Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

AgentRFC: Security Design Principles and Conformance Testing for Agent Protocols

Shenghan Zheng, Qifan Zhang

Abstract

AI agent protocols -- including MCP, A2A, ANP, and ACP -- enable autonomous agents to discover capabilities, delegate tasks, and compose services across trust boundaries. Despite massive deployment (MCP alone has 97M+ monthly SDK downloads), no systematic security framework for these protocols exists. We present three contributions. First, the Agent Protocol Stack, a 6-layer architectural model that defines what a complete agent protocol must specify at each layer -- analogous to ITU-T X.800 for the OSI stack. Second, the Agent-Agnostic Security Model, 11 security principles formalized as TLA+ invariants, each tagged with a property taxonomy (spec-mandated, spec-recommended, aasm-hardening, aps-completeness) that distinguishes protocol non-conformance from framework-imposed security requirements. Third, AgentConform, a two-phase conformance checker that (i)extracts normative clauses from protocol specifications into a typed Protocol~IR with explicit Protocol/Environment/Adversary action separation, (ii)compiles the IR into TLA+ models and model-checks them against AASM invariants, then (iii)replays counterexample traces against live SDK implementations to confirm findings. We introduce the Composition Safety (CS) principle: security properties that hold for individual protocols can break when protocols are composed through shared infrastructure. We demonstrate this with formal models of five protocol composition patterns, revealing cross-protocol design gaps that individual protocol analysis cannot detect. Preliminary application to representative agent protocols reveals recurrent gaps in credential lifecycle, consent enforcement, audit completeness, and composition safety. Some findings are under coordinated disclosure; full evaluation details will be released in the complete version.

AgentRFC: Security Design Principles and Conformance Testing for Agent Protocols

Abstract

AI agent protocols -- including MCP, A2A, ANP, and ACP -- enable autonomous agents to discover capabilities, delegate tasks, and compose services across trust boundaries. Despite massive deployment (MCP alone has 97M+ monthly SDK downloads), no systematic security framework for these protocols exists. We present three contributions. First, the Agent Protocol Stack, a 6-layer architectural model that defines what a complete agent protocol must specify at each layer -- analogous to ITU-T X.800 for the OSI stack. Second, the Agent-Agnostic Security Model, 11 security principles formalized as TLA+ invariants, each tagged with a property taxonomy (spec-mandated, spec-recommended, aasm-hardening, aps-completeness) that distinguishes protocol non-conformance from framework-imposed security requirements. Third, AgentConform, a two-phase conformance checker that (i)extracts normative clauses from protocol specifications into a typed Protocol~IR with explicit Protocol/Environment/Adversary action separation, (ii)compiles the IR into TLA+ models and model-checks them against AASM invariants, then (iii)replays counterexample traces against live SDK implementations to confirm findings. We introduce the Composition Safety (CS) principle: security properties that hold for individual protocols can break when protocols are composed through shared infrastructure. We demonstrate this with formal models of five protocol composition patterns, revealing cross-protocol design gaps that individual protocol analysis cannot detect. Preliminary application to representative agent protocols reveals recurrent gaps in credential lifecycle, consent enforcement, audit completeness, and composition safety. Some findings are under coordinated disclosure; full evaluation details will be released in the complete version.
Paper Structure (61 sections, 3 figures, 2 tables)

This paper contains 61 sections, 3 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Contributions.
  3. Paper roadmap.
  4. Background
  5. The Rise of AI Agent Protocols
  6. AI Agent Protocols Under Study
  7. MCP (Model Context Protocol) mcp2024.
  8. A2A (Agent-to-Agent) a2a2024.
  9. ANP (Agent Negotiation Protocol) anp2025.
  10. ACP-Cap (Agent Communication Protocol) acp2025.
  11. ACP-Client (Agent Client Protocol) acpclient2025.
  12. Formal Verification with TLA+
  13. Threat Model
  14. Specification Extraction and Formalization
  15. Agent Protocol Stack
  16. ...and 46 more sections

Figures (3)

  • Figure 1: The Agent Protocol Stack (APS). Green indicates all protocols pass; orange indicates at least one protocol has a gap. Left labels show mapped AASM principles; right labels show pass rates.
  • Figure 2: AgentConform architecture. Spec documents are formalized through a typed Protocol IR before generating TLA+ models. Phase 1 finds spec-level violations; Phase 2 replays traces against live implementations. Shaded boxes indicate the IR layer.
  • Figure 3: Abstract cross-protocol attack chain: a design gap in Protocol A propagates through a shared bridge to amplify delegation in Protocol B. Bridge operations fall outside both protocols' audit domains.