AGNTCY: the open standard set to structure the Internet of Agents

In my two previous articles, I described an agent economy taking shape at high speed: first tokenomics, the new discipline born of the explosion in token costs; then the payment infrastructure - x402, AP2, ACP - that lets autonomous agents pay each other for services. Each time, the same conclusion returned: technical capability always precedes the capability to govern it.

But one link was still missing from my argument. Before paying a third-party agent, you first have to be able to discover it, verify who it is, talk to it securely, and observe what it does. These four functions - discovery, identity, messaging, observability - are the invisible infrastructure without which the agent economy remains a set of islands unable to collaborate. This is exactly the problem AGNTCY sets out to solve.

AGNTCY (pronounced “agency”) is an open source project building what its proponents call the “Internet of Agents”: an open collaboration layer that lets agents find and work with one another, regardless of the framework that produced them, the vendor that designed them, or where they run. Initiated by Cisco and donated to the Linux Foundation in July 2025, the project aims to become for agents what TCP/IP and HTTP were for the web: not an application, but the foundation on which everything else is built.

This article is aimed at those who will have to design, secure and supervise these systems. We’ll unpack what AGNTCY really is: the fragmentation problem it attacks, its architecture component by component, how it fits with the protocols I’ve already described, the reasons to think it can establish itself as a standard - and, just as honestly, what could stop it.

The problem: a proliferation of agents that don’t talk to each other

Every vendor today builds its agents in its own corner, with its own framework (LangGraph, LlamaIndex, CrewAI, Google’s Agent Development Kit…), its own description format, its own security conventions. The result is predictable: silos. An agent built in one ecosystem can neither discover, query, nor trust an agent built in another. The proliferation of agents, far from creating a network, produces a mosaic of islands.

The web went through exactly this moment. Before a handful of open protocols took hold, proprietary networks - the AOLs and CompuServes of the era - each offered a rich but closed experience. Value only exploded once a common, neutral and open layer let any machine talk to any other. The intuition behind AGNTCY is that agents are at that point: real value won’t come from a proprietary super-agent, but from a fabric of interoperability that lets a thousand agents collaborate.

This diagnosis isn’t unique to AGNTCY. It’s the same logic that gave rise to Anthropic’s Model Context Protocol (MCP) for tool access, and to the Agent2Agent (A2A) protocol - also now under the Linux Foundation - for agent-to-agent communication. AGNTCY doesn’t position itself as a rival to these standards. It positions itself as the infrastructure layer that complements them and makes them work at scale.

What AGNTCY is, and what it isn’t

Let’s clear up a common confusion first. AGNTCY is not a product, nor a commercial platform, nor yet another framework for writing agents. It is an open source collective and a set of reusable specifications and components, whose purpose is interoperability.

The timeline sheds light on the intent. Cisco, through its Outshift incubator, open-sourced AGNTCY in March 2025, in collaboration with LangChain and Galileo - two players that matter, one in agent orchestration, the other in agent evaluation. A few months later, on July 29, 2025, the project was donated to the Linux Foundation. That gesture is the most important of all: it places the infrastructure under neutral governance, beyond the control of any single vendor.

“Building the foundational infrastructure for the Internet of Agents requires community ownership, not vendor control,” says Vijoy Pandey, general manager and senior vice president of Outshift by Cisco. The phrase says everything about the bet: a company deliberately gives up owning the layer it created, wagering that neutrality will generate more adoption - and therefore more value for the whole ecosystem - than exclusive ownership.

The signs of buy-in are there. Alongside Cisco, four heavyweights joined AGNTCY as formative members under the Linux Foundation - Dell Technologies, Google Cloud, Oracle and Red Hat - and the project now claims more than 75 contributing organizations, up from 65 at the time of the move to the Linux Foundation. When direct competitors like Google Cloud, Oracle and Red Hat sit at the same table to build a common layer, we’ve left the realm of experimentation for that of infrastructure setting in place - the same movement I described for the x402 Foundation in my previous article.

The architecture: four functions, one open stack

AGNTCY organizes its infrastructure around four major functions, each addressed by one or more open source components. For an architect, this is the essential reading grid: discover, identify, communicate, observe.

Discover: OASF and the Agent Directory

Before collaborating, agents have to find and understand each other. AGNTCY answers with two complementary building blocks.

The Open Agentic Schema Framework (OASF) is an extensible data model that describes an agent in a machine-readable way: its skills, interfaces, dependencies, constraints. It’s the equivalent of a standardized functional ID card. Importantly, OASF doesn’t try to supplant existing formats: it’s designed to describe agents across A2A, MCP and others, integrating with them rather than replacing them.

Above it, the Agent Directory Service (ADS) plays the role of a registry. It’s a federated registry for publishing, verifying and discovering agents and multi-agent applications. Its design reveals the demand for rigor: the directory builds on OCI registry infrastructure (the same used for container images), on content addressing, and on cryptographic signing of records. In other words, it doesn’t just “list” agents: it guarantees the integrity and provenance of each entry. Notably, AGNTCY’s directory is designed to interoperate with other internet-scale naming approaches, such as the NANDA index developed at the MIT Media Lab under Professor Ramesh Raskar - a sign that the thinking here is ecosystem-wide, not siloed.

