Manish-Hatwalne

With 25+ years in tech, Manish has worked as a developer, architect, and consultant, mostly with distributed teams. He has taken multiple products from 0 to 1 at global startups. These days he builds AI/ML systems, and in his spare time he enjoys writing, sometimes technical and sometimes just for solace.

Architect

Manish Hatwalne

Learn how to prevent agentic misalignment in autonomous AI agents using OpenFGA, Model Context Protocol, and practical human-in-the-loop guardrails.

Do Not Let Your AI Go Rogue, Guard Against Agentic Misalignment

Tara Venkatesan

Tara Venkatesan drives go-to-market and messaging for Auth0's AI Agent and Authorization business. Outside of her work in tech, she lives in Austin and spends her time with her family doing visiting local parks and coffee shops with her family and their dog.

Staff Product Marketing Manager

Karim Tantawy

Karim Tantawy is a Group Product Manager at Auth0, where he leads securing AI Agents and MCP Servers. With over 15 years of experience across both Engineering and Product, he is passionate about solving real world problems and delivering impactful solutions that delight customers.

Group Product Manager

Secure your Model Context Protocol (MCP) servers with Auth0. Implement authentication, CIMD registration, and OBO token exchange for your AI agents.

Auth for MCP Is Now Generally Available

raphael-do-vale

Raphael has more than two decades of experience in developing enterprise systems including coding, project planning, architecture, and specification. His technology stack includes Java, Spring, Python, Relational Databases, JavaScript, DevOps, and Artificial Intelligence. He has a PhD and Master's degree in the Semantic Web, winning awards during his studies. He also worked with Description Logic, Prolog, RDF, and OWL tech.

Raphael do Vale

Learn how to secure your Model Context Protocol (MCP) tools using Auth0 FGA and TypeScript. Implement relationship-based access control for AI applications.

Protect Your MCP Tools With Auth0 FGA in TypeScript

Mark-Vong

Mark is a Staff Product Marketing Manager focused on Technical Marketing at Auth0, where he contributes to the delivery of developer and product focused content. With 8 years of experience in a previous Pre-Sales role, he brings a unique blend of field and customer perspectives on all things CIAM and Auth0. As an avid builder with a background in CS, he continues to develop apps for custom demos and hobby projects.

Mark Vong

Bradford Peirce

Product Marketing Manager, Retail

How to secure agentic commerce interactions with Auth0’s Auth for MCP.

From Storefronts to AI Agents: The Next Evolution of Retail Commerce

william_johnson

  Will Johnson is a Developer Advocate at Auth0. He loves teaching topics in a digestible way to empower more developers. He writes blog posts, records screencasts, and writes eBooks to help developers. He's also an instructor on <a target='_blank' rel='noopener noreferrer' href='https://egghead.io'><strong><b>egghead.io</b></strong></a>.


Developer Advocate

Will Johnson

The November 2025 Model Context Protocol (MCP) update introduces Client ID Metadata Documents (CIMD) and Cross App Access (XAA). Learn how these changes improve AI agent security.


Model Context Protocol Nov 2025 Specification Update: CIMD, XAA, and Security

Discover why the Model Context Protocol (MCP) deprecated Server-Sent Events (SSE) for Streamable HTTP and how this shift enables stronger authentication, standard CORS policies, and secure session management.

Why MCP’s Move Away from Server-Sent Events Simplifies Security





Discover why Client ID Metadata Documents are replacing Dynamic Client Registration in the Model Context Protocol ecosystem for better security.

Client ID Metadata Documents Are the Future of MCP Client Registration

Connect your Auth0-secured Model Context Protocol (MCP) server to ChatGPT. Learn how to enable Developer Mode, configure custom connectors, authorize connections with Auth0 Universal Login, and interacting with your API in chat.

Integrate Your Auth0 Secured Remote MCP Server in ChatGPT Developer Mode

As AI agents become more autonomous, developers need to understand how they communicate. We compare two key agent communication protocols: Model Context Protocol (MCP) and Agent-to-Agent (A2A), explaining how they work and when to use them.

