Exploit for A2A-POC

Name: Exploit for A2A-POC
Rating: 5 (154 reviews)
2026-01-21 | CVSS 5.7
## https://sploitus.com/exploit?id=859FF433-686A-5B73-9687-9FEFC9E41907
# A2A Travel Agency Multi-Agent System

A Proof of Concept demonstrating **Agent-to-Agent (A2A) Communication Protocol** and **Model Context Protocol (MCP)** for cross-organizational interoperability in a travel booking scenario.

## 🎯 Overview

This system showcases how multiple specialized AI agents from different organizations can collaborate to fulfill complex user requests through standardized protocols. A Travel Agency Orchestrator coordinates with external partner agents (flights, hotels, insurance, transport) to assemble complete holiday packages.

## 🏗️ Architecture

### Layered Protocol Stack
1. **A2A Layer**: Agent identity, discovery (Agent Cards), and message transport
2. **MCP Layer**: Standardized tool definitions and execution interface

### System Components

```
┌─────────────────────────────────────────────────────────────┐
│                    React UI (Port 5173)                     │
│              Real-time SSE streaming interface              │
└────────────────────────┬────────────────────────────────────┘
                         │
┌────────────────────────▼────────────────────────────────────┐
│          Travel Orchestrator Agent (Port 8001)              │
│    • Coordinates multi-agent workflows                      │
│    • Streams progress updates via SSE                       │
│    • Handles async webhooks & polling                       │
└────────────────────────┬────────────────────────────────────┘
                         │
                         │ Discovery
┌────────────────────────▼────────────────────────────────────┐
│            Gateway Service (Port 8000)                      │
│    • Agent registration & discovery                         │
│    • Capability-based routing                               │
└─────────────────────────────────────────────────────────────┘
                         │
        ┌────────────────┼────────────────┬──────────────┐
        │                │                │              │
┌───────▼──────┐ ┌──────▼──────┐ ┌───────▼──────┐ ┌────▼─────┐
│Flight Agent  │ │Hotel Agent  │ │Insurance     │ │Transport │
│(Port 8010)   │ │(Port 8011)  │ │Agent         │ │Agent     │
│              │ │             │ │(Port 8012)   │ │(8013)    │
│• Streaming   │ │• Sync       │ │• Sync        │ │• Sync    │
│• Webhooks    │ │  search     │ │  quotes      │ │  quotes  │
│• Polling     │ │             │ │              │ │          │
└──────────────┘ └─────────────┘ └──────────────┘ └──────────┘
```

## 📁 Project Structure

```
A2A/
├── a2a/
│   ├── agents/              # A2A agent implementations
│   │   ├── agent_travel_orchestrator.py
│   │   ├── agent_flights.py
│   │   ├── agent_hotels.py
│   │   ├── agent_insurance.py
│   │   └── agent_transport.py
│   ├── mcp_servers/         # MCP tool servers with mock data
│   ├── schemas/             # Protocol & domain schemas
│   │   ├── schema_a2a.py
│   │   ├── schema_mcp.py
│   │   └── schema_travel.py
│   └── services/
│       └── gateway_service.py
├── ui/                      # React + TypeScript frontend
├── run_poc.py              # Launch all services
├── test_scenarios.py       # Automated test scenarios
└── requirements.txt
```

## 🚀 Getting Started

### Prerequisites
- Python 3.9+
- Node.js 18+ (for UI)

### Backend Setup
```bash
# Create virtual environment
python -m venv venv
.\venv\Scripts\activate  # Windows
# source venv/bin/activate  # Linux/Mac

# Install dependencies
pip install -r requirements.txt

# Launch all services
python run_poc.py
```

This starts:
- **Gateway**: http://localhost:8000
- **Orchestrator**: http://localhost:8001
- **Flight Agent**: http://localhost:8010
- **Hotel Agent**: http://localhost:8011
- **Insurance Agent**: http://localhost:8012
- **Transport Agent**: http://localhost:8013

