The wonks at Linux Foundation conferences might be the only ones who've noticed, but a consequential standards fight is underway—and it's happening largely out of view.
While headlines chase the latest foundation model or bemoan how many tokens ChatGPT can now remember, a more fundamental architecture question is being decided: how will the coming wave of AI agents—those autonomous software systems meant to book your travel, negotiate with vendors, manage your calendar, or trade securities—actually communicate? With each other. With the tools they need. Across the firewalls and security perimeters that define modern enterprise computing.
The answer matters more than it might seem. Deloitte projects the agentic AI market could reach $35 billion by 2030, though improvements in orchestration could lift it to $45 billion. Gartner believes that within four years, 60% of major brands will deploy these agents for direct customer interactions. The World Economic Forum estimated the agents market at $5.4 billion in 2024, projecting $236 billion by 2034.
Big numbers, big ambitions. But there's a problem.
No one has agreed on the plumbing.
And so, in a span of just eight months last year and early this year, three competing open protocols—each backed by a tech giant, each donated to the Linux Foundation in what looks like a strategic land grab disguised as open-source altruism—have emerged to claim the territory. The prize isn't just technical elegance. It's influence over the infrastructure layer of a market that doesn't quite exist yet but is already too important to cede to a rival.
When Giants Move Fast
Anthropic moved first. In November 2024, the AI lab unveiled the Model Context Protocol, or MCP—a specification it positioned as "HTTP for AI tools." The idea: standardize how language models plug into data sources and external applications. No more bespoke integrations every time a new AI assistant needs to read from a database or trigger an API.
The protocol, formally versioned on November 5, 2024, caught on quickly. The MCP experienced rapid ecosystem growth throughout 2025. In December of that year, Anthropic handed MCP over to the Linux Foundation's AI Alliance & Insights Forum, signaling—perhaps genuinely, perhaps strategically—that this wasn't meant to be a walled garden.
Google wasn't about to sit that one out. On April 9, 2025, it launched Agent2Agent, or A2A, with a different emphasis: less about connecting agents to tools, more about enabling agents to message one another. By late June, A2A had also landed at the Linux Foundation, this time with a roster of enterprise backers that read like a corporate strategy deck: Adobe, Box, Deloitte, Salesforce, UiPath. At Google I/O last year, Zoom demoed an A2A integration that let its scheduling agent coordinate with Gmail to find meeting times across platforms. Version 0.3 arrived by year's end, with an explicit focus on enterprise stability.
Then came Cisco. In mid-2025, the networking giant introduced AGNTCY, billing it as an "internet of agents" platform that covered discovery, identity, messaging, and observability. It hit the Linux Foundation between July 30 and August 1, 2025. Cisco's pitch? AGNTCY could interoperate with both MCP and A2A, a kind of Switzerland strategy. Dell, Google Cloud, Oracle, and Red Hat signed on as partners.
Three protocols. Three philosophies. Three corporate camps.
It's messier than that, of course. There are also ACP (Agent Communication Protocol), which surfaced in a 2026 research paper, and ANP (Agent Network Protocol), sketched in a 2025 whitepaper. But MCP, A2A, and AGNTCY have momentum—the kind that comes from money, marketing, and actual implementations shipping to customers.
The Problem Arrived Ahead of Schedule
McKinsey's 2026 outlook observed that enterprises are trying to move toward "mesh-like, modular infrastructure" for agentic AI, but most remain stuck somewhere between pilot projects and real scale. Which makes sense. The technical hurdles are significant: How do you ensure interoperability when an agent running on OpenAI's stack needs to coordinate with one built on Anthropic's Claude, and both are calling Salesforce APIs while respecting IT security policies that were written for humans, not bots?
Without standards, every integration becomes custom plumbing. And custom plumbing doesn't scale.
The infrastructure providers saw the gap. Solo.io launched Agent Gateway and Agent Mesh on April 24, 2025, offering security, observability, multi-tenancy, and guardrails for agent traffic. Solace followed in March of this year with its own Agent Mesh, built on event brokers for pub/sub communication. Dapr added agent support in March 2025, updated through April of this year, showing agents using Redis and Kafka-style message buses.
These aren't theoretical exercises. Salesforce Agentforce shipped as a native MCP client in the second half of 2025, with A2A support in the pipeline and a Command Center for observability. Early customer results trickled out: Engine reported a 15% reduction in case handle time. 1-800Accountant said it hit 70% autonomous resolution for admin chats during the peak tax weeks of 2025. Grupo Globo, the Brazilian media conglomerate, claimed a 22% improvement in subscriber retention.