Identify: DID, Verifiable Credentials and “Agent Badges”

This is the most strategic layer, and the one that most directly extends my earlier reflections on trust between agents. In my article on the agent economy, I flagged the question left open by the payment protocols: on what basis do you establish trust between anonymous agents that discover each other on the fly? AGNTCY provides a structured answer.

The identity framework builds on proven open standards: W3C Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs), the tamper-proof cryptographic objects I already mentioned in connection with AP2 mandates. Every agent - but also every MCP server, every multi-agent system - is given a verifiable, portable identity, independent of the platform that hosts it.

The most elegant concept is the Agent Badge: an enveloped Verifiable Credential, in the form of a JSON-LD object, that attests to a precise definition of an agent according to a given schema (an OASF definition, or an A2A AgentCard). A single agent can carry several badges - one per version or patch, for example - which makes traceable, in an immutable way, not only “who” the agent is but “exactly which version” you’re about to invoke. The project has built collaborations with digital-trust players such as Cisco Duo, Skyfire and Permit.io for onboarding, authentication and access control.

A note of caution, however, one I already voiced about ERC-8004: a verifiable identity doesn’t guarantee honest behavior. It makes behavior traceable and attributable, which is necessary but not sufficient. The signature proves who acted, not that the action was legitimate.

Communicate: SLIM, secure transport

Once an agent has been found and identified, you have to talk to it - reliably, securely and performantly. That’s the role of SLIM (Secure Low-Latency Interactive Messaging), AGNTCY’s transport layer.

SLIM is designed as a network-level messaging substrate on which application protocols like A2A, MCP or AGNTCY’s ACP can rely. It handles secure routing, publish/subscribe (pub/sub), streaming, group messaging and end-to-end encryption via MLS (Messaging Layer Security). Two characteristics deserve an architect’s attention. First, SLIM aims to be quantum-safe, meaning resistant to future quantum computing capabilities - a rare and welcome anticipation for infrastructure meant to last. Second, it natively integrates human-in-the-loop: the ability to insert human validation into a conversation between agents, exactly the kind of guardrail I recommended against the risk of agents going off the rails.

The point of separating transport (SLIM) from semantics (A2A, MCP, ACP) is architectural: application protocols focus on what agents say to each other, while SLIM guarantees how the message travels, safely and efficiently.

Observe: end-to-end telemetry and evaluation

This is the component closest to my heart, and it’s no accident that it’s been in the project’s DNA from the outset - Galileo, an AGNTCY co-founder, has made it its specialty. The Observability and Evaluation building block provides telemetry collectors, SDKs and services to observe and evaluate complex multi-agent workflows, across frameworks and vendors.

The stakes are twofold: observe (requests, latency, tokens consumed, costs, errors) and evaluate (response quality, hallucinations, drift). As Yash Sheth, co-founder of Galileo, puts it: reliable agents cannot scale without purpose-built monitoring. That conviction lines up exactly with the thread I’ve been pulling since the first article: without observability, agentic AI isn’t just technical debt, it’s financial and security debt.

To these four functions is added the Agent Connect Protocol (ACP), a standardized REST API for invoking and interacting with an agent, whatever its implementation. And for those who want to see it all in action, AGNTCY publishes CoffeeAGNTCY, a reference implementation showing how to assemble these components into a real multi-agent application.

How AGNTCY fits with MCP, A2A and x402

This is where everything I described in my previous articles comes together. Many present these standards as competitors; that’s a misreading. They stack.

Let’s take up the agentic web stack I described in my article on the agent economy. At the very bottom, MCP governs how an agent uses tools and reads data. Above it, A2A defines how two agents discover each other and delegate tasks. Then comes the payment layer - x402, AP2, ACP in the “commerce” sense - which enables settlement between agents. And at the very top, a layer of identity and trust.

AGNTCY doesn’t slot in beside this stack: it provides its connective tissue. OASF and the Agent Directory make A2A agents and MCP servers discoverable. The identity framework provides the trust layer that was missing. SLIM offers the secure transport over which A2A, MCP and ACP can travel. And observability covers the whole thing. The project is in fact explicitly interoperable with A2A and MCP: it makes A2A agents and MCP servers visible in its directories, instruments them via its SDKs, and transports their messages via SLIM.

As for payment, the junction is natural. I described how the A2A x402 extension links agent-to-agent communication to stablecoin settlement. AGNTCY provides precisely the upstream layers - finding the agent to pay, proving its identity, securing the exchange, observing everything - without which an autonomous payment would be blind. Paying an agent you can neither discover, identify, nor supervise: that’s exactly the risk these standards, together, allow you to eliminate.

Why AGNTCY can become the standard - and what could stop it

Three fundamental reasons argue for AGNTCY establishing itself as the reference layer.

