The Hollow Standard: Why MCP and A2A Protocols Leave Your Agent Infrastructure Exposed

The numbers, when they first hit my desk, were jarring: thousands of MCP servers, exposed directly to the public internet in 2026, without a shred of authentication. This wasn’t some niche experiment; this was production infrastructure, ripe for exploitation, just months after MCP crossed the hundred-million-monthly-downloads mark and A2A hit v1.0, cementing them as the de facto communication standards for agentic AI. It’s a stark reminder that in our rush to declare victory on interoperability, we’ve neglected the fundamental layers of governance and operations.

Make no mistake, the rapid adoption of protocols like MCP and A2A is a monumental achievement. For too long, agent communication was a wild west, fragmented by vendor-specific APIs and proprietary formats. These new standards have solved a critical problem: the syntax of agent interoperability. Agents can now, theoretically, speak to each other. They understand the format, the handshake, the basic structure of a conversation. This is the conventional wisdom, the ‘success story’ analysts are touting.

But here’s the rub, and it’s a hard lesson I’ve learned repeatedly over two decades of building and operating mission-critical systems: standards solve syntax, not semantics or operations. A protocol, by itself, is stateless. It defines the ‘how’ but entirely overlooks the ‘what if’ and the ‘who.’ When I was leading the messaging middleware team at Deutsche Bank, migrating the trading backbone from TIBCO Rendezvous to Solace, we weren’t just looking for a faster wire. We needed guarantees: guaranteed delivery, guaranteed ordering, auditability, and the ability to apply fine-grained security policies across millions of messages a second. Rendezvous gave us a protocol; Solace gave us a fabric.

Today, MCP and A2A protocols, despite their ubiquity, are similarly bare bones. They don’t give you audit trails, lineage, policy enforcement, or delivery guarantees. They’re like handing every agent a phone, but no one gets a call log, no one knows who owns the network, and there’s no operator to ensure the message actually gets through. The result? Those thousands of exposed MCP servers are just the canary in the coal mine. They illustrate precisely what happens when adoption outruns the architectural layer meant to govern it – security vulnerabilities, compliance nightmares, and an inability to reason about the system’s behavior.

This isn’t a theoretical problem for some distant future; it’s a present-day reality for any enterprise trying to deploy agentic AI at scale. At Capital One, when we built greenfield microservices for real-time credit card controls, the regulatory requirements for auditability and risk management were paramount. Every transaction, every decision, had to be traceable. You can’t build a system handling sensitive financial data or mission-critical IoT telemetry on a stateless protocol that leaves those fundamental requirements to chance. You need an underlying event-driven nervous system.

This is exactly the argument for an event mesh beneath the protocol layer, and it’s why the third generation of Solace Agent Mesh isn’t just another product release; it’s an architectural imperative. We’re not just providing a faster pipe for MCP and A2A; we’re giving agents the operational context and governance they desperately need. Think of it as providing the nervous system and the regulatory body for the agent world.

How does it do this? First, by providing a robust, persistent fabric where every agent interaction becomes an event. This isn’t just about moving messages; it’s about creating an immutable, ordered stream that is your audit trail and lineage. Imagine every agent decision, every tool call, every observation, timestamped and captured. Secondly, it brings enterprise-grade security and policy enforcement. Instead of individual MCP servers fending for themselves, the mesh provides a centralized plane for access control, authentication, and authorization, ensuring that only authorized agents can communicate with specific services or topics.

Our Universal A2A Agent Host within the Solace Agent Mesh is a concrete example. It acts as a governed gateway, ensuring that all A2A traffic passing through it benefits from the full suite of event mesh capabilities: guaranteed delivery, message prioritization, advanced routing, and built-in observability. This isn’t an afterthought; it’s baked into the architecture, a direct response to the kind of production challenges I saw unfold repeatedly at Deutsche Bank and Solace alike.

So, what’s the lesson here? Don’t confuse the successful adoption of a protocol with the successful deployment of a secure, governable, and resilient agent infrastructure. MCP and A2A have laid the syntactic groundwork, but they are a hollow standard without the operational depth beneath them. When evaluating your agentic AI strategy, ask yourself: Can I trace every interaction an agent has had? Can I enforce real-time security policies across my entire agent ecosystem, regardless of where they’re deployed? Can I guarantee message delivery and order? If the answer to any of these is “no” or “I’m relying on individual agent implementations,” then your agent infrastructure is exposed, whether you know it or not.

The agentic revolution is here, but it’s hitting the same production realities that microservices did a decade ago. We learned then that robust, observable, and governable infrastructure is the bedrock. The event mesh isn’t a nice-to-have; it’s the operational nervous system that gives the protocol stack its real teeth. Without it, the agent economy will be built on sand, vulnerable and unpredictable at 3 AM and every other hour.