A2A SDK Checks Reveal Seven Adoption Risks

A2A, a protocol for delegating work between agents and tracking its progress, became a hosted project of the Agentic AI Foundation (AAIF) on August 17, 2026. In an earlier test, researchers checked servers built with official SDKs against 12 criteria and compared them with MCP and plain HTTP. A2A provides mechanisms to track task progress and cancel tasks, but it increased response bytes and latency; only 5 of the 12 checks behaved as specified. The SDK’s default setup did not check authentication declared in an agent card.

Google announced in June 2025, two months after A2A was made public, that it would transfer stewardship to the Linux Foundation; AAIF took it on in August 2026. At the time of writing, the foundation classified A2A at the Growth stage, below the Impact stage. The foundation said A2A was being used in production in supply chains, finance and mobile platforms, and that more than 150 organizations were participating. The author said moving stewardship to a neutral foundation can reduce the risk that one company’s strategy change halts maintenance or revisions. The repository address also changed from google/A2A to a2aproject/A2A.

Founded in December 2025, AAIF had six projects under its stewardship at the time of writing, after approving Agent Router the day after A2A joined. The foundation’s portfolio of tool-calling specifications, project rules files, infrastructure and agent tools gained a protocol for handing work between agents. The author distinguishes between specification documents, which can become standards when multiple organizations follow them, and products that demonstrate whether the standards are used in practice. Starting with Claude Code v2.1.277, the software reads AGENTS.md when CLAUDE.md is absent; when configured, it reads both files. Foundation governance and neutrality do not guarantee that individual SDKs follow the specification.

A2A lets an agent find another agent, delegate work, track progress and cancel tasks. Other projects provide authentication checks, request routing and logging, and tool calls by the agent doing the work. An agent receiving a task through A2A can call tools through MCP; the delegating side cannot see which tools it used internally. In a Kubernetes service, setting appProtocol: agentgateway.dev/a2a routes A2A traffic through agentgateway. The gateway replaces the agent card’s address with its own and records the called method, result and JSON-RPC error code in access logs. Unsupported methods can return a JSON-RPC error inside an HTTP 200 response, so monitoring that checks only HTTP status codes may count them as successful even though the gateway logs an error.

Servers supporting both versions can list v0.3 and v1.0 addresses in an agent card. However, agentgateway rewrites only the v1.0 address to its gateway address and leaves the v0.3 address pointing to the backend. The test found that v0.3 clients could therefore bypass the gateway and request the backend directly. In addition, agentgateway v1.5.0 has no authorization for A2A requests. Authentication verifies a caller’s identity; authorization determines whether the caller may use a particular method or skill. MCP has a mechanism for applying rules to tool names and arguments, but A2A does not yet, leaving requests observable but not controlled by that mechanism. Authentication and authorization must be handled by the application or another layer.

Goose, an agent project, was one of three projects donated to AAIF at its founding in December 2025 alongside MCP and AGENTS.md. On April 7, 2026, its repository moved from Block’s organization to aaif-goose/goose. At the time of writing, it had more than 54,500 stars, and its latest version was v1.51.0, released on September 17, 2026. It offers more than 70 MCP-connected extensions and reads AGENTS.md first as a context file. The author said A2A would become a practical protocol if agents such as Goose offered a built-in way to find other organizations’ agents through their cards and delegate work to them; such a tool was not yet visible at the time.

The author lists seven checks before adoption. First, an SDK’s default setup does not enforce authentication even when an agent card declares an authentication method, so the application or a front-end layer must enforce it. Second, while the specification says extended agent cards should be available only to authenticated requests, the default SDK does not verify identity; anyone who knows the address could retrieve one, so it should contain only information safe to make public. Third, omitting the A2A-Version header results in v0.3 handling without an error. Fourth, teams should verify an agent card’s interface list with actual calls rather than trust it as written. Fifth, canceling a completed task can return the server’s internal error code -32603 instead of the specification’s code -32002; handle this separately to avoid mistaking it for a server failure and retrying. Sixth, push n

A2A, a protocol for delegating work between agents and tracking its progress, became a hosted project of the Agentic AI Foundation (AAIF) on August 17, 2026. In an earlier test, researchers checked servers built with official SDKs against 12 criteria and compared them with MCP and plain HTTP. A2A provides mechanisms to track task progress and cancel tasks, but it increased response bytes and latency; only 5 of the 12 checks behaved as specified. The SDK’s default setup did not check authentication declared in an agent card.

