/learn
How agents talk to tools and to each other
One chapter per mechanism, each opening with an animation. Every message is sent by the Agent_Loop_Sim engine's protocol state machines, whose sessions equal the official MCP SDK's (and, for A2A, the official A2A SDK's), message for message. Toggle layers (Concept / Maths / Code) inside any chapter to choose how deep to go. For the slides behind each chapter, see the MCP series and OAuth for MCP.
N agents and M tools need N·M adapters point to point, or N+M implementations of one protocol; then one tool call followed from the model to the server and back.
Every message of a session, both protocol eras: the handshake and its version negotiation, the stateless 2026-07-28 revision, progress, errors, pagination and cancellation.
The three things a server offers, told apart by who decides to use them: the model, the application or the user. The same document reaches the model all three ways.
stdio pipes against Streamable HTTP: bytes of framing and time per message, and an SSE stream that breaks mid-call, resumed in one revision and sent again in the next.
When a server needs the user or a model, the direction reverses: a request from the server (2025-11-25) or an input_required result and a retry (2026-07-28), with the human gates in the host.
The OAuth 2.1 flow an HTTP MCP server requires, step by step: discovery, registration, PKCE as SHA-256, the token's audience; and nine ways to break it, each failing at its own check.
One gateway in front of many servers: tool names that collide, a prefix that keeps them apart, an allow-list that cuts the tool list's token cost, and a call routed to the right server or the wrong one.
An agent delegating to another over A2A 1.0: the agent card, a task's life cycle across two agents, streaming, input and auth required, cancellation; and where A2A and MCP overlap and differ.
Three attacks at the protocol level, tool poisoning, a confused deputy and a hijacked state handle, each shown at the step where it happens, then again with the defence that stops it.