The Agentic
Web Stack

Contents

Ten sections, written for the operator who has to make a build decision this quarter. Every exhibit states its takeaway in the title and cites its source. Where a number is reported rather than independently audited, we say so.

Visibility got you found. Callability gets you used.

For two years we have told clients the same thing: stop optimizing for Google, start optimizing for trust. Become the answer, do not just appear in it. That is still true. But a new layer is forming underneath it, and most teams cannot see it yet. The answer is no longer the end of the journey. The agent is starting to act on the answer.

Here is the thing most marketing teams have not internalized. Being cited in an AI answer gets you into the consideration set. That is the game we have spent two years helping clients win. But the moment the agent stops recommending and starts doing, booking the demo, pulling live pricing, starting the trial, comparing you against two competitors and picking one, citation alone is not enough. The agent has to be able to call your system. If it cannot, you are eliminated before the funnel even begins, no matter how good your content is.

That is what MCP, A2A, and WebMCP are. Not developer trivia, not a standards-body footnote. They are the rails autonomous agents run on. MCP is how an agent calls a tool. A2A is how one agent hands work to another. WebMCP is how an agent operates your website without screen-scraping it. A brand that exposes none of these is, to an agent, exactly what a business with no website was in the year 2000: technically real, functionally invisible.

So we now think about discoverability in three layers, and they stack. Visibility is whether the agent can find you. Citability is whether it trusts you enough to say your name. Callability is whether it can actually invoke you and complete the task. Most of the market is still fighting for visibility. A smaller group has figured out citability. Almost no one is building for callability yet. That gap is the opportunity, and it is the reason we wrote this report.

One more thing, because it matters to how you read what follows. This is an early market. WebMCP is in preview. A few of the adoption numbers in this report are reported by the same organizations that built the protocols, and we flag every one of those rather than dressing them up as audited fact. We would rather you trust the report than be impressed by it. But the direction is not ambiguous, and the compounding dynamics that made early SEO moats so durable are already visible here. The only real question is whether you move before your competitors do, or after.

Three open protocols are quietly rewiring how the web works.

Model Context Protocol (MCP), Agent-to-Agent (A2A), and WebMCP are not competing standards. They are three layers of one stack that lets AI agents discover tools, delegate work to other agents, and operate websites as structured function calls instead of rendered HTML. For brands and technical leaders, this is as foundational as the arrival of HTTP and REST. The web is becoming a programmable surface that agents can call.

The shift is structural, not cyclical. Gartner projects that 40% of enterprise applications will embed task-specific AI agents by the end of 2026, up from less than 5% in 2025. In the same window, Gartner expects traditional search volume to fall 25% as agents intermediate more discovery. The protocols below are the infrastructure that transition runs on, and adoption is already compounding.

The five shifts every executive needs to understand

Eight findings that define the agentic stack.

If you read nothing else, read this. Each figure is drawn from primary documentation, governance announcements, or ecosystem analysis. Where a number is reported by the protocol's own backers rather than independently audited, the source column says so, because that distinction changes how you should weight it.

MCP reached 100M downloads faster than React did.

The shift from AI assistants to AI agents is architectural, not incremental. Assistants answer. Agents act: they call APIs, read documents, place orders, and coordinate with other agents. The clearest evidence of that transition is the adoption curve of the protocol underneath it.

MCP launched in November 2024 at roughly 2 million monthly downloads. Each subsequent jump maps to a single institutional adoption event, not a slow organic climb. OpenAI standardizing on MCP in April 2025 took it to 22M almost overnight. Microsoft's Copilot Studio integration pushed it to 45M. AWS support brought it to 68M. By March 2026 the combined Python and TypeScript SDKs reached 97M monthly downloads.

Three protocols separated from the pack. One foundation now governs all of them.

Protocol wars usually take a decade. HTTP needed roughly five years to bury Gopher. TCP/IP spent most of the 1980s displacing the OSI model that committees had blessed as the official future. The agentic stack is settling in under two years, and it is settling around three protocols that no longer have a serious challenger.

