LLM-Agent Communication Protocol (LACP)

• LLM-Agent Communication Protocol (LACP) is a framework defining standardized, multimodal communication and coordination between LLM-based agents and contextual systems.
• The protocol taxonomy categorizes LACP by counterparty type, payload structure, session state, discovery mechanism, and schema flexibility to support interoperability.
• Emerging LACP proposals emphasize secure, semantically aligned communication and assess trade-offs in latency, overhead, robustness, and recovery in distributed agent systems.

Searching arXiv for the cited protocol papers to ground the article in current literature. LLM-Agent Communication Protocol (LACP) denotes, in one technical taxonomy, an application-level protocol that standardizes how an LLM-based agent communicates with another system—either another agent, or non-agent “context” such as tools, APIs, services, and data sources (Sander et al., 17 Jun 2026). Across the recent literature, the term refers less to a single settled standard than to an emerging protocol space concerned with interoperability, capability description, discovery, state transfer, semantic alignment, security, and reliable coordination in distributed agent systems (Kong et al., 24 Jun 2025).

1. Definition and scope

The current literature treats agent communication as broader than message exchange between peer agents. One survey defines agent communication as the multimodal information exchange and dynamic behavior coordination that occur when an agent completes tasks with diversified elements through standardized protocol frameworks, and it divides the lifecycle into user-agent interaction, agent-agent communication, and agent-environment communication (Kong et al., 24 Jun 2025). A closely related survey distinguishes two protocol orientations: context-oriented protocols, which connect agents to tools, data, and services, and inter-agent protocols, which support discovery, negotiation, task delegation, and collaboration among autonomous agents (Yang et al., 23 Apr 2025).

This scope matters because the protocol problem is not singular. In the context-oriented setting, the protocol problem is how an agent acquires context or invokes tools in a standardized way. In the inter-agent setting, the protocol problem is how multiple agents discover one another, advertise capabilities, coordinate tasks, exchange artifacts, and maintain state across multi-step workflows. Several papers argue that these two paradigms may converge, because tools can be viewed as low-autonomy agents and agents can be viewed as high-autonomy tools (Sander et al., 17 Jun 2026).

The literature also distinguishes a generic use of “LACP” from specific named proposals. In the taxonomy paper, LACP is a category of application-level protocols (Sander et al., 17 Jun 2026). In a separate position paper, “LACP” is the proper name of a telecom-inspired three-layer proposal intended to ensure semantic clarity, transactional integrity, and built-in security for distributed AI (Li et al., 26 Sep 2025). This suggests that the term functions both as a general descriptor for the protocol layer of agent systems and as the label for concrete architectural proposals.

2. Taxonomic structure and architectural dimensions

A five-dimensional taxonomy has been proposed to classify LLM agent communication protocols by the type of communication they facilitate (Sander et al., 17 Jun 2026).

Dimension	Values	What it classifies
Counterparty	Agent, Context, Hybrid	What type of entity the agent communicates with
Payload	Structured data and artifacts, Conversation focused, Hybrid	The kind of data the protocol exchanges
Interaction State	Stateless, Session state	Whether protocol-level session context persists
Discovery Mechanism	Static, Centralized, Partially centralized, Decentralized, Hybrid	How endpoints or capabilities are found
Schema Flexibility	Single, Multiple, Evolving	How flexibly schemas or interaction structures can change

Using this taxonomy, the literature reports several recurring patterns. Agent-to-agent protocols in the sampled set always use hybrid payloads and always provide session state; most sampled protocols support multiple predefined schemas; only two sampled protocols negotiate schemas at runtime; and decentralized discovery remains rare (Sander et al., 17 Jun 2026). The same paper argues that short-term convergence pressure is likely to favor protocols that unify agent-to-agent and agent-to-context communication, while the long-term outcome is more likely a federated, layered protocol stack than a single monolithic standard (Sander et al., 17 Jun 2026).

A second line of work argues that message transport and schema validation are insufficient because successful message exchange is not the same as successful meaning alignment. It organizes agent communication into three layers—communication, syntactic, and semantic—and concludes that current protocol design is mature in transport, streaming, schema definition, and lifecycle management, but weak in clarification, context alignment, and verification (Yuan et al., 30 Mar 2026). A related architectural proposal for the “Internet of Agents” adds an Agent Communication Layer (L8) for message envelopes, speech acts, and interaction patterns, and an Agent Semantic Negotiation Layer (L9) for discovering, negotiating, locking, and validating a “Shared Context” (Fleming et al., 24 Nov 2025).

Taken together, these taxonomies and layered proposals make semantics a first-class protocol concern. This suggests that a mature LACP cannot be reduced to transport bindings or JSON schemas alone.