*TL;DR: MCP (Model Context Protocol) is a structured way to let AI agents access tools, APIs, or external resources. Agent-to-Agent (A2A) communication, by contrast, is how agents collaborate with each other to accomplish tasks. MCP and A2A are not competing standards, they’re complementary building blocks for how AI agents operate.*

AI agents are no longer just chatbots answering trivia questions. They’re writing code, querying APIs, scheduling meetings, and even collaborating with other agents to accomplish tasks. As this evolves, developers are starting to ask: how do these agents actually work together? Two concepts come up a lot: Model Context Protocol (MCP) and Agent-to-Agent (A2A) communication.
Both terms show up often in AI architecture conversations, but they’re often discussed in different contexts or with varying levels of technical depth. In this post, we’ll unpack both concepts side by side in plain language, with practical context for developers.

## What Is Model Context Protocol (MCP)?

[MCP (Model Context Protocol), developed by Anthropic](https://www.anthropic.com/news/model-context-protocol), is a structured way to let AI agents access tools, APIs, or external resources. It acts like a universal toolbelt, giving agents a predictable way to understand what tools are available, how to use them, and what to do with the responses. This makes tools safe, structured, and reusable across different models or vendors.

It works by connecting an MCP client (typically the LLM-powered agent) to local data sources and/or remote resource servers, which manage access to external tools or datasets.

![](https://images.ctfassets.net/23aumh6u8s0i/6FFOU4oh4xt8zGwx0UDYnK/d22d2b9f198bd30e559be1023028bc42/Copy_of_Auth0__Flow_Chart_Templates.png)

### How MCP works

At a high level, MCP is about helping an AI agent figure out what tools it can use, what they do, and how to call them safely. It’s like setting up a toolbox and giving the agent an instruction manual, instead of poking random APIs.

Here’s how a typical flow might go:

1. The user asks something the agent can’t answer with its current knowledge.
2. It realizes it needs outside info, like data from an API or a tool to crunch numbers.
3. If required, the user gets prompted to approve access.
4. The agent sends a structured request to the MCP server asking for what it needs.
5. The MCP server checks if the agent has permission and returns the result.
6. That fresh data or tool output gets added into its working memory.
7. Now the agent can respond with more accuracy and context.

MCP simplifies tool access and enforces safe, structured use of external resources without requiring the agent to understand the internal workings of those tools.

Learn more about MCP by reading [this introduction blog post](https://auth0.com/blog/an-introduction-to-mcp-and-authorization/).

<include src="LinkCard" link="https://auth0.com/blog/an-introduction-to-mcp-and-authorization/" title="An Introduction to MCP and Authorization
" description="Discover the Model Context Protocol (MCP) and its authorization mechanisms. Learn how to use API keys, OAuth 2.1 implementation, and best practices for secure LLM API connections." img="https://images.ctfassets.net/23aumh6u8s0i/ImPbKVGMqKM4FMs9Flncw/f715edcaec63105c95189125436cc3a1/MCP_and_Authorization.jpg" />

## What Is Agent-to-Agent (A2A) Communication?

Agent-to-Agent (A2A) communication, a concept being defined by Google Cloud, is like agents chatting with each other to figure things out together sharing goals, dividing up work, and sometimes even debating the best way forward. It's more like teamwork than just calling tools, and it opens the door to more dynamic, flexible problem-solving.

In A2A, agents typically fall into one of two categories:

* **Client agents** initiate requests and coordinate tasks on behalf of the user.
* **Remote or Service** agents advertise specific capabilities and handle incoming requests.

This simple distinction helps keep communication clear and makes it easier for agents to find the right collaborators.

![](https://images.ctfassets.net/23aumh6u8s0i/1Cyhz5IaFdhmLPlvW0wBHw/3658f0b0d342db25e7f192e5fe575b78/a2a-protocol-diagram.png
)

### How A2A works

A2A is all about letting agents talk to each other using standardized protocols. These agents send and receive JSON messages over HTTP, often mediated by an A2A server. But before that can happen, there needs to be a layer of trust.

That’s where **Agent Cards** come in, self-descriptions that each agent publishes outlining what they can do, what protocols they speak, and what kind of requests they accept. These cards help agents find the right collaborators without giving away sensitive implementation details.

