Security threat modeling for emerging AI-agent protocols: A comparative analysis of MCP, A2A, agora, and ANP

Abstract

The rapid development of AI-agent communication protocols, including the Model Context Protocol (MCP), Agent2Agent (A2A), Agora, and the Agent Network Protocol (ANP), is reshaping how autonomous agents interact with tools, services, and one another. Although these protocols support scalable multi-agent interaction and cross-organizational interoperability, their protocol-level security properties remain insufficiently studied. In particular, no unified framework currently exists for comparing their security risks across the protocol lifecycle. This paper presents a systematic security analysis of four emerging AI-agent communication protocols. First, we develop a structured threat-modeling approach that examines protocol architectures, trust assumptions, interaction patterns, and lifecycle behaviors to identify protocol-specific and cross-protocol risk surfaces. Second, we introduce a qualitative risk-assessment framework covering twelve protocol-level vulnerabilities across the creation/configuration, operation, and update/maintenance phases. The framework evaluates likelihood, impact, and overall risk using common protocol-independent criteria and protocol-specific evidence. Third, we present a measurement-driven MCP case study that formalizes the absence of mandatory provider-bound tool identity validation as a falsifiable security claim. The experiments demonstrate that ambiguous tool-provider resolution can result in wrong-provider execution under representative resolver policies. The comparative assessment indicates that none of the four protocols provides uniformly low risk across all lifecycle stages. The assessment of all four protocols is grounded in protocol specifications, published evidence, and architecture-based reasoning, whereas the empirical validation is intentionally limited to the MCP case study. Overall, the findings reveal design-induced security gaps and provide actionable guidance for protocol designers, enterprise adopters, and future standardization efforts.

The authors' abstract, as published at the source. Journal of Information Security and Applications, 2026 · DOI ↗