3. Representative protocol families and coordination mechanisms

The literature repeatedly treats four protocol families as reference points. MCP is a context-oriented protocol for standardized LLM access to external tools, resources, prompts, and sampling through a JSON-RPC client-server interface (Ehtesham et al., 4 May 2025). A2A is an inter-agent protocol centered on peer-like task outsourcing and collaboration through capability advertisement via Agent Cards, task objects, messages, and artifacts over HTTP and JSON-RPC 2.0, with optional SSE and push notifications (Ehtesham et al., 4 May 2025). ACP is the survey’s closest general-purpose messaging substrate, built as a REST-native, SDK-optional framework with typed multipart messages, synchronous and asynchronous interactions, routing, and session-aware workflows (Ehtesham et al., 4 May 2025). ANP targets open-network discovery and secure collaboration through W3C decentralized identifiers, JSON-LD, agent description documents, and meta-protocol negotiation (Ehtesham et al., 4 May 2025).

These protocols differ in their assumptions about discovery, trust, and control. MCP emphasizes structured tool invocation and context exchange. A2A emphasizes capability-based discovery, task delegation, and artifact exchange. ACP emphasizes rich agent messaging, multimodal payloads, and brokered routing. ANP emphasizes decentralized identity, semantic self-description, and open-network interoperability. A survey of agent interoperability protocols therefore presents them as complementary layers rather than direct substitutes: MCP for the tool/context layer, ACP for the messaging layer, A2A for the collaboration/task layer, and ANP for decentralized identity and discovery (Ehtesham et al., 4 May 2025).

The protocol literature also includes orchestration designs that are not standards in the strict sense but are informative at the communication level. AnyMAC, for example, can be read cautiously as a proposal for an LLM-agent communication protocol even though the paper does not use the term in the standards-engineering sense (Wang et al., 21 Jun 2025). Its core reframing is that multi-agent collaboration should be modeled as a sequential, cascading communication process rather than as a fixed graph topology. The communication pipeline is represented as a sequence

$\mathcal{S} = [a_1, a_2, \dots, a_T],$

and coordination is decomposed into Next-Agent Prediction (NAP), which selects the next role, and Next-Context Selection (NCS), which selects which prior messages that role should read (Wang et al., 21 Jun 2025). In protocol terms, this yields a centralized routing plane with selective data-plane delivery. The paper’s practical primitives are role addressing, context retrieval, agent execution, message append, and termination/final aggregation (Wang et al., 21 Jun 2025).

A separate line of work treats communication not as online free-form chat but as a structured, learnable event stream. “Learning Through Communication” introduces a universal buffer in which a session is represented as

$$\mathcal{S}=(\mathcal{T}, \mathcal{M}, \mathcal{R}),$$

with text trajectories, source masks, and reward signals, and then defines monologue, dialogue, and teacher-student communication patterns for online adaptation (Wang et al., 2023). This is not a protocol standard, but it contributes a protocol-level idea: provenance, role, and reward annotations can be part of the communication ledger rather than an afterthought (Wang et al., 2023).

4. Security, trust, and protocol failure modes

Recent security surveys treat protocol design as a primary attack surface rather than a neutral transport substrate. One survey organizes the threat landscape into four domains—Input Manipulation, Model Compromise, System and Privacy Attacks, and Protocol Vulnerabilities—and explicitly analyzes vulnerabilities in MCP, ACP, ANP, and A2A-style communication (Ferrag et al., 29 Jun 2025). In that threat model, user prompts, retrieved documents, tool outputs, discovery metadata, peer-agent messages, and memory updates can all become attack carriers. The protocol is therefore both a target and a propagation channel (Ferrag et al., 29 Jun 2025).

A broader survey of agent communication security frames risks over the full lifecycle of user-agent, agent-agent, and agent-environment interaction (Kong et al., 24 Jun 2025). On the agent-agent side, it highlights registration pollution, description poisoning, task flooding, SEO poisoning, agent spoofing, agent exploitation, agent bullying, privacy leakage, responsibility evasion, and denial of service. On the agent-environment side, it highlights memory injection, memory poisoning, memory extraction, retrieval poisoning, malicious tools, misuse of legitimate tools, tool selection manipulation, and cross-tool chaining exploits (Kong et al., 24 Jun 2025). The same survey emphasizes identity authentication, capability verification, access control, context isolation, logging, archiving, and auditing as cross-cutting defenses (Kong et al., 24 Jun 2025).