Here’s how a typical flow goes:

1. A user asks the client agent to complete a complex task.

2. That client agent realizes it needs help and breaks the job into smaller parts.

3. It reviews other remote agents’ cards to see who’s best for which task.

4. It sends requests to those remote agents, who get to work in parallel.

5. They share progress, respond with outputs, or even ask follow-ups.

6. The original agent pulls all the results together and delivers a final response.

This setup supports more flexible workflows where agents can specialize and dynamically coordinate with one another, especially useful for large, multi-step tasks that benefit from multiple perspectives.


Learn more about how Auth0 is collaborating with [Google Cloud to help define the A2A spec](https://auth0.com/blog/auth0-google-a2a/)

<include src="LinkCard" link="https://auth0.com/blog/auth0-google-a2a/" title="Secure A2A Authentication with Auth0 and Google Cloud
" description="Production-ready AI agents need to be secure, and auth is a big part of security. Auth0 is partnering with Google Cloud to help deliver secure authentication for the Agent2Agent (A2A) protocol." img="https://images.ctfassets.net/23aumh6u8s0i/6cD3przXWPPg8VnQxAiZrb/58cfe480db806613aca0509efc57e30e/auth0-google0cloud-a2a.png" />

## MCP and A2A: Complementary, Not Competitive

Sometimes, these systems are blended:

* Each agent in an A2A system might use MCP to call their own tools
* Or, a single MCP-powered agent might spin up temporary agents to handle subtasks (LangGraph, AutoGen)

But they solve different problems:

* MCP extends *what a single agent can do*
* A2A expands *how agents can collaborate*

## Why This Matters for Identity and Security

As AI agents evolve, the need for secure, observable, and identity-aware access grows. Whether an agent is calling a tool via MCP or delegating to another agent via A2A, we need ways to:

* Authenticate agent identities
* Control what they can access
* Trace their behavior

At Auth0, we think a lot about these layers of trust and access. If your agents can make API calls or act on behalf of users, identity becomes just as important as it is for human users.

## Conclusion

MCP and A2A are not competing standards, they’re complementary building blocks for how AI agents operate. Knowing when to use one (or both) is critical for developers building the next generation of AI-native apps. Auth0 has a [MCP Server you can use today](https://github.com/auth0/auth0-mcp-server) and learn more about [our collaboration with Google Cloud](https://auth0.com/blog/auth0-google-a2a/) on the A2A protocol. 

## Related Documentation

* [Client Credentials Flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-credentials-flow)
* [Authentication vs. Authorization](https://auth0.com/docs/get-started/authentication-and-authorization)
* [Access Tokens](https://auth0.com/docs/secure/tokens/access-tokens)
* [APIs](https://auth0.com/docs/get-started/apis)
* [Access Control](https://auth0.com/docs/manage-users/access-control)

MCP vs A2A: A Guide to AI Agent Communication Protocols

jess-author

Jessica Temporal is a Senior Developer Advocate at Auth0 and co-founder of the first Brazilian data science podcast called <a target='_blank' href='https://pizzadedados.com'><strong>Pizza de Dados</strong></a>. She’s the author of <a target='_blank' href='https://www.amazon.com/dp/B0CDNX6NS7/ref=sr_1_1?&_encoding=UTF8&tag=jesstempora0e-20&linkCode=ur2&linkId=efc4229f6b816609dfce4f185781d99a&camp=1789&creative=9325' ><strong>The Big Git Microbook</strong></a>, creator of <a target='_blank' href='https://gitfichas.com/en'><strong>GitFichas.com</strong></a>, and a part of <a target='_blank' href='https://www.linkedin.com/learning/instructors/jessica-temporal'><strong>LinkedIn Learning</strong></a> instructors team. Jessica helped develop the AI that identifies possible unlawful expenses from Brazilian politicians. She is part of the PyLadies initiative that works to improve diversity and inclusion in technology. In her free time, she likes to knit, play video games, use her 3D printer, and is learning to create 3D models.

Sr. Developer Advocate

Jessica Temporal

Learn about the new classification of MCP servers as OAuth Resource Servers, implementing Resource Indicators to prevent token misuse, and the clearer security best practices designed to help you build more robust and secure MCP applications

*TL;DR: The June 2025 MCP spec update classifies MCP servers as OAuth Resource Servers, requires MCP clients to implement Resource Indicators (RFC 8707), and provides more MCP security guidance with a dedicated page for security best practices.*

As developers, we're building the next generation of applications on a foundation of interconnected services. The Model Context Protocol (MCP) is rapidly becoming a key part of that foundation, enabling seamless context sharing between AI models and applications. But as adoption grows, how do we ensure the connections we build are secure?