MCP arrived from Anthropic in November 2024 and won the agent-to-tool layer. A2A arrived from Google in April 2025 and won the agent-to-agent layer. WebMCP, shepherded through the W3C by Microsoft and Google, is claiming the browser edge. The striking part is not that three protocols exist. It is that the same companies who would normally fight to own a standard chose instead to put all three under one neutral roof.

In December 2025, A2A was donated to the Linux Foundation. The frontier labs and hyperscalers then converged on shared governance of the stack, with Anthropic, OpenAI, Google, Microsoft, AWS, Block, and Cloudflare all backing the same protocols rather than splintering into rival camps. When competitors stop building moats around the plumbing, it is because they have decided the plumbing is settled and the value has moved up the stack. That is the signal worth reading.

One question decides which protocol you need: is the work vertical or horizontal?

Almost every architecture mistake in agentic systems comes from reaching for the wrong protocol. The fix is a single distinction. Vertical work is an agent reaching down to a tool, an API, or a dataset. Horizontal work is one agent handing a task sideways to another agent. The browser edge is a third plane entirely, where an agent operates a live website on a user's behalf. Three planes, three protocols, no overlap.

Read top to bottom, the stack also describes a single user request as it travels. A request enters at the agent. The agent reaches down through MCP to gather tools and data. It reaches across through A2A when a task belongs to a specialist agent. And when the task lands on a website built for humans, WebMCP lets the agent operate it directly instead of guessing at pixels. Sections 03 and 04 walk each layer in turn, then show all three working on one order.

MCP gives every tool one plug. The agent learns it once and uses it everywhere.

The Model Context Protocol is the agent-to-tool layer. Anthropic open-sourced it in November 2024 with a deliberately small surface: a single message format and three primitives. That restraint is why it spread. A developer who has wired one MCP server has effectively wired all of them, and an agent that speaks MCP can pick up a new tool without a single line of custom glue.

Everything an MCP server offers falls into one of three primitives, and the distinction is about who is in control. That control model is what keeps an autonomous agent from doing something the application or user never authorized.

Under the hood the protocol is intentionally boring. Messages are JSON-RPC 2.0. Transport is either stdio for a tool running on the same machine, or Streamable HTTP for a remote server, which replaced the older HTTP-plus-SSE approach. Boring is the point. Boring is what 10,000 servers can agree on.

It turned an integration problem that multiplies into one that adds.

Before a standard existed, connecting AI models to tools was a multiplication problem. Every model needed a bespoke integration with every tool, and each one had to be built, tested, and maintained separately. Five models and twenty tools meant one hundred brittle connections. MCP collapses that into addition. Each model speaks the protocol once. Each tool exposes it once. The total stops exploding.

A2A lets agents hire each other without exposing how they work inside.

Where MCP connects an agent to its tools, A2A connects an agent to other agents. Google introduced it in April 2025 to solve a different problem: a single agent cannot be expert at everything, so it needs a way to delegate. A2A lets one agent hand a task to another and receive a result, without either side revealing its internal prompts, models, or logic. Agents collaborate as opaque peers, which is exactly what makes them safe to combine across company boundaries.

Discovery starts with an Agent Card, a small public document an agent publishes to advertise what it can do and how to reach it. Think of it as the agent-era equivalent of a sitemap: the machine-readable front door other agents read before they ever send work.

{
  "name": "Procurement Agent",
  "description": "Sources vendors and negotiates terms",
  "url": "https://agents.acme.com/procurement",
  "capabilities": { "streaming": true, "pushNotifications": true },
  "skills": [ "find_vendors", "request_quote", "compare_terms" ],
  "signature": "<JWS, RFC 7515>"  // signed in A2A v1.0
}

Once two agents agree to work together, the unit of collaboration is a Task, and every task moves through a defined lifecycle. That lifecycle is what lets a fast agent delegate to a slow one and keep working, because progress streams back over Server-Sent Events and long jobs can fire a push notification when they finish.