The telecom-inspired LACP position paper makes a related argument in standards language. It proposes a Transactional Layer responsible for message signing, sequencing, unique transaction IDs for idempotency, and atomic transactions using two-phase-commit concepts, all wrapped in a JWS envelope (Li et al., 26 Sep 2025). Its prototype appendix reports that a tampered signed message is rejected with HTTP 403 Forbidden and that replay of an already processed transaction_id is rejected with HTTP 409 Conflict (Li et al., 26 Sep 2025). The paper explicitly argues that TLS alone is insufficient because attacks can occur after decryption at the endpoint, so message-level integrity and transaction tracking remain necessary (Li et al., 26 Sep 2025).

The security literature therefore converges on a common point: authenticated peers are not automatically trustworthy peers. A robust LACP must treat identity, authorization, provenance, and policy enforcement as protocol-native properties.

5. Evaluation, trade-offs, and empirical behavior

Protocol choice materially changes system behavior. ProtocolBench evaluates A2A, ACP, ANP, and Agora along task success, end-to-end latency, message or byte overhead, and robustness under failures, and reports that in the Streaming Queue scenario overall completion time varies by up to 36.5% across protocols and mean end-to-end latency differs by 3.48 s (Du et al., 20 Oct 2025). In Fail-Storm Recovery, post-fault retention differs substantially, with A2A: 98.85% and Agora: 81.29%, while ProtocolRouter reduces recovery time by up to 18.1% versus the best single-protocol baseline (Du et al., 20 Oct 2025). These results are an explicit argument against intuition-driven protocol selection.

Communication efficiency also appears in adaptive orchestration work. AnyMAC measures communication overhead primarily through prompt token consumption and trajectory length, and reports that AnyMAC-Eff reduces prompt token usage by $5\times$ relative to the most efficient baseline, G-Designer, while remaining competitive in performance (Wang et al., 21 Jun 2025). This is a protocol-level demonstration that selective routing and selective context delivery can reduce bandwidth relative to full-transcript broadcast (Wang et al., 21 Jun 2025).

Behavioral studies add a second kind of trade-off: communication changes outcomes, but not uniformly. In strategic two-agent games, allowing agents to exchange one message before each action materially alters behavior, and the effect varies by language, model, personality, and game structure (Buscemi et al., 30 Jul 2025). In repeated Prisoner’s Dilemma, communication tends to stabilize cooperation for Llama 4 Maverick, but in Battle of the Sexes communication can reduce coordination, and the same communication regime can help in one language while hurting in another (Buscemi et al., 30 Jul 2025). This suggests that natural-language communication is itself a high-variance protocol substrate.

Protocol evaluation is therefore multi-objective. The literature repeatedly returns to success, latency, communication overhead, robustness, security, and semantic alignment as independent axes that no single design optimizes simultaneously (Du et al., 20 Oct 2025).

6. Standardization directions and unresolved questions

The strongest standardization claim is made explicitly in the position paper titled “LLM Agent Communication Protocol (LACP) Requires Urgent Standardization,” which argues that the field needs a unified, telecom-inspired protocol before fragmentation becomes entrenched (Li et al., 26 Sep 2025). Its proposed LACP has three layers—Semantic Layer, Transactional Layer, and Transport Layer—and standardizes a narrow semantic core through three message types: PLAN, ACT, and OBSERVE (Li et al., 26 Sep 2025). The paper frames this as the agent-era analogue of the standard substrate that networking once lacked (Li et al., 26 Sep 2025).

At the same time, multiple surveys argue against expecting one protocol to optimize versatility, efficiency, and portability simultaneously. The taxonomy paper concludes that long-term evolution is more likely to yield a federated, layered protocol stack (Sander et al., 17 Jun 2026). The “Internet of Agents” proposal similarly separates syntax-level interoperability from meaning-level interoperability through L8 and L9, with SNL-HELLO, SNL-SELECT, and SNL-LOCK forming a dedicated semantic handshake around a versioned Shared Context such as urn:contexts:travel:v2.1 (Fleming et al., 24 Nov 2025). A survey of AI agent protocols likewise identifies future requirements such as adaptability, privacy preservation, group-based interaction, layered architectures, and collective intelligence infrastructures (Yang et al., 23 Apr 2025).

Several gaps recur across these works. Privacy safeguards, compliance checks, and policy enforcement are described as widely absent from existing protocols (Sander et al., 17 Jun 2026). Semantic responsibilities are often pushed into prompts, wrappers, or application-specific orchestration logic, creating hidden interoperability debt (Yuan et al., 30 Mar 2026). Cross-protocol identity, especially across ecosystems such as A2A and MCP, remains an open problem (Kong et al., 24 Jun 2025). This suggests that the near-term future of LACP is not a finished universal wire protocol, but a standards program: shared dimensions, shared descriptors, layered semantics, stronger trust infrastructure, and clearer separation between communication, execution, and governance.