The [latest changelog](https://modelcontextprotocol.io/specification/2025-06-18/changelog), released on June 18, 2025, introduces updates that clarify how authorization should be handled for MCP Servers and how MCP Clients should implement [Resource Indicators](https://www.rfc-editor.org/rfc/rfc8707.html) to prevent malicious servers from obtaining access tokens.

Let's break down what’s new for auth and what it means for you as you build with MCP.

## MCP Servers Now Classified as OAuth Resource Servers

MCP servers are now officially classified as [OAuth Resource Servers](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization#authorization-server-discovery). This might seem like a small semantic change, but it has significant implications for security and discovery.

By defining MCP servers this way, the protocol now includes a mechanism to add protected resource metadata. What does this mean in practice? It allows an MCP server to advertise where its corresponding Authorization Server is located. This discovery mechanism is vital for clients, as it removes ambiguity and ensures they request tokens from the legitimate, intended authority, streamlining the authorization process securely.

## Preventing Token Misuse by Implementing Resource Indicators (RFC 8707)

Have you ever worried about a token intended for one service being misused at another? This is a legitimate threat known as "token mis-redemption." To combat this, MCP clients are now required to implement Resource Indicators, as specified in [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707).

![A diagram illustrating MCP security, showing how Resource Indicators (RFC 8707) prevent token misuse by locking an access token to a specific audience (resource server)](https://images.ctfassets.net/23aumh6u8s0i/5H7veAQxKRIcnI6bOHWyEI/c2c6881322830a9283a5360af6906c68/Uploaded_from_Model_Context_Protocol__MCP__Spec_Updates_from_June_2025__One_Small_Step_for_a_Spec__One_Giant_Leap_for_Security)

By using a resource indicator in the token request, a client explicitly states the intended recipient (the "audience") of the access token. The Authorization Server can then issue a token that is _tightly scoped_ and only valid for that specific MCP server. This prevents a malicious or compromised server from taking a token it received and using it to access a different protected resource on the user's behalf. Put plainly, this practice ensures your tokens can't be used where they don't belong.

## Clearer MCP Security Guidance and Best Practices

Building secure systems is easier when the rules of the road are crystal clear. This update brings significant clarifications to the core [authorization spec's security considerations](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization#security-considerations) and introduces a brand new, dedicated page for [security best practices](https://modelcontextprotocol.io/specification/2025-06-18/basic/security_best_practices).

This new guidance provides actionable advice for developers like you and me so we can implement both clients and servers more securely. It centralizes security guidance, making it easier to build robust and secure MCP integrations from the ground up. We strongly recommend all developers working with MCP review these pages.

## Building a More Secure Future

These updates represent a significant step forward in hardening the Model Context Protocol. By formalizing the roles of servers, mandating token protection with resource indicators, and providing clearer documentation, the MCP is becoming an even more robust and trustworthy standard for the AI application ecosystem.

While these aren’t the only changes in the June 18th MCP specification changelog, they are the most impactful ones concerning authentication and authorization. If you are building and securing MCPs you should check out our documentation on Auth for MCP and the Getting Started with Auth0 Model Context Protocol (MCP) Server.

Now you’re ready to go forth and enhance the security of your MCP servers and clients.

## Related Documentation

* [Access Tokens](https://auth0.com/docs/secure/tokens/access-tokens)
* [APIs](https://auth0.com/docs/get-started/apis)
* [Validate Access Tokens](https://auth0.com/docs/secure/tokens/access-tokens/validate-access-tokens)
* [Scopes](https://auth0.com/docs/get-started/apis/scopes)
* [Authentication and Authorization Flows](https://auth0.com/docs/get-started/authentication-and-authorization-flow)

Model Context Protocol (MCP) Spec Updates from June 2025: One Small Step for a Spec, One Giant Leap for Security

I stream, blog, and make youtube videos about tech stuff. I love coding, I love AI, and I love building stuff!

Staff Developer Advocate

Juan Cruz Martinez

Discover the Model Context Protocol (MCP) and its authorization mechanisms. Learn how to use API keys, OAuth 2.1 implementation, and best practices for secure LLM API connections.

"model context protocol"