Article: Multi-Agent AI for Production Security Operations: an A2A and MCP Architecture in a 5G Core

Coordinate through an Agent-to-Agent (A2A) open protocol and integrate the environment through Model Context Protocol (MCP). Open coordination and context protocols outlive frameworks; agents written eighteen months apart will still talk if they share A2A, and each new tool exposed via MCP is immediately available to every agent at near-zero marginal integration cost. Gate LLM inference with classical anomaly detection. A lightweight Isolation Forest pre-filter on raw telemetry routes the LLM-driven agents only to genuinely novel samples. This approach makes the architecture reactive, where inference cost stays bounded, latency stays predictable, and the LLM does the work only humans were doing before. Reject both the monolithic-LLM and the GenAI-on-SIEM patterns for high-stakes security operations centers. The former is non-deterministic in ways production cannot tolerate; the latter is a productivity tool, not an architectural advance. A multi-agent layer with anomaly-gated inference, policy-gated autonomy, and a real human-in-the-loop is the durable alternative. Measure the right latency. The metric that matters in a production Security Operations Center (SOC) is the time between a new threat class appearing in the wild and your SOC having a deployed detection for it. Optimize the architecture for that latency. A 5G core in production generates more security…