- Agent discovery
- Authentication
- sendMessage (request)
- sendMessageStream (streaming updates)
| Stage | Purpose | Typical endpoint / artifact |
|---|---|---|
| Agent discovery | Locate an agent and retrieve its capabilities and endpoints | GET /.well-known/agent-card (or registry/direct configuration) |
| Authentication | Obtain a token (e.g., OpenID Connect) for the agent’s security schema | Authorization server token endpoint → JWT |
| sendMessage | Submit a request to an agent (synchronous or async task creation) | POST /sendMessage with JWT |
| sendMessageStream | Receive streaming task lifecycle events and artifacts | POST /sendMessageStream with JWT (server-sent events or similar) |
Agent discovery
Discovery is the first step: the client finds an agent card that describes the agent’s capabilities, endpoints, and security schema. Discovery can happen in one of three ways:- Well-known URI: the client requests a predictable path on the agent or controller.
- Curated registry: a central catalog contains agent cards.
- Direct configuration: a client is given an agent card or endpoint manually.
- The agent’s name and description
- Endpoints (e.g.,
sendMessage,sendMessageStream) - Supported authentication schemes (e.g., OpenID Connect)
- Declared skills and tool metadata
Authentication
After parsing the agent card, the client inspects the security schema. If the agent uses OpenID Connect (or another OAuth2 flow), the client obtains an access token from the authorization server and presents that token to the agent. Typical flow:- Discover token endpoint from the agent card or identity provider metadata.
- Authenticate (client credentials / authorization code / other grant).
- Receive a JWT access token.
- Use the JWT in
Authorization: Bearer <token>when calling the agent.
Store and transmit JWTs securely. Always use TLS, implement short token lifetimes, validate audience/issuer claims, and follow least-privilege practices.
sendMessage (request)
With a valid JWT, the client calls the agent’ssendMessage endpoint to submit work. The agent processes the incoming message, creates a task, and returns a task response. The exact response depends on the agent implementation — it may return a synchronous result, a task identifier, or a simple acknowledgement indicating the task was queued.
Simple sequence:
- The message payload should match the agent’s expected schema (declared in the agent card).
- Responses vary: some agents do full synchronous processing and return results inline; others return a task ID for later polling or streaming.
sendMessageStream (streaming updates)
When you need real-time updates (task submitted, progress, artifacts, completion), usesendMessageStream. The client opens a streaming connection (SSE, WebSocket, or chunked HTTP) and the agent pushes lifecycle events:
- Task submission confirmation
- Task status updates (e.g., “working”, “succeeded”, “failed”)
- Artifact update events (e.g., logs, files, intermediate outputs)
- Final completion event
Real-world examples
Enterprise agent network
A2A enables agents across departments and organizations to discover and interoperate using the same protocol. Agents advertise their capabilities and endpoints so other agents can call them directly, enabling cross-company collaboration and standardized integrations.
Agent composition
Agent composition is the pattern where one agent treats another agent as a tool. Building systems from small, focused agents (each exposing specific skills) makes complex workflows easier to maintain and scale.
Distributed systems
Agents may be deployed in different regions or clouds. A2A supports distributed deployment, enabling agents to collaborate over the network and form a resilient, geo-distributed agent infrastructure.
Key takeaways: what A2A enables — and what it does not
What A2A provides:- Cross-company agent collaboration
- Multi-agent coordination and composition
- Secure, standardized communication at the protocol level
- Reduced need for custom integrations when parties follow the same A2A conventions
- An agent-building framework (it does not replace frameworks like LangChain)
- A full messaging/control plane (MCP) on its own
- Model-specific (A2A is independent of the underlying model)
- Limited to trivial tools — it supports complex agent-to-agent coordination
| A2A Enables | A2A Is Not |
|---|---|
| Cross-company agent collaboration | An agent-building framework |
| Multi-agent coordination | A replacement for an MCP |
| Standardized, secure protocol | Model-dependent |
| Reduced integration burden | Limited to simple tools |

How A2A fits with KAgent
When A2A is enabled in KAgent, KAgent exposes a discoverable endpoint so other agents can find and communicate with it. The well-known URI for a KAgent-managed agent typically follows this pattern:KAgent exposes each agent’s A2A endpoint under the controller’s API. Replace
namespace and agent-name with the actual Kubernetes namespace and agent name.
Example: agent composition in KAgent
The example below shows a flight agent that exposes abook_flight skill and a travel-planner agent that calls the flight agent via A2A.
flight-agent’s book_flight skill over A2A and uses the returned result as part of the itinerary.
Summary
A2A is a protocol that standardizes agent-to-agent communication to support multi-agent orchestration, secure discovery and authentication, and streaming task lifecycles. It enables agents across organizations and environments to interoperate while remaining agnostic to underlying model frameworks. Further reading and references- OpenID Connect: https://openid.net/connect/
- JWT (JSON Web Tokens): https://jwt.io/
- Well-known URIs (RFC 5785): https://datatracker.ietf.org/doc/html/rfc5785
- Kubernetes documentation: https://kubernetes.io/docs/