# How do MCP, connectors and agent-to-agent protocols fit together in 2026?

Date: 2026-10-28 · Author: Robert Scales · https://guidetoartificialintelligence.com/en/learn/mcp-connectors-agent-protocols-2026/

**Answer:** MCP is the common plug that lets one AI assistant or agent reach tools and data, connectors are the ready-made MCP links you switch on in apps like ChatGPT and Claude, and the Agent2Agent protocol (A2A) lets separate agents, often from different companies, hand tasks to one another. Think of MCP as giving one agent more hands and A2A as letting agents talk to colleagues; both now sit under the same neutral foundation.

Three names now come up whenever people discuss agents that do real work: MCP, connectors and A2A. They are easy to confuse because all three are about "connecting AI to things". The difference is *what* gets connected. MCP connects one AI application to tools and data. A connector is simply a packaged MCP connection you turn on in a product. A2A connects one agent to another agent.

Here is the picture as of October 2026: how the pieces relate, what changed this year, and how to decide what deserves a connection at all.

## Three layers, one picture

| Layer | What it connects | Everyday comparison | Example |
|---|---|---|---|
| **MCP** (Model Context Protocol) | An AI app to tools, files and data | A standard power outlet | Your assistant reads a folder or queries a calendar |
| **Connector** | A ready-made MCP server you enable with a few clicks | An appliance already fitted with the right plug | "Google Drive" in the assistant's settings |
| **A2A** (Agent2Agent protocol) | One agent to another agent | A phone call between two departments | Your purchasing agent asks a supplier's agent about stock |

The A2A project describes the split in direction terms: MCP is *vertical*, deepening what a single agent can do, while A2A is *horizontal*, letting agents built on different frameworks and run by different organizations discover each other and share work. An A2A agent publishes an **agent card**, a short machine-readable description of what it can do and how to reach it, so another agent can read the card and decide whether to delegate.

In August 2026, A2A joined the Agentic AI Foundation, which the Linux Foundation directs and which already hosts MCP and the AGENTS.md convention. For a buyer, that matters more than it sounds: neither protocol now belongs to a single vendor, so a tool you build or buy against them is less likely to be stranded.

## What changed in MCP this year

The current MCP specification is dated July 28, 2026, and it is the biggest revision so far. You don't need the details to use connectors, but three changes explain why products behave differently than they did a year ago.

- **Stateless requests.** Earlier versions opened a session with a handshake. Now every request carries its own version and capabilities, which makes MCP servers easier to run at scale in the cloud.
- **Extensions.** Optional add-ons sit outside the core: *Tasks* for long-running jobs you check on later, *Skills over MCP* for packaged instructions, and *MCP Apps* for small interactive pieces, such as a chart or a form, shown inside the conversation.
- **Clean-up.** Some older features, including Sampling and Roots, are deprecated, and a new policy guarantees at least twelve months' notice before anything is removed.

What did *not* change is the security stance. The specification still says users must understand and agree to what data is shared and which actions run, that the host app must ask before calling any tool, and that a tool's own description should be treated as untrusted unless the server is trusted. It also admits that the protocol cannot enforce any of this by itself. Enforcement is up to the app you use and the choices you make.

## A worked example: one small office, three layers

Picture a five-person bookkeeping firm.

1. **Connectors** in its AI assistant: the shared drive (read-only, client folders only) and the team calendar.
2. **A custom MCP server**, written by a contractor, that exposes exactly two tools from the accounting software: `find_invoice` and `list_unpaid_invoices`. No tool that creates or deletes anything.
3. **A2A**, later and optionally: if a supplier offers an ordering agent with an agent card, the firm's agent could ask it about delivery dates instead of a person phoning.

Before enabling the custom server, someone on the team asks the assistant:

```prompt
List every tool this connection gives you, with one line each on what it can read, what it can change, and whether it can send anything outside our company. If any tool can create, edit, delete or send, say so first.
```

The answer becomes the firm's record of what was approved, and it gets repeated whenever the server is updated.

> **Try it:** Open the connectors page of the assistant you use and write down each one that is switched on, what it can reach, and when you last used it. Switch off any you can't justify in one sentence.

## What should you connect, and what should you keep out?

Connect what a task needs, at the smallest scope that works. A connector that reads one shared folder is safer than one that reads your whole drive, and a read-only tool is safer than one that can write. Good first candidates are sources you already search by hand: documentation, a knowledge base, a calendar, a ticket queue. Each connection pays off when it saves you a copy-and-paste you make every day.

Keep out, or keep behind a person's approval, anything that moves money, sends messages in your name, deletes records, changes permissions, or holds data you are legally bound to protect, such as health files or client identity documents. Be especially careful with connections that combine three things: access to private data, exposure to content from strangers (email, web pages, shared documents) and a way to send information out. An agent with all three can be tricked by planted text into leaking what it can see.

For agent-to-agent links, add one rule: treat the other agent as an outside party, not a colleague. Read its agent card, share only what you would put in an email to that company, and never let a remote agent's request trigger an action in your systems without the same approval a human request would need. Protocols make the connection easy; deciding what flows through it is still your job.

## Sources

- Specification (version 2026-07-28): https://modelcontextprotocol.io/specification/2026-07-28
- Key Changes (specification 2026-07-28): https://modelcontextprotocol.io/specification/2026-07-28/changelog
- A New Chapter for A2A: Joining the Agentic AI Foundation: https://a2a-protocol.org/latest/blog/2026/08/27/a-new-chapter-for-a2a-joining-the-agentic-ai-foundation/