agent.mcp, it hands over an address and the headers that
authenticate it, and an A2A client (a2a-sdk,
@a2a-js/sdk) reads the card and
sends the calls, both through the gateway.
What an agent carries
With an A2A client
a2a_agent.py and a2a-agent.ts examples in the
SDK repository
run as they are.
For an end user
Name the person the calls are for, as withfor_end_user(). The headers then carry
X-NeuralTrust-End-User, and the call runs as that user: their tasks are theirs,
and an agent that verifies TrustGate’s token sees
them as sub.
When it fails
Errors from the agent and from the gateway’s agent plane reach the A2A client, not
the SDK: see Connect to an agent.