OpenAI announced its Frontier platform on February 5 this year, aimed at enterprise deployment and management of agent fleets. Balyasny Asset Management, the hedge fund, went public with a case study on March 6 describing federated, team-specific research agents rolling out across the firm.
AWS previewed Bedrock AgentCore on July 16, 2025. On November 18, 2025, Microsoft overhauled Foundry, focusing on observability, security, and data pipelines for agents under Foundry IQ and Fabric IQ.
The platforms, in other words, are committed. The protocols are still figuring themselves out.
When Security Researchers Knock
Late April and early May brought an unwelcome reminder that moving fast can mean breaking things in dangerous ways.
Security researchers flagged what they described as potentially critical vulnerabilities in some MCP implementations—flaws that could expose systems to remote code execution. The issue wasn't a garden-variety coding bug. It was a design challenge in how MCP servers handle tool invocations and validate inputs, a problem baked into the architecture.
The disclosure set off an ecosystem-wide scramble: hardened servers, stricter input validation, identity attestation. Cisco's AGNTCY already included agent identity verification as a core feature, which suddenly looked prescient. Research proposals emerged for an Agent Identity Protocol—AIP—to enable verifiable delegation across MCP and A2A. On April 27, the .agent namespace launched, promising machine-native identities for autonomous systems.
Comparative security analyses of MCP, A2A, and ANP appeared in February. The maintainability and security posture of MCP servers became a documented research topic by last June. For the maintainers and contributors, the message was clear: this infrastructure would be held to a higher standard than a typical open-source side project.
Regulation added pressure. The EU AI Act's Code of Practice obligations for general-purpose AI models, impacting agent systems, took effect on August 2, 2025, requiring transparency, copyright compliance, and safety alignment. The European Council and Parliament moved on May 7 this year to streamline the rules and clarify the AI Office's role.
In the United States, the Office of the Comptroller of the Currency issued Bulletin 2026-13 on April 17, clarifying model risk management expectations for banks. While not agent-specific, the guidance references a forthcoming request for information on AI, generative AI, and agentic AI. Translation: banking regulators are signaling they'll expect stronger validation, monitoring, and controls around autonomous execution.
The FTC launched an inquiry into AI chatbots acting as companions last September, part of broader oversight on deceptive and unfair practices. NIST updated its AI Risk Management Framework playbook on March 27, building on the Generative AI profile from July 26, 2024.
The regulatory backdrop, in short, is tightening. And it's tightening around systems that don't yet have agreed-upon standards.
The Layers Beneath
Below the protocol wars, orchestration frameworks and observability tools are starting to consolidate, though it's early yet.
LangGraph (graph-based stateful orchestration), CrewAI (role-based multi-agent), and Microsoft's AutoGen/Agent Framework (multi-agent conversational) dominate downloads, with enterprise segmentation forming in 2026. Mastra, Pydantic AI, and Anthropic's Agent SDK round out the landscape. Segment-specific adoption patterns are emerging, tracked by industry observers who count GitHub stars and PyPI downloads like political operatives counting voter registrations.
Datadog expanded into AI Agent Monitoring in June 2025. By this year, observability is consolidating around Langfuse, Arize Phoenix, and LangSmith, with OpenTelemetry semantics gaining traction for agent tracing.
Composio—a startup that offers both an MCP server and direct tool APIs—provides 500 to over 1,000 connectors, depending on how you count. Documentation and live toolkits run through 2026. For developers in a hurry, Composio is often faster than building MCP servers from scratch.
Layer by layer, the infrastructure stack is filling in. Agent mesh for traffic management. Observability for debugging and compliance. Identity for cross-organizational trust. Orchestration frameworks for wrangling multiple agents at once.
But the substrate—the protocols themselves—remains unsettled.
The YC Bet
Y Combinator's Spring 2026 batch includes a three-person team in San Francisco called Primitive. The pitch: "communication infrastructure needed for fully autonomous agents."
Founder Ethan Byrd previously served as CTO at Actual AI, which raised $3.2 million in seed funding in September 2025. Before that, engineering roles at Microsoft, AWS, Facebook, and Google—the usual pedigree for someone trying to build infrastructure from the ground up.
