Future Horizons

The Agent Protocol Wars: MCP, A2A, and the Plumbing of the Agentic Web

MCP went stateless in July 2026, ChatGPT Atlas shut in August, and the agent payment rails are still being laid one country at a time. The protocol fight under the agentic web, with dates and adoption numbers.

Gabriele Masetti · 2026-09-04

Why the plumbing decides the winners

Every computing platform war has eventually been settled below the application layer. Email won because SMTP was open enough for anyone to run a mail server. The web won because HTTP and HTML let any publisher reach any browser without asking permission. RSS lost most of its ground once platforms found it cheaper to keep readers inside a walled feed than to let them subscribe out. The pattern repeats: whoever controls the wire format between systems controls how much value gets captured downstream, regardless of whose model is smartest that quarter.

The same fight is now running through AI agents, and by mid-2026 it has produced a recognizable stack: a protocol for connecting a model to tools and data (Anthropic's Model Context Protocol), a protocol for agents to talk to other agents (Google's Agent2Agent), a scramble of protocols for agents to pay for things (Visa, Mastercard, Stripe/OpenAI, Google), early work on proving which agent is acting on whose behalf (Okta, Auth0), and a browser layer racing to become the client all of this runs inside.

None of it is settled. Nearly all of it is being built as open specifications donated to neutral foundations rather than kept as vendor lock-in — a strategic choice each company is making for reasons worth examining, not because anyone suddenly turned altruistic.

MCP: the protocol Anthropic gave away

Anthropic open-sourced the Model Context Protocol on November 25, 2024, describing it as a way to connect AI assistants to "the systems where data lives" — content repositories, business tools, developer environments — without every application writing a custom integration for every data source. The architecture is simple enough to explain in a paragraph: an MCP host (say, Claude Desktop or an IDE) runs an MCP client, which speaks to one or more MCP servers over stdio or streamable HTTP.

Each server exposes three primitives — tools (executable functions with typed JSON Schema arguments), resources (read-only data identified by URI, such as file contents or query results), and prompts (reusable instruction templates). Anthropic shipped reference servers for Google Drive, Slack, GitHub, Git, Postgres, and Puppeteer on day one.

What happened next is the part that matters for a platform-war argument: MCP's own creator lost control of who adopted it. In March 2025, OpenAI added MCP support across its Agents SDK, Responses API, and ChatGPT desktop app, with Sam Altman posting that "people love MCP and we are excited to add support across our products" — a direct competitor endorsing a rival's protocol rather than shipping its own.

In April 2025, Google DeepMind CEO Demis Hassabis confirmed Gemini and its SDK would add MCP support, calling it "rapidly becoming an open standard for the AI agentic era." Microsoft moved on multiple fronts across 2025: MCP support in Copilot Studio shipped in March 2025 and reached general availability in May 2025, and at Ignite in mid-November 2025 Microsoft announced native, public-preview MCP support in Windows itself, including built-in agent connectors for File Explorer and Windows Settings and an on-device registry for managing which MCP servers a machine trusts.

By December 9, 2025, MCP had outgrown single-vendor stewardship. Anthropic donated the protocol to a newly formed Linux Foundation project, the Agentic AI Foundation (AAIF), co-founded with Block and OpenAI and backed by supporting members including Google, Microsoft, AWS, Cloudflare, and Bloomberg. Anthropic's own numbers at the time of the donation: more than 10,000 active public MCP servers, over 97 million monthly SDK downloads across Python and TypeScript, and MCP wired into ChatGPT, Gemini, Microsoft Copilot, Cursor, and VS Code.

Block's agent framework goose and OpenAI's AGENTS.md joined MCP as the foundation's other founding projects — a signal that the industry wanted at least the connective tissue of the agentic web to sit outside any single company's roadmap, echoing the logic Google applied when it handed Kubernetes to the Cloud Native Computing Foundation in 2016.

Seven months after the donation the specification took its largest break so far. The 2026-07-28 revision, published on 28 July 2026 and superseding 2025-11-25, made MCP stateless: the initialize/notifications/initialized handshake is gone, the Mcp-Session-Id header is gone from the Streamable HTTP transport, and each request now carries its own protocol version and client capabilities in _meta. Servers must implement a server/discover RPC advertising their versions, capabilities and identity. Tools, resources and prompts survived unchanged; Roots, Sampling and Logging were deprecated under a new twelve-month removal window, and Tasks moved out of the core into an official extension.

