
As autonomous LLM agents increasingly operate across heterogeneous communication stacks — MCP, A2A, ACP, and FIPA-ACL — the translation gateways that bridge these protocols constitute a critical yet largely unstudied attack surface. Semantic mismatches in authentication, state management, and content encoding at translation boundaries can enable vulnerabilities that are invisible to single-protocol defenses. We introduce the Translation Security Analysis Framework (TSAF), contributing a six-category vulnerability taxonomy (ISV, PIV, SCV, CPRV, TIV, CEV) grounded in category theory, a three-layer detection pipeline combining static rules, behavioral anomaly detection, and a stacking ensemble classifier (XGBoost, LightGBM, HistGBM) trained on 2.5 million real network traffic samples from CICIDS2017 and UNSW-NB15, and formal verification of 16 security properties via ProVerif, Tamarin Prover, and TLA+—all proved to hold. Evaluation yields 96.3% true positive rate, 3.8% false positive rate, and 147 ms p95 latency, with statistically significant improvements over all baselines. TSAF provides the first systematic treatment of translation-boundary attacks in multi-agent AI.

Three incompatible communication protocols now dominate multi-agent AI deployments: the Model Context Protocol (MCP), Google’s Agent-to-Agent Protocol (A2A), and FIPA-ACL. Yet every production system that bridges two of them introduces a translation boundary whose security properties no existing framework examines. This paper presents CPASA, a cross-protocol attack surface analysis with five interlocking results. A category-theoretically grounded taxonomy defines six vulnerability categories, foremost among them the novel Cross-Protocol Replay Vulnerability (CPRV), and models the six directed translation paths as functors between protocol categories, with security properties expressed as natural transformations. 87 machine-checkable formal verdicts (44 ProVerif, 36 Tamarin, 7 TLA+) yield 77 verified properties and 10 violations; three independent formalisms—category theory, ProVerif, and TLA+—with corroborating Tamarin evidence converge on a single conclusion: the MCP–FIPA–MCP roundtrip irreversibly strips OAuth 2.1 credentials, constituting CPRV. A 120-feature ML classifier (macro-F1=0.72) provides complementary real-time detection when data are available. Systematic enumeration of 80 attack vectors confirms CPRV as a vulnerability class absent from MAESTRO, OWASP, AgentDojo, and all prior threat modelling. We believe the central finding here is architectural in nature. FIPA-ACL was designed in 2002 without cryptographic authentication, and no amount of gateway engineering can restore credentials that a translation functor has already destroyed—this is not a gap that better statistics will close. The formal proofs do not expire. The ML metrics, on the other hand, depend heavily on the data distribution available at training time and should be treated accordingly.