{
  "title": "Combined MCP and A2A Threat Model",
  "schemaVersion": "1.0",
  "researchFreeze": "2026-08-26",
  "protocolRevision": "MCP 2026-07-28 / A2A 1.0",
  "mcpRevision": "2026-07-28",
  "a2aCompatibilityLine": "1.0",
  "a2aWebsiteSpecificationLabel": "1.0.0",
  "a2aRepositoryPatchTag": "v1.0.1",
  "a2aVersionSemantics": "A2A negotiates major.minor 1.0; patch tags identify specification releases and are not negotiated.",
  "count": 15,
  "records": [
    {
      "Threat": "Agent Card spoofing",
      "Affected boundary": "A2A discovery/identity",
      "Failure mode": "Client connects to impersonated agent",
      "Mitigations": "TLS validation, trusted discovery, signed-card verification, publisher allowlists",
      "id": "R8-THREAT01",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Threat": "Stale capability metadata",
      "Affected boundary": "Both",
      "Failure mode": "Client relies on obsolete tools or skills",
      "Mitigations": "HTTP/cache TTL discipline, ETags, list-change handling, revalidation before sensitive actions",
      "id": "R8-THREAT02",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Threat": "Tool poisoning",
      "Affected boundary": "MCP metadata/model boundary",
      "Failure mode": "Malicious tool description steers model",
      "Mitigations": "Trust server publisher, filter descriptions, user confirmation, policy engine",
      "id": "R8-THREAT03",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Threat": "Skill misrepresentation",
      "Affected boundary": "A2A metadata/delegation",
      "Failure mode": "Agent claims competence or safety it does not possess",
      "Mitigations": "Reputation, conformance testing, contractual policy, outcome validation",
      "id": "R8-THREAT04",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Threat": "Prompt injection in returned content",
      "Affected boundary": "Both data planes",
      "Failure mode": "Untrusted resource/artifact steers downstream agent",
      "Mitigations": "Treat content as data, provenance labels, model isolation, output validation",
      "id": "R8-THREAT05",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Threat": "Confused delegation",
      "Affected boundary": "Combined stack",
      "Failure mode": "Agent delegates authority it does not own",
      "Mitigations": "End-to-end subject/audience binding, least privilege, policy at every hop",
      "id": "R8-THREAT06",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Threat": "Identity loss at MCP-A2A gateway",
      "Affected boundary": "Bridge",
      "Failure mode": "Downstream service sees gateway rather than original principal",
      "Mitigations": "Token exchange/delegation records, signed context, audit correlation",
      "id": "R8-THREAT07",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Threat": "Task handle theft",
      "Affected boundary": "Both task systems",
      "Failure mode": "Attacker reads/cancels another task",
      "Mitigations": "High-entropy IDs, owner/tenant authorization on every operation, TTL",
      "id": "R8-THREAT08",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Threat": "Push callback abuse",
      "Affected boundary": "A2A",
      "Failure mode": "SSRF or forged task update",
      "Mitigations": "Callback allowlists, challenge/verification, signed payloads, egress controls",
      "id": "R8-THREAT09",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Threat": "Local package compromise",
      "Affected boundary": "MCP local",
      "Failure mode": "Malicious stdio server executes with user permissions",
      "Mitigations": "Pinned packages, signatures/provenance, sandbox, minimal environment",
      "id": "R8-THREAT10",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Threat": "Excessive underlying credentials",
      "Affected boundary": "Both",
      "Failure mode": "Remote party can exceed delegated purpose",
      "Mitigations": "Scoped tokens, per-object authorization, short lifetimes, step-up approval",
      "id": "R8-THREAT11",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Threat": "Artifact poisoning",
      "Affected boundary": "A2A",
      "Failure mode": "Malicious deliverable later trusted by user/agent",
      "Mitigations": "Content scanning, signatures/provenance, safe rendering, independent verification",
      "id": "R8-THREAT12",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Threat": "Cross-tenant task leakage",
      "Affected boundary": "A2A remote",
      "Failure mode": "Task list/history crosses tenant boundary",
      "Mitigations": "Tenant-scoped authorization, storage partitioning, filtered list operations",
      "id": "R8-THREAT13",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Threat": "Cross-user cache leakage",
      "Affected boundary": "MCP remote",
      "Failure mode": "Cached lists/results reveal another user’s data",
      "Mitigations": "Correct cacheScope, Vary/auth context, no shared caching of private results",
      "id": "R8-THREAT14",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    },
    {
      "Threat": "Audit fragmentation",
      "Affected boundary": "Combined stack",
      "Failure mode": "No complete record from model decision to final action",
      "Mitigations": "Shared trace IDs, immutable logs, protocol-boundary events, outcome reconciliation",
      "id": "R8-THREAT15",
      "packageSourceIds": [
        "S003",
        "S009",
        "S047"
      ],
      "sourceIds": [
        "S339",
        "S345",
        "S133"
      ]
    }
  ]
}