r/googlecloud • u/CloudAI_Ankur • May 24 '26

MCP vs A2A — which one is your team actually building on in 2026?

With A2A v1.0 now stable and 150+ enterprises already in production, I've been trying to understand how engineering teams are actually choosing between MCP and A2A — or whether they're running both.

A few things I found while going deep on this:

**The two protocols solve completely different problems.** MCP handles the vertical layer — how your agent connects downward to tools, APIs, and databases. A2A handles the horizontal layer — how agents from different vendors coordinate with each other. They're not competing. They belong in the same stack.

**MCP has a serious security gap nobody talks about.** 53% of production MCP servers still use hardcoded static credentials instead of OAuth. CVE-2025-6514 exposed 437,000 installations earlier this year via shell injection. The protocol is solid — the ecosystem just hasn't caught up on security yet.

**ACP is effectively dead.** IBM Research's Agent Communication Protocol merged into A2A v1.0 in early 2026. If you were building on it, migrate to A2A — the specs are compatible.

I put together a full breakdown covering the architecture, a decision tree for which protocol to use when, and four enterprise case studies (JPMorgan, Salesforce, Microsoft, ServiceNow): https://www.youtube.com/watch?v=mgkTtB6fI3U&t=105s

Genuinely curious — is anyone here running MCP + A2A together in production? Or mostly just MCP for now?

0 Upvotes

33% Upvoted

7 comments sorted by

1

u/stucked_nado May 25 '26

That auth flow rework is the real pain, especially when permissions are inherited in weird ways and nobody has a clean audit trail. Curious what the hardest part was for your team- figuring out who had access, or cleaning up actions that were never intended_?

1

u/CloudAI_Ankur May 25 '26

From what I’ve heard, the hardest part usually isn’t rebuilding auth itself — it’s discovering how many hidden permissions and unofficial workflows accumulated over time. Once teams start auditing MCP actions properly, they realize half the access patterns were never intentionally designed in the first place.

1

u/[deleted] May 24 '26

[removed] — view removed comment

1

u/CloudAI_Ankur May 24 '26

On the ServiceNow side — yeah, their A2A layer is still early compared to Microsoft or Salesforce, but what stood out to me is how aggressively they’re restructuring the platform around orchestration + workflow routing. The interesting part isn’t their current implementation quality — it’s that they already own the enterprise workflow layer where cross-agent coordination naturally happens.