Three incompatible communication protocols now dominate multi-agent AI deployments: the Model Context Protocol (MCP), Google’s Agent-to-Agent Protocol (A2A), and FIPA-ACL. Yet every production system that bridges two of them introduces a translation boundary whose security properties no existing framework examines. This paper presents CPASA, a cross-protocol attack surface analysis with five interlocking results. A category-theoretically grounded taxonomy defines six vulnerability categories, foremost among them the novel Cross-Protocol Replay Vulnerability (CPRV), and models the six directed translation paths as functors between protocol categories, with security properties expressed as natural transformations. 87 machine-checkable formal verdicts (44 ProVerif, 36 Tamarin, 7 TLA+) yield 77 verified properties and 10 violations; three independent formalisms—category theory, ProVerif, and TLA+—with corroborating Tamarin evidence converge on a single conclusion: the MCP–FIPA–MCP roundtrip irreversibly strips OAuth 2.1 credentials, constituting CPRV. A 120-feature ML classifier (macro-F1=0.72) provides complementary real-time detection when data are available. Systematic enumeration of 80 attack vectors confirms CPRV as a vulnerability class absent from MAESTRO, OWASP, AgentDojo, and all prior threat modelling. We believe the central finding here is architectural in nature. FIPA-ACL was designed in 2002 without cryptographic authentication, and no amount of gateway engineering can restore credentials that a translation functor has already destroyed—this is not a gap that better statistics will close. The formal proofs do not expire. The ML metrics, on the other hand, depend heavily on the data distribution available at training time and should be treated accordingly.