Primitive's public product, as of May 10, is programmatic email infrastructure for developers. The tagline: "email is primitive." Inbound email arrives as JSON webhooks. Outbound goes via HTTPS API. The platform provides managed subdomains at *.primitive.email, handling MX, DKIM, SPF, DMARC, and TLS-RPT. Official SDKs cover Node.js, Python, and Go.
Why email for agents?
Because, oddly enough, existing enterprise workflows still run on it. An agent that can't send or parse email is cut off from vast swaths of business communication—purchase orders, vendor negotiations, HR approvals, the bureaucratic substrate of organizational life. Primitive's approach treats email not as a manual interface but as a communication layer agents can program against.
The company is hiring: Founding Infrastructure Engineer at $240,000 to $320,000 with 2% to 4% equity, and Founding Engineer at $220,000 to $280,000 with 1.5% to 2.5% equity. No public funding announcement has surfaced as of May 10.
Elsewhere in the YC portfolio, Terminal Use (Winter 2026) positions itself as "Vercel for filesystem-based agents," focusing on deployment infrastructure. Firecrawl, backed since 2022, provides web data infrastructure used by agents, with products and docs updated through this year.
The startup layer, in other words, is betting there are infrastructure gaps the giants haven't filled. Or won't.
What the Enterprise Buyers Are Doing
Salesforce's approach offers a useful case study. Agentforce integrates MCP for tool connectivity, is building A2A support for inter-agent messaging, and uses MuleSoft connectors for enterprise system integration. The company launched AgentExchange, a marketplace for agent capabilities, positioning interoperability as a strategic differentiator—a selling point, not just a technical feature.
OpenAI's Frontier partnerships with major consultancies signal an enterprise land grab, but the platform's interoperability story remains largely proprietary. AWS and Microsoft are building within their cloud ecosystems. Bedrock AgentCore and Foundry offer paths to production that don't require negotiating multi-cloud protocol standards.
The pattern: large platforms hedging their bets. Support MCP because it's popular and developers expect it. Plan for A2A because Google is pushing hard. Build proprietary orchestration because differentiation still matters in a competitive market.
Deloitte framed 2026 as the year of taming "agent sprawl," with orchestration and interoperable protocols competing for dominance. The firm's analysis from November 18, 2025, suggests that open versus proprietary communication stacks will battle through this year before consolidation begins. Maybe.
Gartner predicts specialized niches emerging: by 2030, "guardian agents" will capture 10% to 15% of the agentic AI market, per a forecast from June 11, 2025. Half of supply chain solutions will include agentic AI by decade's end, according to a May 21, 2025 forecast.
But adoption gaps persist. Deloitte notes that despite strong intent signals from buyers, only a subset of vendors deliver what could reasonably be called "real autonomous capabilities" today. The World Economic Forum's January 15 analysis emphasized that governance and trust—not technical capability—remain the primary gating factors for adoption.
Which might explain why the protocol wars matter more than the model benchmarks right now.
Twelve Months From Now
The standards war won't resolve quickly. HTTP didn't win overnight, either. It competed with Gopher, WAIS, and a host of proprietary alternatives before emerging as the web's foundation, and even that took years.
What's different this time: the market is moving faster. Regulatory pressure is higher. Enterprise buyers have less patience for fragmentation, and their vendors know it. The companies that donated MCP, A2A, and AGNTCY to the Linux Foundation did so to signal neutrality and invite collaboration. Whether that actually happens depends on competitive dynamics none of them fully control.
The technical questions—identity, routing, security, observability—are solvable. These are known problems with known solutions, even if implementing them at scale across heterogeneous systems is never trivial.
The political questions are harder.
Who controls the namespace? Who certifies agents? What happens when an agent misbehaves across organizational boundaries, and there's no single throat to choke, no clear liability chain, no obvious regulator with jurisdiction?
For technical founders, the choice isn't which protocol to bet on exclusively. It's how to build infrastructure flexible enough to adapt as standards shift—or fail to coalesce. For CTOs evaluating platforms, the question is whether vendor lock-in at the communication layer creates unacceptable long-term risk. For infrastructure investors, the opportunity lies in the gaps: identity, security, observability, developer tooling. The pieces no single protocol fully addresses.
The race to build the internet for AI agents is early, crowded, and consequential.
The winners won't necessarily be the ones who picked the right protocol in 2026. They'll be the ones who built systems flexible enough to survive whatever consolidation—or fragmentation—comes after.
