Glossary

Plain definitions of MCP, A2A, Agent Skills and the rest of the agent vocabulary, with primary sources. 54 terms, each defined in one sentence, explained in a short passage written from a primary source (a specification or official documentation) that is linked on the page, with the top-ranked listings that use it.

Also: Comparisons · Alternatives · Best for · By host app · Guides · Use cases · Industries

A

A2A: A2A, short for Agent2Agent, is an open protocol that lets independent AI agents built on different frameworks, languages, or vendors discover each other, exchange messages, and coordinate tasks without exposing their internals.
Agent card: An Agent Card is a JSON document in the A2A protocol that describes a remote agent's identity, service endpoints, capabilities, skills, and authentication requirements so a client can decide whether and how to call it.
Agent harness: An agent harness is the software wrapped around a language model so it can use tools and work on a task across many steps, a term Anthropic applies to the Claude Agent SDK.
Agent hooks: Hooks in Claude Code are user-defined handlers that run at set points in its lifecycle, giving deterministic control over actions instead of relying on the model to remember them.
Agent identity: Agent identity is a distinct identity assigned to an AI agent, separate from human user and application identities, so the agent can authenticate, receive scoped access, and be recorded as an agent in logs.
Agent memory: Agent memory is stored information that an agent writes during one session and reads back in later sessions, so it can continue earlier work without holding everything in its context window.
Agent sandbox: An agent sandbox is an operating-system-enforced boundary that limits which files and network destinations the commands run by an AI agent can reach.
Agent SDK: The Claude Agent SDK is a Python and TypeScript library that exposes Claude Code's tools, agent loop and context management so developers can build their own agents.
Agent Skills: Agent Skills are folders built around a SKILL.md file that give an AI agent reusable instructions, which the agent loads only when a task calls for them.
Agent tracing: Agent tracing is the practice of recording the steps of a request or agent run as timed spans grouped into a trace, so the path of the work can be followed afterward.
AGENTS.md: AGENTS.md is an open, plain markdown file format placed in a repository to give coding agents project context such as build steps, test commands and conventions.
AP2: AP2, the Agent Payments Protocol, is an open protocol that defines how an autonomous agent can be authorized to make a payment, using signed mandates so that authorization, authenticity, and accountability can be verified.

B

Browser agent: A browser agent is an AI system that operates a web browser, for example by navigating, clicking and typing, to carry out tasks; Playwright MCP is one way to give a language model those browser tools.

C

CLAUDE.md: CLAUDE.md is a markdown file that holds persistent instructions for Claude Code, read at the start of every session for a project, a user or an organization.
Computer use: Computer use is a tool capability that lets a model operate a desktop environment by viewing screenshots and issuing mouse and keyboard actions that the developer's application carries out.
Context window: A context window is the total amount of text a language model can take into account while producing a reply, counting the reply it is writing; Anthropic compares it to the model's working memory.

E

Embeddings: Embeddings are numerical vectors that represent content such as text, so that the distance between two vectors reflects how similar their meaning is.
Evals: Evals are repeatable tests that run a model or application on example inputs and grade the outputs against defined criteria to measure quality.

F

Function calling: Function calling is a feature where a model returns a request to run a developer-defined function with structured arguments, and the application executes it and sends the result back.

G

Guardrails: Guardrails are checks that validate the input to an AI agent, its output, or its tool calls, and can stop a run when a check fails.

J

JSON-RPC: JSON-RPC is a stateless, lightweight remote procedure call protocol that encodes requests and responses as JSON objects and does not depend on any particular transport.

K

Knowledge graph: A knowledge graph is a structured representation of real-world entities and the relationships between them, usually stored in a graph database.