### Frontend Setup
```bash
cd ui
npm install
npm run dev
```

Access the UI at: http://localhost:5173

## 🎬 Use Case: Holiday Package Booking

### User Journey
1. User requests a holiday to Lisbon via chat interface
2. Orchestrator analyzes request and discovers partner agents
3. Parallel coordination:
   - **Flights**: Streaming search with real-time progress updates
   - **Hotels**: Synchronous search for 4-star accommodations
   - **Insurance**: Quote calculation based on travelers & duration
   - **Transport**: Airport transfer estimation
4. Results assembled into complete package with total price
5. User sees real-time updates character-by-character via SSE

### Example Request Flow
```
User: "I need a holiday to Lisbon for 2 people, March 15-22"
  ↓
Orchestrator discovers agents via Gateway
  ↓
Flight Agent (streaming): "Searching airlines... Found 5 options..."
Hotel Agent: Returns 4-star hotels in Lisbon
Insurance Agent: Calculates quote for 2 travelers, 7 days
Transport Agent: Estimates airport transfer cost
  ↓
Complete package presented with itemized pricing
```

## ✨ Key Features Demonstrated

### Protocol Features
- ✅ **Agent Discovery**: Dynamic capability-based agent lookup
- ✅ **Agent Cards**: Self-describing agent capabilities (MCP tools)
- ✅ **JSON-RPC 2.0**: Standardized message format
- ✅ **Protocol Layering**: A2A wraps MCP for cross-org communication

### Communication Patterns
- ✅ **Synchronous RPC**: Direct request-response (hotels, insurance, transport)
- ✅ **Streaming**: Real-time progress updates (flight search)
- ✅ **Async Webhooks**: Callback-based notifications
- ✅ **Polling Fallback**: Status checking when webhooks fail

### User Experience
- ✅ **Server-Sent Events (SSE)**: Character-by-character streaming to UI
- ✅ **Real-time Progress**: Live updates during multi-agent orchestration
- ✅ **Notification Center**: Push notifications for completed tasks
- ✅ **Responsive UI**: Modern React interface with Tailwind CSS

## 🧪 Testing

### Run Test Scenarios
```bash
# All scenarios (S1-S4)
python test_scenarios.py

# Specific failure scenario
python test_s4_failure.py

# Verify backend health
python verify_backend.py
```

### Test Scenarios
- **S1**: Full happy path with all agents available
- **S2**: Flight streaming with fallback to webhooks
- **S3**: Webhook timeout with polling fallback
- **S4**: Critical agent unavailable (failure case)

## 🔧 Development

### Start Individual Services
```bash
# Terminal 1 - Gateway
python a2a/services/gateway_service.py

# Terminal 2 - Orchestrator
python a2a/agents/agent_travel_orchestrator.py

# Terminal 3 - Flight Agent
python a2a/agents/agent_flights.py

# ... etc
```

### Environment Variables
No configuration needed for POC. All services use hardcoded localhost ports.

## 📊 API Endpoints

### Orchestrator (Port 8001)
- `POST /chat/message` - Initiate booking request
- `GET /chat/stream/{task_id}` - SSE stream for real-time updates
- `POST /a2a/webhook` - Receive async agent callbacks
- `GET /notifications` - Poll for push notifications

### Gateway (Port 8000)
- `POST /register` - Agent registration
- `POST /discover` - Find agents by capability
- `GET /agents` - List all registered agents

### Partner Agents (Ports 8010-8013)
- `POST /a2a/message` - Receive A2A protocol messages
- `GET /card` - Retrieve agent card (capabilities)

## 🎓 Learning Resources

This POC demonstrates concepts from:
- [Google's A2A Protocol](https://github.com/google/a2a)
- [Model Context Protocol (MCP)](https://modelcontextprotocol.io/)
- Multi-agent orchestration patterns
- Real-time streaming architectures

## 📝 License

Educational POC - see thesis documentation for academic context.