In one year, A2A went from launch to signed, governed, and production-grade.

A protocol is only as trustworthy as its governance. A2A spent its first year doing the unglamorous work that turns an interesting idea into infrastructure an enterprise will actually deploy: gathering backers, moving to neutral ownership, and adding the security primitives that let agents trust a stranger's Agent Card.

The single most important addition was the signed Agent Card. In v1.0, an agent can cryptographically sign the document it publishes, using a JSON Web Signature per RFC 7515. That turns the Agent Card from a claim into a credential. A receiving agent can verify that the card genuinely belongs to the organization it names before it routes real work or money through it.

WebMCP hands an agent a clean set of tools, instead of making it guess at pixels.

The last layer is the one most brands can act on first, because it lives on your own website. Today, when an agent has to use a site built for humans, it screen-scrapes: it reads the rendered page, guesses which button does what, and clicks. That is slow, brittle, and breaks every time you ship a redesign. WebMCP replaces guessing with declaring. The site itself tells the agent what actions are available and how to call them.

It reached an early preview in Chrome in February 2026 and is being standardized through the W3C Web Machine Learning Community Group. It deliberately exposes only the Tools primitive from MCP, not Resources or Prompts, which keeps the security surface small. There are two ways to adopt it, and they trade lift against control.

// The page registers a tool the browser agent can call directly
navigator.modelContext.registerTool({
  name: "search_products",
  description: "Search the catalog by query and filters",
  inputSchema: { /* JSON Schema for query, filters */ },
  async execute({ query, filters }) {
    const results = await store.search(query, filters);
    return { results };
  }
});

One request. Three protocols. Each doing the one job it was built for.

Picture an operations lead who tells a company agent: "Reorder 500 units of packaging before Friday, and keep it under budget." That single sentence cannot be served by any one protocol. It needs internal data, it needs a specialist to source vendors, and it needs to transact on websites built for humans. Watch how the stack divides the work.

No layer is doing another's job. MCP never tries to negotiate with a vendor. A2A never screen-scrapes a website. WebMCP never reaches into your ERP. That separation is what makes the system debuggable, swappable, and safe to extend. Replace the Procurement Agent with a better one tomorrow and nothing else changes, because the contract between layers is the protocol, not the implementation.

Follow the request step by step, and notice where a brand can be present.

Here is the same request again, this time as the agent actually executes it. The protocol in play at each step is named, because the lesson for any brand is in the handoffs: every step is a place an agent either can or cannot reach a given company.

Choose the protocol by the verb: use, work with, or operate.

If you remember one thing from this section, make it the bottom row. When an agent needs to use a tool or data, that is MCP. When it needs to work with another agent, that is A2A. When it needs to operate a website built for humans, that is WebMCP. Everything else in this table follows from that.

Visibility got you found. Citability got you cited. Callability gets you used.

Every framework we have built at MaximusLabs starts from one belief: you win the AI era by being trustworthy to a machine, not by gaming it. The agentic stack adds a layer to that belief. There are now three things an agent must be able to do with your brand, and they stack. Each one is necessary for the next, and the market thins out fast as you climb.

The reason this matters is sequencing. A brand stuck at Visibility is fighting to be found in a world that has moved on to trust. A brand that has earned Citability but ignored Callability gets recommended and then watches the agent fail to act, because there is nothing to call. The work of the next two years is climbing from the middle tier to the top one, and the brands that start now will own the apex while it is still empty.

Callability is not one switch. It is three surfaces, and you already own the first.

"Become callable" sounds like a backend megaproject. It is not, if you sequence it right. There are exactly three surfaces an agent can reach you through, they map one-to-one onto the three protocols, and they are not equally hard. Start with the one you fully control today, your website, and earn the rest over time.