M

MCP: MCP, the Model Context Protocol, is an open protocol that standardizes how LLM applications connect to external data sources and tools, using JSON-RPC messages between hosts, clients and servers.
MCP client: An MCP client is a connector created by a host application that communicates with exactly one MCP server, attaching protocol version and capabilities to every request.
MCP elicitation: MCP elicitation is a client feature that lets a server request additional information from the user, through the client, either as an in-band form or by sending the user to an external URL.
MCP prompt: An MCP prompt is a reusable prompt template that an MCP server exposes to clients, with optional arguments, so users can explicitly select structured messages and instructions for a language model.
MCP Registry: The MCP Registry is the project's official directory of metadata about publicly accessible MCP servers, with namespace verification and a REST API for clients and aggregators to discover them.
MCP resource: An MCP resource is a piece of data, such as a file, a database schema or application information, that a server exposes to clients under a unique URI to give models context.
MCP roots: MCP roots are a client feature for telling servers which filesystem directories and files the client considers relevant, shared as file URIs so servers can focus their operations.
MCP rug pull: A rug pull, in MCP security usage, is a malicious update to a tool that users or clients already trusted, listed by OWASP as a sub-technique of tool poisoning.
MCP sampling: MCP sampling is a client feature that lets a server request a language model generation through the client, so the client keeps control of model access, selection and permissions.
MCP server: An MCP server is a program or remote service that provides specialized context and capabilities to MCP clients by exposing resources, tools and prompts through the Model Context Protocol.
MCP tool: An MCP tool is a function exposed by an MCP server, identified by a name and a JSON Schema for its inputs, that a language model can invoke to act on external systems.
Multi-agent orchestration: Multi-agent orchestration is the practice of coordinating several AI agents on one task, commonly with a lead agent that splits the work, delegates to workers and combines their results.

O

OAuth for MCP: OAuth for MCP is the optional authorization part of the Model Context Protocol, in which an HTTP-based MCP server acts as an OAuth 2.1 resource server and the client obtains access tokens from an authorization server.
Observability: Observability is the ability to understand what a system is doing from the outside by asking questions of the telemetry it emits, without needing to know its internal workings.
OpenTelemetry: OpenTelemetry is an open source observability framework and toolkit for generating, exporting and collecting telemetry data such as traces, metrics and logs from software.
OSV: OSV, the Open Source Vulnerability format, is a JSON interchange format for describing vulnerabilities in open source packages so that different vulnerability databases can share data.

P

Permission manifest: A permission manifest is a file in which software declares ahead of time the capabilities and resources it needs, so a user or platform can review and grant them.
Plugin marketplace: A plugin marketplace is a directory or git repository with a marketplace.json file that lists plugins and where to fetch each one, so users can add it and install from it.
Prompt injection: Prompt injection is a vulnerability in which crafted input changes the behavior or output of a large language model in ways its developers did not intend.

R

RAG: RAG is a technique that combines a pretrained language model with an external searchable store of documents, so generated text can draw on passages retrieved at query time.

S

SBOM: An SBOM, or software bill of materials, is a formal record of the components used to build a piece of software and the supply chain relationships between them.
Server-Sent Events (SSE): Server-Sent Events is a web standard that lets a server push a stream of text events to a client over one long-lived HTTP response, which browsers read through the EventSource interface.
SKILL.md: SKILL.md is the required file in an Agent Skills folder, made of YAML frontmatter with a name and description followed by markdown instructions for the agent.
SPDX: SPDX is an open standard for communicating software bill of materials information, including provenance, licensing, and security details about software components.
stdio transport: The stdio transport is an MCP transport in which the client launches the server as a subprocess and exchanges newline-delimited JSON-RPC messages with it over the server's standard input and output.
Streamable HTTP: Streamable HTTP is an MCP transport in which a server exposes one HTTP endpoint, the client sends each JSON-RPC message as a POST, and the reply arrives as a JSON object or a Server-Sent Events stream.
Subagent: A subagent is a specialized AI assistant that Claude Code delegates a task to; it works in a separate context window with its own instructions and tool limits, and hands back only a summary.

T

Tool poisoning: Tool poisoning is a risk category in the OWASP MCP Top 10 (MCP03) in which an attacker tampers with the schemas and descriptions that tell a model how to call a tool, so that a harmless-looking operation maps to a harmful one.
Tool use: Tool use is the capability that lets a language model request calls to functions defined by a developer or provided by the vendor, returning a structured call instead of plain text.

V

Vector database: A vector database stores embedding vectors together with metadata and returns the stored items whose vectors are closest to the vector of a query.
Voice agent: A voice agent is an application people talk to out loud to get answers and finish tasks, connecting speech input and output to a model that can reason and call tools.

X

x402: x402 is an open payment standard built on the HTTP 402 Payment Required status code that lets a server charge for API or content access directly over HTTP without accounts or sessions.