The new release is MCP's most important since remote MCP first launched over a year ago. It is a leap in serving scalable MCP servers and takes all the lessons learned over the last 18 months to provide a robust foundation for MCP's future. — David Soria Parra, Member of Technical Staff, Co-Inventor of MCP

The effect is infrastructural rather than semantic. Cloudflare's write-up of the revision notes that a server which previously needed sticky sessions, draining on deploy and session migration during autoscaling can now run as a plain stateless HTTP workload — on Workers, without Durable Objects. A protocol under foundation governance moved in the direction that makes it cheap for anyone to host rather than the one that makes a single vendor's runtime necessary. Adoption kept pace: at the July release the project reported close to half a billion downloads a month across its Tier 1 SDKs, with the TypeScript and Python SDKs each past a billion total.

A2A: teaching agents to talk to each other

MCP solves agent-to-tool communication. It says nothing about how one autonomous agent discovers, trusts, or delegates work to a different autonomous agent built by someone else — the gap Google's Agent2Agent (A2A) protocol was built to close. Google announced A2A on April 9, 2025, alongside more than 50 launch partners spanning software vendors (Atlassian, Box, Cohere, Intuit, LangChain, MongoDB, PayPal, Salesforce, SAP, ServiceNow, UKG, Workday) and systems integrators (Accenture, BCG, Capgemini, Cognizant, Deloitte, HCLTech, Infosys, KPMG, McKinsey, PwC, TCS, Wipro).

Structurally, A2A defines two things. An Agent Card is a JSON document, conventionally served at a /.well-known/agent.json endpoint, that advertises an agent's name, version, skills, and supported authentication schemes — a business card a client agent can fetch before deciding whether to hand off work. A Task is the unit of work itself: it carries a unique ID and moves through a defined lifecycle (submitted, working, input-required, completed, failed, canceled), with progress streamed back via server-sent events and final outputs returned as "artifacts."

Google released the spec under Apache 2.0 and, on June 23, 2025, donated A2A to the Linux Foundation for neutral governance — a faster path to foundation stewardship than MCP took, though both ended up under the Linux Foundation within about eight months of their respective launches.

Google and Anthropic both describe the relationship between the two protocols as complementary rather than competitive: MCP is how an agent reaches into a database or calls a function; A2A is how one agent finds and negotiates with another agent that might be running on a completely different vendor's stack. Google's own AP2 payments protocol, discussed below, is explicitly built as an extension layered on top of both.

The payment rails being built under agents

If agents are going to transact — book the flight, buy the ticket, restock the pantry — someone has to define how money moves when the party initiating the purchase isn't a human clicking "buy." Four card networks and platforms moved on this within roughly a year of each other.

Visa launched Intelligent Commerce in 2025, letting a user tokenize card credentials into an AI agent via Visa payment passkeys with spending limits attached, then followed in October 2025 with the Trusted Agent Protocol, an open framework built with more than ten partners to help merchants distinguish legitimate purchasing agents from bots at checkout.

Mastercard's Agent Pay framework, dating to April 2025, issues "Agentic Tokens" through its Digital Enablement Service so a verified agent can spend on a consumer's behalf; in June 2026 Mastercard extended this with Agent Pay for Machines, aimed at machine-to-machine transactions and sub-cent microtransactions across cards, bank accounts, and stablecoins, with more than 30 partners including Stripe, Coinbase, and Cloudflare building on it.

OpenAI and Stripe took a different entry point: commerce inside the chat interface itself. Their jointly built Agentic Commerce Protocol (ACP), released under Apache 2.0 on September 29, 2025, defines the contract between a buyer, an agent acting for them, a merchant, and a payment provider, and shipped alongside Instant Checkout in ChatGPT — initially for US Etsy sellers, with Shopify merchants following. PayPal joined ACP as a payment provider on October 28, 2025.

Google's entry, the Agent Payments Protocol (AP2), announced September 16, 2025 with more than 60 payment and technology partners (PayPal, Mastercard, American Express, Adyen, Coinbase, Salesforce, ServiceNow, Worldpay, JCB, UnionPay among them), works as a cryptographically signed "permission slip" a human grants an agent before it can spend, explicitly designed to sit on top of A2A and MCP rather than replace either.

At Google I/O 2026, Google paired an AP2 update — version 0.2.0, adding "Human Not Present" payments for scenarios like autonomously grabbing limited-release tickets the instant they go on sale — with a new Universal Cart experience and an expanding Universal Commerce Protocol (UCP), letting a shopping cart persist across Search, Gemini, YouTube, and Gmail, with checkout support rolling into Canada and Australia and the UK to follow later in 2026.

Identity: proving the agent is who it claims to be

None of the above works if a merchant, a bank, or a second agent can't tell a legitimate purchasing agent from an impersonator, or a company can't tell which of its thousands of autonomous processes is acting with which permissions. Identity vendors moved into this gap through 2025.