Notice what this reframes. The work of becoming callable is not separate from the work your marketing team already does. It is the same intent pages, the same product surfaces, the same brand promises, made legible to a new kind of reader. The brand that treats agent-readiness as a content discipline, not an IT project, moves first.

The agentic discovery funnel just added a stage before its first stage.

The accepted model of agentic discovery has four stages: an agent includes you in what it can reach, extracts facts from you, selects you for the answer, and presents you to the user. That model is correct, and it is now missing its first step. None of those four can happen if the agent cannot connect to you in the first place. Connectability is the new gate, and it sits in front of everything else.

The first wave of MCP servers was built by developers, for developers.

More than 10,000 active MCP servers now run in production. Where they cluster tells you who moved first, and where the open ground is. Developer tooling and data platforms dominate, because engineers built the protocol and wired up their own stack first. Customer-facing categories, the ones that touch revenue, are still thin. That gap is the opportunity for any brand willing to be early.

When all three hyperscalers ship the same protocol, adoption stops being a choice.

A2A no longer needs evangelism. It is wired into the three platforms where enterprises already build their agents, which means adoption now happens by default: deploy an agent on AWS, Azure, or Google Cloud and you are speaking A2A whether you set out to or not. That is what infrastructure looks like in its quiet phase.

Adoption outran security. The most-deployed protocol is the most exposed.

Here is the uncomfortable half of the story. The protocol stack grew faster than its security practices, and the public MCP ecosystem carries real, exploitable flaws today. This is not a reason to stay out. Block, Bloomberg, and hundreds of Fortune 500 companies run MCP safely. It is a reason to treat a public MCP server as a security project, not a config change.

Block's internal AI development was bottlenecked by 340 custom connectors, each a bespoke bridge between an AI application and a data source, each needing its own maintenance, version pinning, and upgrade cycle. The connectors were not the product. They were the tax on building the product.

A protein producer and a foodservice distributor needed their systems to coordinate in real time: availability, pricing, logistics. The catch is that they are separate companies running different AI agent frameworks, and neither could expose its internal systems to the other. This is exactly the problem A2A was built for.

The money is moving to the layer that hosts and bridges the protocols.

The question is no longer whether the stack wins. It is how fast.

The slope is already visible, so the honest forecast is about rate, not direction. Below are the headline projections we hold to, each tagged with how confident we are and why. We would rather give you a number you can argue with than one you have to take on faith.

The cheapest time to be callable is while WebMCP is still in preview.

There is a recurring pattern in platform shifts: the disproportionate winners are the ones who move during the preview, not after the launch. The brands that shipped mobile-optimized sites in 2010 and 2011, before Google's mobile-first indexing made it mandatory, captured an advantage that compounded for years. WebMCP is at that exact moment now. Adoption is low, agents are actively probing which sites have structured interfaces, and the cost of being early has never been lower.

Eight moves, three roles, all of them startable this week.

None of this requires a transformation program. It requires the three people who already own discoverability, infrastructure, and content strategy to each make a first move. Here is the shortest path for each of them.

Score yourself out of three. Most brands start at zero.

Callability is not a vibe, it is a count. There are exactly three surfaces an agent can reach you through, so your readiness is a number between zero and three. Run this scorecard honestly before you plan anything, because the gap it exposes is usually larger than teams expect.

What we measured, what we inferred, and where we have skin in the game.

A report is only as good as its willingness to show its work. We draw on primary protocol documentation, official governance announcements, first-party ecosystem analysis, and independent security research, across a window from MCP's November 2024 launch through May 2026. Where a figure is reported by an interested party rather than independently measured, we weight it accordingly, and so should you.

Every headline number in this report traces to a primary source.

Thirty-two public sources, listed in order of first appearance: protocol specifications, vendor announcements, security advisories, and independent adoption trackers. Internal MaximusLabs strategy documents that inform our point of view are cited in the methodology and are not reproduced here.