No Hacks with Slobodan Manic

Slobodan "Sani" Manić

232: The Agentic Web Is Still A Single-Player Game

SEP 16, 202618 MIN

Description

A hundred and seventy-two companies have put their name to A2A, the standard for AI agents at different companies to find each other and talk. I took the web address the project lists next to each name and asked 135 of them the question the standard is built around. Four answered. The reason is not technical: MCP needs one person to say yes, A2A needs two organisations. Chapters 00:00 - AWS, Microsoft, Salesforce, SAP, and four answers 00:54 - What I was actually sold, and what I went looking for 01:31 - What counts as another party, and what does not 03:08 - Single-player, and why the reason is not technical 04:07 - MCP, November 2024: one person has to agree 06:56 - A2A, April 2025: two organisations have to agree 11:04 - What the agent card is, and why not having one is fine 12:56 - Who is actually at your server 15:35 - Forget the logos, watch your own logs 16:24 - After the episode: the race to the bottom Key Numbers 172 companies listed on the A2A partners page 135 of them checked, both well-known paths, 270 requests 4 served an agent card. 131 served nothing 1 served it at the path the specification registers 14 returned HTTP 200 at that path. 12 were the homepage MCP: 1 person has to agree. A2A: 2 organisations Key Takeaways The visitor at your server is one person's assistant, not another company's agent. It fetches one thing, cannot ask a follow-up, and has no patience for a slow page. That is a smaller job than the one being described to you, and a different one. A protocol that pays off alone spreads. One that needs a counterparty waits. MCP works the afternoon you wire it up. You can implement A2A perfectly and get nothing until somebody you do not control has done the same work. Not having an agent card is not a failure. It is not a test, nothing scores you on it, and if no agent runs on your server there is nothing to publish. What to Do Watch your own logs rather than the partner lists. The day something arrives that was clearly sent by another company's system, not a person, is the day this changed. Treat a 200 as nothing. Twelve of the fourteen I found were a homepage answering to any address. Answer clearly and quickly, and be honest about what you do not have. Most websites say yes to everything. The No Hacks newsletter is at nohacks.co/subscribe. Sources & Links The standard A2A specification, section 8.2 discovery A2A partners list IANA well-known URI registry The other protocol Model Context Protocol specification Announcing A2A, Google, April 2025 No Hacks runs no sponsorships and is funded by advisory and audit work.  If your website needs to work for machines as well as people, start with a fixed-scope Machine-First Architecture audit: https://nohacks.co/audit