Okta introduced Okta for AI Agents in September 2025, treating agents as first-class, governable identities alongside human and service accounts, with a companion open protocol called Cross App Access (XAA) meant to standardize how an agent authenticates into a third-party application without the user re-entering credentials at every hop.

Auth0's parallel "Auth for GenAI" work added a Token Vault that manages OAuth 2.0 tokens for agents connecting to services like Gmail and Slack, handling refresh and scope exchange so a developer isn't storing long-lived credentials inside an agent's runtime. The pattern across both is the same: least-privilege, time-boxed, cryptographically attested access for a non-human actor, a materially different problem than logging in a person.

Adjacent to identity sits a quieter debate over how a website should present itself to an agent in the first place. Microsoft's NLWeb, announced at Build in May 2025 and built with Anthropic's involvement, turns any website's endpoint into an MCP server that answers natural-language queries directly, effectively letting a site opt into being talked to rather than merely crawled.

The competing, much lighter-weight idea — llms.txt, a plain markdown file a site publishes to summarize itself for crawlers, proposed by Jeremy Howard in September 2024 — has not caught on with model providers: more than 784 sites have implemented it, but as of mid-2026 no major provider has committed to reading it, and Google has publicly compared it to the discredited keywords meta tag.

The inherited vulnerability

Opening a standardized channel between a language model and arbitrary external tools reintroduces an old problem in a new shape: prompt injection. Security researchers at Invariant Labs disclosed in 2025 what they termed Tool Poisoning Attacks — an MCP server can embed hidden instructions inside a tool's own description field, text a model reads as trusted metadata during tool selection, and a sufficiently capable model will silently follow those embedded instructions, potentially exfiltrating files or leaking secrets from an unrelated, legitimate tool call the user actually approved.

The same research described related failure modes: "shadowing," where a malicious server's tool descriptions can override or reinterpret how a trusted server's tools behave, and "MCP rug pulls," where a server changes its tool definitions after a user has already approved them. Invariant subsequently released MCP-Scan, a static analysis tool that inspects a client's configured servers and tool metadata for injection risk before anything executes; separate research from CyberArk extended the concern to tool outputs, not just descriptions, arguing that any text an MCP server returns is a potential injection vector once it re-enters the model's context.

The structural point is that MCP, A2A, and the commerce protocols all route more decision-making authority through model-interpreted text, and none of them eliminate the fact that a language model cannot fully distinguish an instruction from its principal versus an instruction smuggled in by a third party.

The browser front, and what's still unsettled

The interface fight is happening in parallel with the protocol fight, because whoever runs the client that holds a user's session, credentials, and payment tokens has leverage over every protocol underneath it. Perplexity's Comet browser went to limited release on July 9, 2025 for $200-a-month Max subscribers before Perplexity opened it to everyone worldwide for free that October.

OpenAI answered with ChatGPT Atlas, a macOS-first browser launched October 21, 2025 with an early "Agent Mode" for bounded autonomous actions — then retired it less than ten months later. OpenAI confirmed on July 9, 2026 that Atlas would be sunset, and the browser stopped working on August 9, 2026. Its agentic browsing went into the ChatGPT Chrome extension and into the single desktop application OpenAI had said in March 2026 would merge Atlas, the ChatGPT desktop app and Codex — part of a broader push by OpenAI's applications lead Fidji Simo to cut standalone side projects.

Google took the opposite bet — extend the incumbent rather than launch a challenger — announcing Chrome Auto Browse on January 29, 2026, a Gemini 3-powered feature that scrolls, clicks, and fills forms across multi-step tasks with user approval required at sensitive steps, alongside saveable "Chrome Skills" workflows and enterprise data-loss-prevention controls.

What remains genuinely open, with 2026 nearly gone: discovery (no registry yet functions the way DNS or an app store does for finding trustworthy agents, and Google, OpenAI, Stripe, and independent marketplaces on Replit, Vercel, and Cloudflare are each building their own catalog rather than converging on one); trust and liability (when an autonomously purchasing agent buys the wrong thing or gets tricked by a poisoned tool description, which party in the Visa/Mastercard/Stripe/Google payment chain absorbs the loss is still being negotiated contract by contract rather than settled by protocol); and who, if anyone, ends up owning the equivalent of an app store for agents rather than a fragmented set of vendor-specific marketplaces.

Google's Universal Commerce Protocol shows how slowly the commerce half travels. When Google announced the Universal Cart on 20 May 2026, UCP-powered checkout was live with US retailers including Nike, Sephora, Target, Ulta Beauty, Walmart and Wayfair, with Canada and Australia promised "in the coming months" and the UK after that. Four months on, Google has published no UK date. A wire format can be donated to a foundation in an afternoon; a payment rail has to clear one country's rules at a time.