Protocols

Every Protocols article we've published — field notes on building and shipping production AI systems, written by the engineers who build them.

5 articles

George Onyango13 min read

The MCP spec's security rules that servers skip

The Model Context Protocol puts much of its security on implementers, in MUST and MUST NOT language a working server can ignore. Token audiences, owned state handles, SSRF, command allowlists and least scope, as a checklist.

Sep 15, 2026 Read article

Patrick Waweru12 min read

The agent protocols are standardised. Your authorization isn't.

A2A now sits beside MCP at the Agentic AI Foundation, and both leave authorization to you. Delegation versus impersonation, token exchange at every hop, and the RFC 8693 rule that decides where chain policy has to live.

Sep 12, 2026 Read article

Patrick Waweru11 min read

A2A in production - tasks, push, and security beyond the demo

The A2A features a hello-world skips but a real multi-agent system can't: push notifications, resubscription, security schemes on the agent card, and typed extensions.

Jul 15, 2026 Read article

Harrison Itotia11 min read

Introduction to A2A - agent-to-agent over gRPC

The Agent-to-Agent protocol gives multi-agent systems the same transport story REST gave web services. A walkthrough with Go.

Apr 9, 2026 Read article

George Onyango9 min read

Introduction to MCP - the Model Context Protocol

How MCP turns "LLM with tools" from bespoke glue code into a stable, language-agnostic contract you can build a platform on.

Mar 25, 2026 Read article