A2A & MCP Security Integration Demo

🛠️ What is a2ajava?

a2ajava is a powerfull agentic sdk, which is swiss knife to build agentic applicaiton , annotation-based Java library built to implement Agent-to-Agent (A2A) protocol and also Model Context Protocol (MCP). It enables the exposure of secure, semantically described agents over JSON-RPC with minimal configuration.
You can see the project a2ajava here

• ✅ Simple to integrate in Spring Boot or standalone Java apps
• ✅ Supports tool listing and dynamic invocation via JSON-RPC
• ✅ Enables role-based filtering using annotations like @PreAuthorize
• ✅ Auto-generates agent manifests compliant with OpenAI Tool/Function Calling and Claude Tool Use
• ✅ Powerful when combined with AI orchestration tools like OpenAI, Claude, Grok

It bridges the gap between Java backend services and AI agents needing structured capability descriptions.

🚀 Test the Demo

Run these curl commands to explore dynamic access control using A2A + MCP + Security:

1. 🔍 Agent Discovery

USER Role

curl -u user:password https://vishalmysore-a2amcpdemo.hf.space/.well-known/agent.json

Returns a list of user-accessible tools like booking cars or checking status.

ADMIN Role

curl -u admin:admin https://vishalmysore-a2amcpdemo.hf.space/.well-known/agent.json

Includes advanced capabilities like canceling bookings or scheduling maintenance.

Anonymous Access

curl https://vishalmysore-a2amcpdemo.hf.space/.well-known/agent.json

Returns only tools publicly exposed without login.

2. 🔧 List Tools

Unauthenticated

curl -H "Content-Type: application/json" -d '{"jsonrpc":"2.0","method":"tools/list","params":{},"id":9}' https://vishalmysore-a2amcpdemo.hf.space/

With USER Role

curl -u user:password -H "Content-Type: application/json" -d '{"jsonrpc":"2.0","method":"tools/list","params":{},"id":9}' https://vishalmysore-a2amcpdemo.hf.space/

With ADMIN Role

curl -u admin:admin -H "Content-Type: application/json" -d '{"jsonrpc":"2.0","method":"tools/list","params":{},"id":9}' https://vishalmysore-a2amcpdemo.hf.space/

3. ⚙️ Tool Execution

Cancel Booking (ADMIN)

curl -u admin:admin -H "Content-Type: application/json" \
-d '{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "cancelCarBooking",
    "arguments": {
      "provideAllValuesInPlainEnglish": {
        "arg0": "2233"
      }
    }
  },
  "id": 25
}' \
https://vishalmysore-a2amcpdemo.hf.space/

Book Car (USER)

curl -u user:password -H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"bookCar","arguments":{"provideAllValuesInPlainEnglish":{"arg0":"sedan","arg1":"toronto","arg2":"vancouver"}}},"id":1}' \
https://vishalmysore-a2amcpdemo.hf.space/

🔐 Features Demonstrated

• Role-based access control using Spring Security
• @PreAuthorize annotations control tool visibility and execution
• Dynamic agent.json generation per user role
• a2ajava framework simplifies exposing secure tools
• Cross-language support (Python/Java clients)
• Deploy anywhere: HF Space, Render, or your own server

📚 Learn More

Explore the full source code, setup instructions, and more at:

GitHub Repository: a2a-mcp-with-security