Kuadrant puts A2A agent traffic inside its MCP Gateway policy perimeter

Kuadrant has added an experimental Agent2Agent passthrough path to its MCP Gateway, giving platform teams a first way to apply the gateway’s existing policy controls to traffic between AI agents. The feature is off by default and deliberately stops short of agent discovery, task ownership or automatic routing.

What changed

The new --enable-a2a flag teaches the gateway router to inspect requests under an /a2a path and derive two headers: x-a2a-agent, taken from the first path segment after /a2a/, and x-a2a-method, taken from the JSON-RPC method in the request envelope. Kuadrant says the router strips client-supplied x-a2a-* headers before setting its own values, preventing callers from forging the metadata consumed by policy and telemetry.

Once those fields are ordinary trusted headers, existing Kuadrant resources can act on them. An AuthPolicy can authorize access per agent, a RateLimitPolicy can throttle agent traffic, and Telemetry configuration can include the addressed agent and A2A method in structured access logs. Unknown methods are normalized to other to bound metric cardinality, while malformed A2A requests are rejected rather than forwarded without policy metadata.

The implementation parses only the JSON-RPC envelope fields it needs, not the task payload. An operator still supplies the HTTPRoute and, where necessary, a URL rewrite from /a2a/{agent} to the endpoint exposed by the destination agent.

Who it affects

The immediate audience is platform teams running agents that delegate work to other agents while already using Kuadrant’s MCP Gateway for tool access. Kuadrant’s engineering post argues that tool calls may already pass through authentication, rate limiting and observability, while direct A2A delegation can otherwise bypass that policy perimeter.

This release slice does not provide a complete A2A control plane. It does not register or discover agents, serve agent cards, choose destinations, track task ownership or observe streamed task lifecycles. Kuadrant says those capabilities were proven in a fork but held back while their long-term API and placement remain unsettled.

What to do

Teams evaluating the feature should begin with the project’s A2A passthrough guide, enable the flag only in a test environment, and attach an HTTPRoute, AuthPolicy and Telemetry configuration. The practical validation is straightforward: confirm that callers cannot inject their own A2A headers, malformed envelopes fail closed, and access logs record the caller, destination agent, method and response outcome.

Because the feature is experimental and disabled by default, this is a lab path rather than a production migration signal. Its significance is narrower but concrete: Kuadrant can now bring inter-agent calls into the same authorization and audit machinery already used for MCP tool traffic.