Four agent-payment standards, usually compared on rails. The axis that matters is where the spending cap is stored — a pre-funded wallet, an issuer rule, a one-checkout token, or a mandate the user signed — because that fixes how much a prompt-injected agent can spend before anything else gets a vote.
A2UI sends JSON and MCP Apps sends sandboxed HTML — the least consequential difference between them. One has the agent compose components you own, moving the review into your design system; the other installs an interface someone else wrote, moving it to the server boundary. Sort your surfaces by whether you can enumerate them, then pick.
Five rival vendors agreed on a directory layout on 6 August, and explicitly declined to agree on install, distribution, permissions, sandboxing or provenance. The format makes one bundle of instructions plus credentialed tool access portable across six clients — which is exactly why the compensating controls are now yours.
Every identity vendor now sells “auth for AI agents”, and the phrase covers two opposite problems: letting an agent into your app, and letting your agent out to someone else’s API. Pick on direction first — and notice that a token vault holding a user’s full grant has relocated the credential rather than shrunk it.
Google's shopping agent now phones local shops to check stock — a channel that carries none of the signed identity, scoped authorisation, replay protection or verifiable receipts that AP2 and its rivals were built to provide. The phone is not a stopgap on the way to universal protocol adoption; it is the permanent floor of agent commerce, covering the merchant tail that will never implement an API, and it has no trust primitives at all.
The 28 July specification retires the initialize handshake and the Mcp-Session-Id header, and every write-up so far has framed that as plumbing. It is not. Dropping the held-open connection forced Sampling, Roots and Logging onto a twelve-month deprecation clock — and those were the features that made an MCP client a peer rather than a caller. The protocol just settled what it is.
Two years from Anthropic's launch, MCP isn't a debate — it's a dependency. Every frontier vendor, every major IDE, and one Pinterest team saving 7,000 engineering hours a month all ship against it. The interesting question is no longer *should you use MCP* — it's what fails at this scale and how the 2026 roadmap plans to fix it.