The first is neutral governance. The history of open source teaches that lasting standards are those no single player owns. By donating AGNTCY to the Linux Foundation - the home of Linux, Kubernetes and PyTorch - Cisco made the choice that maximizes adoption. The fact that A2A followed the same path, under the same umbrella, creates a center of gravity that’s hard to ignore.

The second is the coalition. A standard exists only through those who implement it. Bringing together, from the start, infrastructure vendors (Dell, Oracle, Red Hat), a hyperscaler (Google Cloud), specialists in orchestration and evaluation (LangChain, Galileo) and 75 organizations around the table is to assemble the conditions for a network effect.

The third is deliberate complementarity. By refusing the protocol war and making itself interoperable with MCP and A2A, AGNTCY takes on the most defensible role: not the protocol that wins, but the infrastructure that helps the others win. It’s a less spectacular position, but historically a more solid one.

We should nonetheless guard against any triumphalism, and I’d be dishonest not to lay out the reservations. Standardization is a crowded battlefield: NANDA on the MIT side, initiatives specific to the large models, purely crypto/on-chain approaches… convergence is not guaranteed, and several competing layers may coexist for a long time. Maturity is still young: signed directories, portable reputation and decentralized identity are active work in progress, not achievements in production at scale. Developer adoption - the real deciding factor - will be measured in real implementations, not press releases. And above all, an open standard solves interoperability, not control: knowing that an agent can discover another says nothing about what it does once let loose in the wild.

The real differentiator remains operational governance

This is the point I want to insist on, because it closes the loop across the three articles. An interoperability standard is a necessary condition for the agent economy; it is not the sufficient one. The day your agents can discover, identify, talk to and pay each other at internet scale, the question will no longer be “can they collaborate?” but “do I know, at every moment, what each of them is doing, who it’s talking to, what it’s spending, and for what value?”.

That’s precisely Splunk’s focus. Agent observability is part of AGNTCY’s DNA, and that’s no accident: Splunk Agent Observability, from the acquisition of Galileo - a co-founder of the project - already offers a centralized view of agents (requests, latency, input and output tokens, costs) correlated with response quality. An open standard like AGNTCY and an observability platform aren’t at odds: they complement each other. The standard guarantees that telemetry is produced in an interoperable way, whatever the agent’s framework; the platform turns it into a single control plane - budgets, circuit breakers, anomaly detection, cost/value correlation. That’s also the whole spirit of Argos AI, the Splunk app dedicated to the agentic world that I’m developing: making agent activity legible, budgeted and auditable.

In other words, AGNTCY solves “how agents collaborate”; it’s up to organizations - and their observability partners - to solve “how I keep control.” One doesn’t go without the other.

In practice: what a technical decision-maker should do now

For anyone designing multi-agent systems today, a few principles emerge. Think in open layers: treat discovery, identity, transport and observability as distinct, standardized layers, rather than functions buried inside each agent. Bet on interoperability, not on a vendor: rely on the standards converging under neutral governance (AGNTCY, A2A, MCP) rather than on proprietary formats you’ll have to rebuild. Instrument from the very first agent: observability isn’t a layer you add after the fact, it’s a design requirement - hence the value of a standard that carries it natively. Anticipate identity and trust: adopt verifiable, portable identities (DIDs, Verifiable Credentials) early so you’re not caught out when agents cross organizational boundaries. And set hard limits: budgets, caps, circuit breakers and human validation remain indispensable, standard or not.

Conclusion

The web was born of open protocols that no one owned: HTTP to transport, HTTPS to secure, DNS to name. The Internet of Agents is replaying that founding moment, and AGNTCY proposes to be its infrastructure layer - the one that lets agents discover each other, trust each other, talk to each other and let themselves be observed, regardless of who built them. The gesture of donating it to the Linux Foundation, the coalition gathering around it, and the logic of complementarity with MCP and A2A make it one of the most credible candidates for standard status.

But my three articles converge on the same lesson. Tokenomics taught us that the capacity to consume precedes the capacity to control its cost. The agent economy taught us that the capacity to pay precedes the capacity to govern its decisions. The Internet of Agents adds a third floor to that lesson: the capacity to interoperate precedes the capacity to supervise. AGNTCY may well be the standard that holds this edifice together. It won’t excuse anyone from the only question that matters to a decision-maker: “do I know, at every moment, what my agents are doing, and for what value?”. The organizations that win the agent era won’t be those that adopt the most standards, but those that manage to turn interoperability into control.

Going further: the AGNTCY project site and its technical documentation, the announcement of the move to the Linux Foundation, the code on GitHub, the NANDA index from the MIT Media Lab and Splunk Agent Observability. Also worth reading, my two previous articles on tokenomics and on the agent economy.

SHAPE \* MERGEFORMAT

About the author

Romain Valentin is a Staff Solutions Engineer at Splunk, where for more than seven years he has helped organizations get value from their data and strengthen their digital resilience. Passionate about and expert in artificial intelligence, he explores day to day the concrete uses of agentic AI applied to security and observability. He is also the creator of Argos AI, a Splunk app dedicated to the agentic world.