A2A and MCP: The Open Protocol Stack Powering theMulti-Agent SOC

An alert fires at 2am. A Triage Agent inside Splunk enriches it in seconds. Then the workflow stops. Somebody has to open a second device to set off the response. Somebody has to open a 3rd to create the ticket. The agent did its job completely, and the SOC nonetheless waited on a human to stroll the output from one system to the following.

That handoff drawback isn’t a Splunk drawback. It’s each vendor’s drawback proper now, and it’s the purpose Agent2Agent, or A2A, issues greater than any single agent announcement.

Splunk’s new brokers Triage, Detection Builder, SOP, Guided Response, Automation Builder, Malware Menace Reversing every do one job properly. The fascinating query isn’t what any one in all them does alone. It’s what occurs when brokers constructed by totally different groups, on totally different platforms, can hand work to one another straight. That’s what A2A is for. And it’s value being direct about the place issues stand: A2A-mediated handoffs between manufacturing safety brokers should not delivery anyplace but. What follows is the conceptual structure, and why it’s value placing the constructing blocks in place now.

Two protocols, not one

A2A doesn’t work alone. It sits alongside MCP, the Mannequin Context Protocol, and the 2 resolve totally different issues.

MCP connects an agent to its knowledge and instruments. Splunk’s MCP Server, typically obtainable since February 2026, offers any MCP-compatible agent a ruled method to run searches, pull asset context, and floor enrichment knowledge from Splunk, no customized integration required.

A2A connects brokers to one another, throughout vendor and platform boundaries. The place MCP is vertical agent to knowledge. A2A is horizontal agent to agent. A manufacturing multi-agent SOC wants each. Triage occurs in a single context, containment in one other, ticketing in a 3rd. An agent that may solely full its personal step after which await a human to restart the following one has compressed the duty, not the workflow. A2A is the protocol constructed to make the total workflow transfer with out that wait.

Use MCP when an agent wants to succeed in into Splunk’s knowledge. Use A2A when one agent wants at hand work to a different.

This isn’t SOAR by one other identify. SOAR orchestrates mounted playbooks by way of integrations constructed one vendor at a time, and the logic lives centrally, within the SOAR platform. A2A is peer-to-peer: any A2A agent can uncover and name every other A2A agent by way of a self-published Agent Card, no customized connector required, and the receiving agent applies its personal reasoning moderately than following a static script. The 2 should not in competitors. A2A is how autonomous brokers from totally different distributors determine what to do and hand work to one another; SOAR stays a pure place for the ensuing actions to execute.

How A2A works

A2A runs on HTTP, Server-Despatched Occasions, and JSON-RPC 2.0 current net requirements, chosen intentionally so infrastructure groups can undertake it with out rearchitecting community controls.

1. Brokers publish an Agent Card. Each A2A-compliant agent exposes a JSON manifest at a well known URL (/.well-known/agent-card.json) describing what it will possibly do, what inputs it takes, and what authentication it requires. A2A v1.0 added Signed Agent Playing cards, so a receiving agent can cryptographically confirm the cardboard really got here from the area that issued it the mechanism that stops a fraudulent agent from inserting itself right into a workflow.
2. A shopper agent delegates a Activity. Quick operations return a outcome instantly. Lengthy-running ones, a multi-stage investigation, a deep correlation throughout weeks of telemetry stream standing updates over SSE, by way of an outlined lifecycle: submitted, working, input-required, accomplished, failed, cancelled.
3. The distant agent returns an Artifact. The structured output textual content, knowledge, or recordsdata that the shopper agent routes ahead, acts on, or surfaces to an analyst.
4. Authentication rides on infrastructure you already govern. OAuth 2.0, API keys, mTLS, the identical schemes your API administration layer already enforces. A2A doesn’t require a parallel belief system.

What safety groups must construct now

Three issues intersect straight with controls your crew already owns, and they’re value beginning earlier than any agent on this stack reaches GA.

Agent identification is a PAM drawback. Which agent might name which different agent, beneath what circumstances, is a privileged entry administration query, not a brand new class. The advice could be to increase your current IAM governance, apply to service accounts to cowl agent identities.

Agent-to-agent site visitors is audit materials. Each activity delegation, supply, goal, content material, artifact, timestamp belongs in a sturdy log earlier than quantity makes retrofitting costly. The Splunk platform can ingest and index this knowledge immediately with no particular integration; that half is simple. Getting analyst-grade worth out of it inside Enterprise Safety — correlation searches, notable occasions, threat scoring is a separate step. It means mapping agent site visitors onto an current CIM knowledge mannequin or constructing a customized one, the identical onboarding work any new knowledge supply requires in ES.

Immediate injection is a typical assault sample and A2A doesn’t sanitize activity content material. If an agent processes attacker-controlled knowledge, a crafted log entry, a malicious filename and delegates a activity based mostly on it, the payload travels alongside. Enter validation is an application-layer accountability that must be designed in earlier than any agent delegates by way of A2A, not added after.

Last ideas

A2A is probably going the following step the place the agentic SOC must go subsequent. The only-purpose brokers are nice, one other dashboard is sweet however a protocol layer that lets each agent in an enterprise runs, no matter vendor, work as one system as an alternative of a shelf of disconnected level options. The primary era of agentic safety was about giving one device a mind. The following era is about giving the complete stack a nervous system and Safety leaders ought to proceed to observe the A2A protocol carefully because it matures.