A2A and MCP: Multi-Agent Protocol Federation

┌────────────────────────────────────────────────────────┐
│                   ENTERPRISE HOST                      │
│   Primary Agent (Claude / Codex CLI / Gemini)          │
└──────────────────────────┬─────────────────────────────┘
                           │
            A2A Protocol Negotiation (Intent / Auth / SLA)
                           │
                           ▼
┌────────────────────────────────────────────────────────┐
│                   VENDOR AGENT CLUSTER                 │
│   Specialized Subagent (e.g. Security Audit Agent)     │
└──────────────────────────┬─────────────────────────────┘
                           │
              MCP Transports (stdio / SSE / mTLS)
                           │
       ┌───────────────────┼───────────────────┐
       ▼                   ▼                   ▼
┌──────────────┐    ┌──────────────┐    ┌──────────────┐
│  MCP Server  │    │  MCP Server  │    │  MCP Server  │
│  PostgreSQL  │    │  Git / CI    │    │  AWS Auditor │
└──────────────┘    └──────────────┘    └──────────────┘

{
  "a2a_version": "1.0",
  "task_id": "task_98412_audit_sec",
  "sender_agent_did": "did:web:internal.acme.corp:agent:ops-lead",
  "recipient_agent_did": "did:web:vendor.security-audit.io:agent:inspector",
  "intent": {
    "action": "security_audit_repository",
    "parameters": {
      "repo_url": "https://github.com/acme-corp/payment-service",
      "target_commit": "e814bf9"
    }
  },
  "delegated_mcp_capabilities": {
    "endpoint": "https://mcp-gateway.internal.acme.corp/sse",
    "session_token": "mcp_jwt_scoped_read_only_849201",
    "allowed_tools": [
      "github_get_file_contents",
      "github_list_commits",
      "sentry_query_issues"
    ],
    "max_tool_invocations": 25
  },
  "sla": {
    "timeout_seconds": 120,
    "budget_usd": 1.50
  }
}

// a2a_mcp_bridge.ts
import { Client } from "@modelcontextprotocol/sdk/client/index.js";
import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";

export async function connectDelegatedMcp(a2aEnvelope: any) {
  const { endpoint, session_token, allowed_tools } = a2aEnvelope.delegated_mcp_capabilities;

  const transport = new SSEClientTransport(new URL(endpoint), {
    headers: {
      Authorization: `Bearer ${session_token}`
    }
  });

  const client = new Client({
    name: "A2A-Vendor-Worker",
    version: "1.0.0"
  }, {
    capabilities: {}
  });

  await client.connect(transport);

  // Discover and filter tools based on A2A SLA contract
  const allTools = await client.listTools();
  const authorizedTools = allTools.tools.filter(t => allowed_tools.includes(t.name));

  console.log(`✅ A2A Agent connected to delegated MCP gateway with ${authorizedTools.length} tools.`);
  return { client, authorizedTools };
}