SWT3 as the Evidence Layer for Agent Protocols: MCP + A2A

1. Two Protocols, One Evidence Gap

MCP (Model Context Protocol) standardizes how AI assistants access external tools, resources, and prompts. It defines a client-server architecture where the AI model is the client and external services are the servers. MCP handles tool discovery, invocation, and response formatting. It does not record what happened during the tool call, whether the call was authorized, or whether the result was within expected parameters.

A2A (Agent-to-Agent) standardizes how autonomous agents discover and delegate tasks to each other. It defines a task lifecycle (submitted, working, completed, failed) and a discovery mechanism (Agent Cards at /.well-known/agent.json). A2A handles delegation and coordination. It does not record who delegated to whom, what context crossed agent boundaries, or whether the delegated agent was operating within governance.

These are complementary protocols. An orchestrator agent might use A2A to delegate a task to a specialist agent, which then uses MCP to call external tools. The resulting architecture has two protocol layers but zero evidence layers.

The regulatory landscape assumes otherwise:

• EU AI Act Art. 12: High-risk AI systems must produce logs that allow tracing of system operation throughout its lifecycle.
• NIST AI 600-1: AI agents with autonomous capabilities must maintain evidence of decision provenance.
• Five Eyes "Careful Adoption": Cryptographic agent identity and continuous behavioral monitoring across agent boundaries.
• OWASP Agentic Top 10: Excessive agency, tool misuse, and confused deputy attacks all assume some form of access logging exists.

SWT3 is the evidence layer. It sits beneath both MCP and A2A, witnesses consequential events in both protocols, and produces independently verifiable cryptographic anchors. It does not modify either protocol. It observes and records.

2. Architecture

The key architectural principle: SWT3 is protocol-agnostic infrastructure. Like TLS provides encryption beneath HTTP and SMTP, SWT3 provides evidence beneath MCP and A2A. Each protocol has its own set of witness procedures, but all anchors share the same format, the same fingerprint formula, and the same verification mechanism.

This means an assessor verifying an MCP tool invocation anchor uses exactly the same process as verifying an A2A delegation anchor. The evidence is uniform. The protocols are different. The accountability layer is shared.

3. Coverage Map

SWT3 defines dedicated procedures for each protocol surface. MCP procedures cover the tool integration lifecycle. A2A procedures cover the agent delegation lifecycle. Supporting procedures from the AI namespace provide cross-cutting evidence for both.

MCP Procedures

A2A Procedures

Cross-Cutting Procedures (Both Protocols)

4. NIST + Five Eyes Alignment

Three recent government publications establish the regulatory baseline for agent protocol governance. All three assume that evidence production is a solved problem. SWT3 solves it.

NIST AI Agent Standards Initiative (February 2026)

NIST launched the AI Agent Standards Initiative to develop measurement science for autonomous AI systems. The initiative identifies four areas where standards are needed: agent identity, agent accountability, agent interoperability, and agent safety. SWT3 directly addresses the first two:

• Agent identity: AI-ID.1 binds a cryptographic identity to every anchor minted by an agent, persisting across sessions and protocol boundaries
• Agent accountability: AI-A2A.1, AI-MCP.1-5, and AI-TOOL.1 produce independently verifiable evidence of every consequential agent action

NCCoE Concept Paper: AI Agent Governance

The National Cybersecurity Center of Excellence published a concept paper outlining governance patterns for AI agents in enterprise environments. Key recommendations mapped to SWT3:

Five Eyes "Careful Adoption" Guidance (April 2026)

The joint CISA/NSA guidance, endorsed by Australia, Canada, New Zealand, and the UK, establishes five risk categories for agentic AI. SWT3 procedures map to each. See the full crosswalk in the CISA Agentic AI Crosswalk.

5. For Assessors

When auditing an agent-based system that uses MCP, A2A, or both, the following evidence artifacts should be present in the witness ledger.

MCP Audit Checklist

A2A Audit Checklist

Verifying Anchors

Every anchor, regardless of protocol context, can be verified at /verify/. The verification process is identical for MCP and A2A anchors:

• Navigate to the Anchor Verifier
• Enter the anchor token (e.g., SWT3-E-AWS-AI-AIMCP1-PASS-1774900000-a1b2c3d4e5f6)
• The verifier confirms that the anchor's fingerprint has not been altered since it was minted

6. Quick Start

Three lines to start witnessing each protocol context.

MCP Context (Tool Invocation)

# Python: witness an MCP tool call
from swt3_ai import Witness
witness = Witness(api_key="axm_live_...", tenant_id="YOUR_TENANT")
witness.wrap_tool(my_tool_function)(tool_args)

// TypeScript: witness an MCP tool call
import { Witness } from "@tenova/swt3-ai";
const witness = new Witness({ apiKey: "axm_live_...", tenantId: "YOUR_TENANT" });
witness.wrapTool(myToolFunction)(toolArgs);

A2A Context (Task Delegation)

# Python: witness an A2A task delegation
from swt3_ai import Witness
witness = Witness(api_key="axm_live_...", tenant_id="YOUR_TENANT")
witness.witness_task_lifecycle(task_id="task-001", state="submitted", target_agent="analyst")

// TypeScript: witness an A2A task delegation
import { Witness } from "@tenova/swt3-ai";
const witness = new Witness({ apiKey: "axm_live_...", tenantId: "YOUR_TENANT" });
await witness.witnessTaskLifecycle({ taskId: "task-001", state: "submitted", targetAgent: "analyst" });

Combined Context (Orchestrator with Both Protocols)

from swt3_ai import Witness
from swt3_ai.adapters.a2a import wrap_a2a

witness = Witness(
    api_key="axm_live_...",
    tenant_id="YOUR_TENANT",
    agent_id="orchestrator-v1",
)

# Wrap the A2A agent for delegation witnessing
analyst = wrap_a2a(analyst_client, witness=witness)

# Wrap tools for MCP witnessing
search = witness.wrap_tool(search_function)

with witness.chain("financial-review-q3") as ctx:
    # MCP: call search tool (AI-TOOL.1 anchor)
    data = search(query="Q3 revenue by region")

    # A2A: delegate analysis (AI-A2A.1 anchor)
    result = analyst.send({"text": f"Analyze: {data}"})

    # Both anchors share the same chain context
    # Full forensic reconstruction via: witness.query_chain("financial-review-q3")

The chain context manager links MCP and A2A anchors into a single auditable workflow. During forensic reconstruction, the full sequence is visible: tool calls, agent delegations, context transfers, and results, all linked by a shared contextId.