The agent protocol wars are over. The map they left behind lies by symmetry.

Eleven days from now, on 28 July, the final version of the largest revision in the history of MCP ships, the protocol that connects AI models to tools and data. It is a good excuse to tidy up a story that closed with almost nobody noticing: the so-called "agent protocol wars" are over. And they ended in the least dramatic way possible: by donation. Between December 2025 and April 2026, the four main protocols were all handed to neutral bodies. MCP to the Linux Foundation in December. x402 likewise, in April. AP2 to the FIDO Alliance, also in April. A2A was already there since 2025 and reached version 1.0 in April 2026.

What remains is a diagram that now appears in every deck: five stacked layers, one protocol each, everything tidy. The diagram is true. And it lies by symmetry: it draws the layers the same size, when in practice nearly all the real weight sits in one of them.

The map, in plain terms

Five names, each solving one piece of the same problem: how a software agent acts in the world on someone's behalf.

MCP (Model Context Protocol, Anthropic, November 2024) connects a model to tools and data: the standardised socket between AI and systems. A2A (Agent2Agent, Google, 2025) handles the conversation between agents: how two agents from different companies discover each other and exchange tasks. ACP (OpenAI and Stripe) handles checkout when an agent buys. AP2 (Google, now FIDO) handles authorisation: signed mandates proving that a specific human authorised a specific purchase, within specific limits. And x402 (Coinbase) handles machine-to-machine settlement, reviving an HTTP code forgotten since the nineties, 402, "Payment Required".

The best parallel is the shipping container. The container's value was never in the metal box; it was in everyone agreeing on the same box, which turned every port and every ship into interchangeable parts. These protocols do the same to integration: instead of every model needing a custom connection to every system (the old N×M problem), each side implements the standard once. A single purchase can cross four of them with no rivalry at all: the agent reads the catalogue over MCP, fills the basket, proves authorisation with AP2, settles over x402 or a card.

The layers do not weigh the same

"They stack rather than compete" became the consensus of 2026, and it is true. But the consensus omits the most useful fact for anyone deciding where to spend attention: the weight distribution.

The numbers speak plainly. At donation time in December, MCP counted 97 million monthly SDK downloads and more than 10,000 active public servers, with native support in practically everything that matters: ChatGPT, Claude, Gemini, Copilot, Cursor, VS Code. Community trackers give it around 87,000 GitHub stars, against the low twenty thousands for A2A and a few thousand for the commerce protocols (tracker numbers, indicative only, but the order of magnitude is the point). A2A has real enterprise adoption, mostly via Microsoft, Google and AWS. The payment layers carry small loads: x402 had accumulated roughly 50 million dollars (about 45 million euros) of volume by April. MCP is not one layer among five; it is the gravity well the others orbit.

There is a structural reason for this. Connecting a model to tools is the problem everyone has, today, from the solo developer to the insurance company. Agents negotiating with agents, and paying each other, is the problem some companies have, sometimes, still almost always in pilot. The upper layers wait for the future; the bottom one is already in production everywhere.

What this map does not tell you

Three warnings that separate the map from the marketing.

"Backed by 150 organisations" is not adoption. It is a spectrum running from a logo on a website to real production, and the metric that matters, production retention, is one almost nobody publishes. That applies to every protocol in the stack, including the ones I use and defend.

Security is not solved, and authorisation is not what solves it. Prompt injection remains at the top of the OWASP risk list for applications built on language models, and tool poisoning (malicious instructions hidden in tool descriptions or tool responses) exploits a structural gap in MCP: descriptions are reviewed once, at connection time, but what tools return enters the model's context with no equivalent check. The 28 July revision hardens authorisation, aligning it with OAuth, and rightly so. But authorising is not trusting: the emerging consensus is that governance has to live in the runtime, out of the prompt's reach. I wrote about that rule, applied at small scale, when I gave an agent the keys to this blog.

Stabilising through governance has a cost too. The 28 July revision removes sessions and the initialisation handshake from the protocol's core, 20 months after it was born. That is architectural health, and it is expensive for whoever built on top. The institutional answer, a minimum 12-month window between deprecation and removal, is exactly the kind of boredom that separates infrastructure from fashion.

From the trenches

I use this stack every day, at the layer where it carries weight: MCP, connectors and skills in production, in consulting work and in my own products. That is where you feel the edges the generic explainers skip. The context cost is real: Anthropic itself documented setups where tool definitions consumed between 55,000 and 134,000 tokens before the first question was asked. That cost fed last autumn's "skills kill MCP" narrative. The right reading is different: skills are procedural knowledge (how to do things), MCP is connectivity (what you can reach), and the two layers compose. Using both daily, you feel where each one hurts, and they are different pains.

The other side of the trench is this site itself. It is open to every AI crawler by choice, and it has a content API and an MCP server through which an agent has already written a whole piece in draft, under rules I described here. For a site like this, the whole stack currently reduces to one question: when an agent arrives representing someone, is what is there legible? It is the same conclusion I reached from the commerce angle in the piece on agentic commerce: before you sell through an agent, you need to be legible to an agent.

The implementer's ladder

The right question is not "which protocols do I adopt?" but "which rung am I on?". The ladder, bottom up: first, machine-readable content and data (this touches everyone, today). Second, exposing your systems over MCP, starting with reads and reversible writes (this touches anyone already operating software; it is cheap and the return is immediate). Third, agent-to-agent coordination via A2A (this touches companies with multi-team processes, in pilot). Fourth, agentic payments (this touches almost no small business yet; see what happened to the AI checkout shop window).

The calm bet is this: the bottom layer has just stabilised, with neutral governance, a deprecation policy and the largest revision in its history locked. It is infrastructure, in the boring, durable sense of the word. The upper rungs will still change shape. You do not need to climb the whole ladder; you need to know which rung your business is on, and that rung, almost certainly, is one of the lower ones.

mcp #agents #protocols #ai