Google announced in June 2025, two months after A2A was made public, that it would transfer stewardship to the Linux Foundation; AAIF took it on in August 2026. At the time of writing, the foundation classified A2A at the Growth stage, below the Impact stage. The foundation said A2A was being used in production in supply chains, finance and mobile platforms, and that more than 150 organizations were participating. The author said moving stewardship to a neutral foundation can reduce the risk that one company’s strategy change halts maintenance or revisions. The repository address also changed from google/A2A to a2aproject/A2A.

Founded in December 2025, AAIF had six projects under its stewardship at the time of writing, after approving Agent Router the day after A2A joined. The foundation’s portfolio of tool-calling specifications, project rules files, infrastructure and agent tools gained a protocol for handing work between agents. The author distinguishes between specification documents, which can become standards when multiple organizations follow them, and products that demonstrate whether the standards are used in practice. Starting with Claude Code v2.1.277, the software reads AGENTS.md when CLAUDE.md is absent; when configured, it reads both files. Foundation governance and neutrality do not guarantee that individual SDKs follow the specification.

A2A lets an agent find another agent, delegate work, track progress and cancel tasks. Other projects provide authentication checks, request routing and logging, and tool calls by the agent doing the work. An agent receiving a task through A2A can call tools through MCP; the delegating side cannot see which tools it used internally. In a Kubernetes service, setting appProtocol: agentgateway.dev/a2a routes A2A traffic through agentgateway. The gateway replaces the agent card’s address with its own and records the called method, result and JSON-RPC error code in access logs. Unsupported methods can return a JSON-RPC error inside an HTTP 200 response, so monitoring that checks only HTTP status codes may count them as successful even though the gateway logs an error.

Servers supporting both versions can list v0.3 and v1.0 addresses in an agent card. However, agentgateway rewrites only the v1.0 address to its gateway address and leaves the v0.3 address pointing to the backend. The test found that v0.3 clients could therefore bypass the gateway and request the backend directly. In addition, agentgateway v1.5.0 has no authorization for A2A requests. Authentication verifies a caller’s identity; authorization determines whether the caller may use a particular method or skill. MCP has a mechanism for applying rules to tool names and arguments, but A2A does not yet, leaving requests observable but not controlled by that mechanism. Authentication and authorization must be handled by the application or another layer.

Goose, an agent project, was one of three projects donated to AAIF at its founding in December 2025 alongside MCP and AGENTS.md. On April 7, 2026, its repository moved from Block’s organization to aaif-goose/goose. At the time of writing, it had more than 54,500 stars, and its latest version was v1.51.0, released on September 17, 2026. It offers more than 70 MCP-connected extensions and reads AGENTS.md first as a context file. The author said A2A would become a practical protocol if agents such as Goose offered a built-in way to find other organizations’ agents through their cards and delegate work to them; such a tool was not yet visible at the time.

The author lists seven checks before adoption. First, an SDK’s default setup does not enforce authentication even when an agent card declares an authentication method, so the application or a front-end layer must enforce it. Second, while the specification says extended agent cards should be available only to authenticated requests, the default SDK does not verify identity; anyone who knows the address could retrieve one, so it should contain only information safe to make public. Third, omitting the A2A-Version header results in v0.3 handling without an error. Fourth, teams should verify an agent card’s interface list with actual calls rather than trust it as written. Fifth, canceling a completed task can return the server’s internal error code -32603 instead of the specification’s code -32002; handle this separately to avoid mistaking it for a server failure and retrying. Sixth, push n