{
  "title": "Combined MCP and A2A Security Checklist",
  "schemaVersion": "1.0",
  "researchFreeze": "2026-08-26",
  "protocolRevision": "MCP 2026-07-28 / A2A 1.0",
  "mcpRevision": "2026-07-28",
  "a2aCompatibilityLine": "1.0",
  "a2aWebsiteSpecificationLabel": "1.0.0",
  "a2aRepositoryPatchTag": "v1.0.1",
  "a2aVersionSemantics": "A2A negotiates major.minor 1.0; patch tags identify specification releases and are not negotiated.",
  "count": 20,
  "records": [
    {
      "Control area": "Identity",
      "Checklist item": "Record end user, client agent, remote agent, MCP client/server and service identities.",
      "Owner": "Platform plus application/server/agent owners",
      "id": "R8-CTRL01",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Control area": "Delegation",
      "Checklist item": "Bind authority to purpose, scope, tenant and expiry.",
      "Owner": "Platform plus application/server/agent owners",
      "id": "R8-CTRL02",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Control area": "Authorization",
      "Checklist item": "Recheck at every MCP and A2A boundary and in underlying systems.",
      "Owner": "Platform plus application/server/agent owners",
      "id": "R8-CTRL03",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Control area": "Approval",
      "Checklist item": "Distinguish permission to delegate from permission to execute destructive tools.",
      "Owner": "Platform plus application/server/agent owners",
      "id": "R8-CTRL04",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Control area": "Tool policy",
      "Checklist item": "Allowlist high-risk MCP servers and tools; validate arguments semantically.",
      "Owner": "Platform plus application/server/agent owners",
      "id": "R8-CTRL05",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Control area": "Agent policy",
      "Checklist item": "Approve Agent Cards/agents/skills independently of discovery metadata.",
      "Owner": "Platform plus application/server/agent owners",
      "id": "R8-CTRL06",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Control area": "Provenance",
      "Checklist item": "Label Messages, Artifacts, resources and tool results with origin.",
      "Owner": "Platform plus application/server/agent owners",
      "id": "R8-CTRL07",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Control area": "Injection defense",
      "Checklist item": "Treat all cross-protocol content and metadata as untrusted.",
      "Owner": "Platform plus application/server/agent owners",
      "id": "R8-CTRL08",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Control area": "Tasks",
      "Checklist item": "Enforce Task ownership, retention, expiry, cancellation and authorization changes.",
      "Owner": "Platform plus application/server/agent owners",
      "id": "R8-CTRL09",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Control area": "Callbacks",
      "Checklist item": "Authenticate push endpoints; block SSRF and validate callback origins.",
      "Owner": "Platform plus application/server/agent owners",
      "id": "R8-CTRL10",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Control area": "Tenancy",
      "Checklist item": "Carry tenant context immutably and prevent cache or Artifact leakage.",
      "Owner": "Platform plus application/server/agent owners",
      "id": "R8-CTRL11",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Control area": "Secrets",
      "Checklist item": "Never forward bearer tokens or secrets across protocols without explicit token exchange.",
      "Owner": "Platform plus application/server/agent owners",
      "id": "R8-CTRL12",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Control area": "Audit",
      "Checklist item": "Correlate user request, A2A Message/Task, MCP request/Task and upstream action.",
      "Owner": "Platform plus application/server/agent owners",
      "id": "R8-CTRL13",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Control area": "Observability",
      "Checklist item": "Measure latency, retries, failures, state transitions and policy decisions.",
      "Owner": "Platform plus application/server/agent owners",
      "id": "R8-CTRL14",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Control area": "Revocation",
      "Checklist item": "Stop or restrict work when user, agent or tool authority is revoked.",
      "Owner": "Platform plus application/server/agent owners",
      "id": "R8-CTRL15",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Control area": "Data minimization",
      "Checklist item": "Send only context required by the remote agent or capability.",
      "Owner": "Platform plus application/server/agent owners",
      "id": "R8-CTRL16",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Control area": "Output controls",
      "Checklist item": "Scan Artifacts and results before execution, storage or forwarding.",
      "Owner": "Platform plus application/server/agent owners",
      "id": "R8-CTRL17",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Control area": "Supply chain",
      "Checklist item": "Review MCP packages, A2A SDKs, agent endpoints and dependencies.",
      "Owner": "Platform plus application/server/agent owners",
      "id": "R8-CTRL18",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Control area": "Conformance",
      "Checklist item": "Use current SDK tests/TCKs but do not treat conformance as security certification.",
      "Owner": "Platform plus application/server/agent owners",
      "id": "R8-CTRL19",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Control area": "Incident response",
      "Checklist item": "Maintain kill switches for agents, servers, credentials and callbacks.",
      "Owner": "Platform plus application/server/agent owners",
      "id": "R8-CTRL20",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    }
  ]
}