Four Layers Deep Now

On April 17, Google Cloud published a gRPC transport for MCP — the Model Context Protocol that Anthropic open-sourced in late 2024 for AI-to-tool communication. This isn't a minor patch. gRPC gives MCP binary encoding (10x smaller than JSON), bidirectional streaming, and enterprise-grade mTLS. Spotify's already running it internally — Stefan Särne, their Staff Engineer for Developer Experience, went on record saying they're seeing "ease of use and familiarity" and "reducing the work needed to build MCP servers."

That's the tool use layer. But it gets better.

On April 28, Google donated the Agent Payments Protocol (AP2) to the FIDO Alliance. AP2 v0.2 introduced "Human Not Present" payments — agents autonomously executing transactions based on pre-authorized instructions. Buy concert tickets the second they drop. Reorder supplies when inventory dips below threshold. Mastercard co-developed a complementary standard called "Verifiable Intent" that creates a tamper-proof log of user-authorized agent actions.

That's the commerce layer. Google created it, then immediately gave it away to an independent standards body so it wouldn't look like a platform lock-in play.

Before that, Google published A2A — the communication layer for agent-to-agent discovery and messaging. And independently, the A2CN protocol launched in early April for agent-to-agent commercial negotiation — the negotiation layer.

Four layers, in production, inside of a month: tool use (MCP + gRPC), communication (A2A), negotiation (A2CN), payments (AP2 + Verifiable Intent).

Then the Government Showed Up

On May 1, CISA, the NSA, and Five Eyes intelligence partners from Australia, Canada, New Zealand, and the UK published joint guidance on secure AI agent deployment. This is the first time these agencies have treated AI agents as a distinct security surface requiring specific guidance — not just "AI safety" in the abstract, but concrete recommendations about cryptographic agent identity, short-lived credentials, and human-in-the-loop gating for high-impact actions.

The document identifies five risk categories (privilege escalation, design flaws, behavioral unpredictability, cascading structural failures, and audit accountability) and flat-out tells organizations to assume agents "may behave unexpectedly" and prioritize "resilience, reversibility and risk containment over efficiency gains."

That's the regulatory layer. And the timing isn't coincidental — the PocketOS incident on April 25, where a Cursor agent deleted a production database, made it clear that agent screw-ups have real-world consequences.

Why Nobody's Connecting the Dots

There's a pattern here that's easy to miss if you're staring at model leaderboards. The internet's original protocol stack — TCP/IP, HTTP, SMTP, SSL — wasn't built by a single company executing a master plan. It accreted. Different organizations solved adjacent problems, and the layers stacked because they had to.

The same thing is happening with agents right now, except compressed into months instead of decades.

MCP has ~25,000 servers in its ecosystem. Spotify and Google Cloud are running it in production. AP2 is now under FIDO Alliance governance, the same body that manages WebAuthn and passkeys. Mastercard — Mastercard — is co-developing agent payment standards. These aren't startups throwing things at the wall. These are the organizations that built the infrastructure the internet runs on.

The agent economy isn't a "what if." The plumbing is already laid. What's missing isn't protocols — it's the applications that sit on top of them.

The Real Question

Everyone's asking when we'll get AGI. The better question is: what happens when millions of autonomous agents — each with verified cryptographic identity, tool access via MCP, the ability to negotiate with other agents, and the capacity to spend money autonomously — are running on infrastructure we're building right now?

The stack is here. The agents are getting smarter by the month. The regulatory frameworks are taking shape.

The only thing left is for someone to build something genuinely dangerous on top of it. And if history's any guide, that'll happen about six months before anyone's ready for it.

Sources: Google AP2/FIDO announcement, Google Cloud gRPC for MCP, CISA/NSA guidance via CyberScoop, Anthropic April 23 postmortem, A2CN protocol