The A2A delegation contract: agent card discovery, per-hop RFC 8693 token exchange carrying the user's identity, and JSON-RPC invocation. Framework glue for hosting agents is out of scope.

Rack bearer-token middleware (RFC 6750), OAuth protected-resource and authorization-server metadata endpoints (RFC 9728 / RFC 8414), and an AuthProvider for delegated token exchange in MCP servers. Wraps no MCP SDK; attaches to any Rack app, including servers built on the official mcp gem.