MCP and A2A Boundaries on Amazon Bedrock AgentCore

Model Context Protocol (MCP) and Agent-to-Agent (A2A) are not “hands” and “voices” that every agent must have. They are different wire contracts. MCP exposes tools and contextual resources to a model-facing client. A2A exposes an agent, its capabilities, and task-oriented interaction to another application or agent. Sometimes plain HTTP is the smaller and better boundary. Amazon Bedrock AgentCore Runtime supports all three. The choice affects the port, mount path, message format, discovery mechanism, and client expectations. | Contract | Runtime endpoint | Discovery | Good fit | | --- | --- | --- | --- | | HTTP | port 8080, `/invocations` or `/ws` | application-defined | direct application calls and streaming | | MCP | port 8000, `/mcp` | tool listing | bounded tools or an MCP server | | A2A | port 9000, `/` | Agent Card | interoperable agent delegation | Do not run several contracts behind one runtime and infer the requested protocol from payload shape. Deploy and test each public contract independently. ## Use MCP for constrained capabilities An MCP tool should have a narrow name, JSON schema, predictable errors, and an authorization check at execution time. The model choosing a tool is not approval. Validate arguments, bind the caller to permitted resources, rate-limit costly operations, and require confirmation for consequential writes. MCP is useful when multiple compatible clients need the same tools. A normal internal function is preferable when there is only one process and no interoperability requirement. Adding a network protocol creates authentication, versioning, observability, and availability work. Treat tool descriptions and returned text as untrusted content. A document fetched through MCP can contain instructions aimed at the model. Keep system policy separate, label provenance, sanitize output used in another command, and never turn retrieved text directly into shell or database operations. ## Use A2A for an agent-shaped service AgentCore’s A2A contract uses JSON-RPC 2.0 over HTTP and serves the Agent Card at `/.well-known/agent-card.json`. The Agent Card is metadata for discovery; it is not a search engine, trust proof, or authorization grant. Production routing should use an allow-listed registry and verify the destination’s identity and advertised capabilities. The current AgentCore and Strands integration wraps a Strands agent with the supported executor and runtime helper: ```python from strands import Agent, tool from strands.multiagent.a2a.executor import StrandsA2AExecutor from bedrock_agentcore.runtime import serve_a2a @tool def summarize_case(case_id: str) -> str: """Return an authorized case summary for the current caller.""" return load_authorized_summary(case_id) agent = Agent(tools=[summarize_case]) if __name__ == "__main__": serve_a2a(StrandsA2AExecutor(agent)) ``` This establishes protocol compatibility; it does not implement business authorization. AgentCore can authenticate invocation with SigV4 or OAuth 2.0. The service must still decide whether that principal may read the requested case and invoke downstream tools. Do not forward a user token indiscriminately. Prefer token exchange or service credentials with explicit, least-privilege delegation, and record the initiating principal separately from the workload identity. ## Propagate context deliberately AgentCore adds a runtime session header for session isolation. Session identity is not tenant identity. Carry correlation, tenant, and end-user context in a signed or server-established envelope, validate it at every hop, and avoid trusting values generated by the model. For A2A, define timeouts and cancellation, bound task fan-out, and preserve a trace ID across calls. A delegation graph can otherwise loop or multiply costs. Return structured errors and avoid embedding secrets or raw internal stack traces in JSON-RPC error data. ## Migration and evaluation Start with an inventory of existing tools and agent endpoints. Keep deterministic, narrow operations as functions or MCP tools. Expose A2A only where independent ownership, capability discovery, or cross-framework delegation provides real value. Put legacy adapters behind the new boundary and migrate clients gradually instead of changing orchestration and protocol simultaneously. Contract-test Agent Card retrieval, JSON-RPC errors, authentication failures, tool schemas, cancellation, and streaming. Security tests should include forged tenant context, prompt injection in tool output, a compromised downstream agent, excessive delegation, and replayed requests. Compare task success, latency, token use, tool error rate, and authorization denials before and after migration. ## References - [AgentCore Runtime service contract](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-service-contract.html) - [Deploy A2A servers in AgentCore Runtime](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-a2a.html) - [AgentCore A2A protocol contract](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-a2a-protocol-contract.html) - [Model Context Protocol specification](https://modelcontextprotocol.io/specification/) _Reviewed against official documentation on 2026-08-01._

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

from strands import Agent, tool
from strands.multiagent.a2a.executor import StrandsA2AExecutor
from bedrock_agentcore.runtime import serve_a2a

@tool
def summarize_case(case_id: str) -> str:
    """Return an authorized case summary for the current caller."""
    return load_authorized_summary(case_id)

agent = Agent(tools=[summarize_case])

if __name__ == "__main__":
    serve_a2a(StrandsA2AExecutor(agent))