RA2A
Comprehensive Rust SDK for the Agent2Agent (A2A) Protocol v1.0 — event-driven server, streaming client, gRPC transport, push notifications, and pluggable SQL task storage.
ra2a implements the full A2A protocol specification v1.0 with an idiomatic Rust API, providing a Client → Transport → AgentCard discovery flow on the client side and an AgentExecutor → EventQueue → RequestHandler pipeline on the server side. It is functionally aligned with the official Go SDK — same protocol version, same 12 JSON-RPC methods, same type definitions, same error codes.
Crates
| Crate | Description | |
|---|---|---|
ra2a |
SDK — Client, Server, Types, gRPC, task storage | |
ra2a-ext |
Extensions — extension activator, metadata propagator interceptors |
Quick Start
Server
The SDK provides composable Axum handlers — you own the router, listener, TLS, and middleware.
use ;
use ;
;
async
Client
use Client;
use ;
async
Architecture
ra2a crate
| Layer | Key types | Role |
|---|---|---|
| Types | AgentCard, AgentInterface, Task, Message, Part |
Full A2A v1.0 type definitions with serde, proto-aligned |
| Server | AgentExecutor, EventQueue, DefaultRequestHandler |
Event-driven agent execution; composable Axum handlers (a2a_router) — SDK does not own the HTTP server |
| Client | Client, Transport, CallInterceptor |
Transport-agnostic client with interceptor middleware, streaming fallback, and ClientConfig defaults |
| Storage | TaskStore, PushNotificationConfigStore |
Pluggable persistence (in-memory, PostgreSQL, MySQL, SQLite) |
| gRPC | GrpcTransport, GrpcServiceImpl |
Alternative transport via tonic/prost, compiled from the official proto |
ra2a-ext crate
| Component | Role |
|---|---|
ExtensionActivator |
Client interceptor — requests extension activation filtered by AgentCard capabilities |
ServerPropagator / ClientPropagator |
Interceptor pair — propagates extension metadata and headers across agent chains (A → B → C) |
PropagatorContext |
Task-local data carrier connecting server and client interceptors |
Feature Flags
| Feature | Default | Description |
|---|---|---|
client |
yes | HTTP/JSON-RPC client, SSE streaming, card resolver, interceptors |
server |
yes | Composable Axum handlers, event queue, task lifecycle, SSE streaming |
grpc |
— | gRPC transport via tonic/prost (requires protobuf compiler) |
telemetry |
— | OpenTelemetry tracing spans and metrics |
postgresql |
— | PostgreSQL task store via sqlx |
mysql |
— | MySQL task store via sqlx |
sqlite |
— | SQLite task store via sqlx |
sql |
— | All SQL backends (postgresql + mysql + sqlite) |
full |
— | Everything (server + grpc + telemetry + sql) |
Proto Source
The protobuf definition (a2a.proto) is sourced directly from the official A2A repository via git submodule, pinned to the v1.0.0 tag. The googleapis dependency is also vendored as a submodule.
After cloning, initialize both submodules:
To upgrade the proto to a new release:
A2A Protocol Overview
Protocol Version
ra2a targets A2A v1.0 (released 2026-03-12). The a2a.proto is the normative source for the protocol data model; JSON-RPC and gRPC are separate protocol bindings derived from it.
JSON-RPC Methods
All 12 methods defined by the A2A specification are implemented on both client and server:
| Method | Description |
|---|---|
message/send |
Send a message, receive Task or Message |
message/stream |
Send a message, receive SSE event stream |
tasks/get |
Retrieve task by ID with optional history |
tasks/list |
List tasks with pagination and filtering |
tasks/cancel |
Request task cancellation |
tasks/resubscribe |
Reconnect to an ongoing task's event stream |
tasks/pushNotificationConfig/create |
Create a push notification config for a task |
tasks/pushNotificationConfig/get |
Retrieve a push notification config |
tasks/pushNotificationConfig/list |
List push notification configs for a task |
tasks/pushNotificationConfig/delete |
Delete a push notification config |
agent/getAuthenticatedExtendedCard |
Retrieve authenticated extended agent card |
Task Lifecycle
Tasks progress through well-defined states with terminal conditions:
Submitted → Working → Completed
→ Failed
→ Canceled
→ Rejected
Input Required ←→ Working
Auth Required ←→ Working
Unknown (initial/query state)
Terminal states (Completed, Failed, Canceled, Rejected) end the task lifecycle. InputRequired and AuthRequired are interactive states that resume to Working when the client responds.
Agent Discovery
Agents declare one or more AgentInterface entries in their AgentCard, each specifying a URL, transport protocol (JSONRPC, GRPC, or HTTP+JSON), and protocol version. The card is published at /.well-known/agent-card.json. The client's card resolver fetches and caches it automatically. Agents may also expose an authenticated extended card via agent/getAuthenticatedExtendedCard for capabilities that require authorization to discover.
Security Model
A2A supports five security scheme types in the AgentCard:
| Scheme | Description |
|---|---|
| API Key | Static key in header, query, or cookie |
| HTTP Auth | Bearer token or Basic authentication |
| OAuth 2.0 | Authorization code, client credentials, device code flows |
| OpenID Connect | OIDC discovery-based authentication |
| Mutual TLS | Client certificate authentication |
Push notifications use HMAC-SHA256 verification to authenticate webhook deliveries.
Security
This library has not been independently audited. See SECURITY.md for full disclaimer, supported versions, and vulnerability reporting instructions.
License
Licensed under either of:
- Apache License, Version 2.0 (LICENSE-APACHE or https://www.apache.org/licenses/LICENSE-2.0)
- MIT License (LICENSE-MIT or https://opensource.org/licenses/MIT)
at your option.
Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in this project shall be dual-licensed as above, without any additional terms or conditions.
A QNTX open-source project.
Code is law. We write both.