A hundred and seventy-two companies have put their name to A2A, the standard for AI agents at different companies to find each other and talk. I took the web address the project lists next to each name and asked 135 of them the question the standard is built around. Four answered. The reason is not technical: MCP needs one person to say yes, A2A needs two organisations.
Chapters
- 00:00 - AWS, Microsoft, Salesforce, SAP, and four answers
- 00:54 - What I was actually sold, and what I went looking for
- 01:31 - What counts as another party, and what does not
- 03:08 - Single-player, and why the reason is not technical
- 04:07 - MCP, November 2024: one person has to agree
- 06:56 - A2A, April 2025: two organisations have to agree
- 11:04 - What the agent card is, and why not having one is fine
- 12:56 - Who is actually at your server
- 15:35 - Forget the logos, watch your own logs
- 16:24 - After the episode: the race to the bottom
Key Numbers
- 172 companies listed on the A2A partners page
- 135 of them checked, both well-known paths, 270 requests
- 4 served an agent card. 131 served nothing
- 1 served it at the path the specification registers
- 14 returned HTTP 200 at that path. 12 were the homepage
- MCP: 1 person has to agree. A2A: 2 organisations
Key Takeaways
- The visitor at your server is one person's assistant, not another company's agent. It fetches one thing, cannot ask a follow-up, and has no patience for a slow page. That is a smaller job than the one being described to you, and a different one.
- A protocol that pays off alone spreads. One that needs a counterparty waits. MCP works the afternoon you wire it up. You can implement A2A perfectly and get nothing until somebody you do not control has done the same work.
- Not having an agent card is not a failure. It is not a test, nothing scores you on it, and if no agent runs on your server there is nothing to publish.
What to Do
- Watch your own logs rather than the partner lists. The day something arrives that was clearly sent by another company's system, not a person, is the day this changed.
- Treat a 200 as nothing. Twelve of the fourteen I found were a homepage answering to any address.
- Answer clearly and quickly, and be honest about what you do not have. Most websites say yes to everything.
- The No Hacks newsletter is at nohacks.co/subscribe.
Sources & Links
The standard
The other protocol
No Hacks runs no sponsorships and is funded by advisory and audit work.
If your website needs to work for machines as well as people, start with a fixed-scope Machine-First Architecture audit: https://nohacks.co/audit
