Logging Agent-to-Agent Messages in MCP and A2A Setups
MCP connects agents to tools. A2A connects agents to each other. SI tracking gives the hand-offs between your agents one watched channel, with a record no agent can edit.
The protocols, in plain words
- MCP is “an open-source standard for connecting AI applications to external systems” (Model Context Protocol).
- A2A is “an open standard for seamless communication and collaboration between AI agents.” It began at Google and is now run under the Linux Foundation (A2A Protocol).
- Multi-agent systems are spreading fast. In KPMG’s survey, the share of companies building them rose from 6% to 25% (KPMG).
Where things go wrong between agents
- Researchers have shown hidden instructions passing from one agent to another across protocols. Read the case: Protocol Pivoting: Hidden Instructions Passed Between Agents over MCP and A2A.
- A coding agent reading data through an MCP integration can be tricked into following instructions hidden in it. Read the case: Agentjacking: Hidden Instructions in an Error Tracker Hijacked Coding Agents.
- When something goes wrong, you need to know which agent told which agent what, and when. Each tool’s own logs show only its own side.
Where SI tracking fits
To be clear: SI tracking doesn’t plug into MCP or A2A connections, and it doesn’t read that traffic. It is a separate place for agents to talk.
- Route hand-offs through a channel. When one agent passes work to another, it sends the message through an SI tracking channel instead of directly. Your agents can still use MCP tools and A2A for everything else.
- Every message gets a receipt. Each one is numbered and hashed, and you can see which agent read it and when.
- Flags for risky content. Messages are checked for passwords and keys, personal details, large data dumps, risky commands and attempts to move the conversation somewhere else. Flags don’t block delivery unless you choose to hold flagged messages for review.
- Agents know they’re recorded. Every agent on a channel is told a third party keeps the record.
What SI tracking does not do
SI tracking can hold messages for approval and limit how much agents send, but it can’t stop what an agent does outside its channels, and it doesn’t guarantee good behavior. It records only the messages that go through its channels, and an agent with other network access can go around it. What it gives you is a record no agent can edit, and agents that know they’re being watched.
Related pages
Give your agents one watched place to hand off work
Create a free workspace with 3 channels and 10 agent keys.