ARD Protocol Explained: How AI Agents Autonomously Discover and Invoke Tools

When more and more AI agents are deployed within an enterprise, an awkward problem surfaces: they have no idea the others exist. The sales department builds a customer data analysis agent, but the marketing team's AI assistant is completely unaware of it—unless someone manually informs it and configures the connection. This is the "information silo" problem of the AI world.

In fact, the information silo problem within enterprises has a long history. Even in the traditional IT era, different departments using separate ERP, CRM, and OA systems already caused data fragmentation. In the age of AI agents, this problem is further amplified—because agents need not only to access data but also to discover and invoke the capabilities of other agents. According to Gartner, by 2028 the number of AI agents deployed within enterprises will exceed that of traditional software applications, meaning that without a unified discovery mechanism, the cost of inter-agent collaboration will grow exponentially.

In June 2026, Google, Microsoft, NVIDIA, Salesforce, GitHub, and 11 other tech giants jointly released an open specification—ARD (Agentic Resource Discovery)—specifically designed to solve this problem. ARD is essentially a search engine built for AI agents, enabling them to autonomously discover, locate, and invoke the tools and services they need.

MCP's Limitation: Having the Interface but Unable to Find the Device

To understand the value of the ARD protocol, we first need to revisit MCP (Model Context Protocol), introduced by Anthropic in 2024. MCP is essentially a "USB-C port" for the agent world—it standardized how AI systems connect with various data sources and tools. As long as developers build according to the protocol, agents can directly invoke these tools.

From a technical perspective, MCP (Model Context Protocol) was officially released by Anthropic in November 2024. Its core design philosophy is to provide large language models with a standardized context injection interface. Before MCP, every AI application that needed to integrate external tools (such as database queries, API calls, file reads, etc.) required developers to write custom integration code. MCP standardized this process by defining a unified message format and interaction flow. It supports three core primitives: Resources (such as files and data), Tools (such as function calls), and Prompts (prompt templates). MCP quickly gained industry recognition, with OpenAI, Google, Microsoft, and other companies successively announcing support, making it the de facto communication standard for agents.

But MCP has a critical prerequisite: you must already know the tool exists, then manually connect it to your agent. It's like having a phone with USB-C, but having no idea where to buy a flash drive or keyboard—no matter how good the interface is, it's useless.

As AI tools published by enterprises and developers grow explosively, manual configuration simply doesn't scale. AI agents urgently need their own "discovery mechanism"—just like how we use search engines—to autonomously find and invoke the resources they need.

ARD's Architecture: A Hierarchical, Decentralized Model Inspired by DNS

ARD's architecture draws from the internet's Domain Name System (DNS), adopting a hierarchical and decentralized model built around two core components: Catalogs and Registries.

It's worth taking a deeper look at the architectural essence of DNS. DNS (Domain Name System) is one of the internet's most critical pieces of infrastructure, translating human-readable domain names (like google.com) into machine-readable IP addresses. DNS uses a tree-like hierarchical structure: root servers sit at the top, followed by top-level domain servers (.com, .org, etc.), authoritative name servers, and local caching servers. This layered design allows DNS to support the name resolution needs of billions of devices globally without relying on any single central node—even if one server goes down, other nodes continue to function normally. ARD borrows this architectural philosophy: Catalogs are analogous to authoritative DNS records, maintained by resource owners themselves; Registries are analogous to DNS recursive resolvers, responsible for aggregating and searching these distributed records.

Catalogs: The "Product Spec Sheet" for AI Tools

A catalog is essentially a capability manifest. Any organization or developer that wants to expose their AI service simply places a standard manifest file at a fixed path under their domain: /.well-known/aicatalog.json. This file provides detailed descriptions of the tool's capabilities, the types of tasks it can handle, and how to invoke it.

It's worth noting that /.well-known/ is a standardized URI path prefix defined by the IETF in RFC 5785, specifically designed for placing site-level metadata files on web servers. This mechanism is already widely used across multiple internet protocols: for example, Let's Encrypt uses /.well-known/acme-challenge/ to verify domain ownership for issuing SSL certificates, and OAuth uses /.well-known/openid-configuration to publish authentication server configuration information. ARD's choice of /.well-known/aicatalog.json as the standard path means that any organization with a domain name and a web server can publish its AI capability manifest with zero barriers—no additional registration process or third-party platform required.

The credibility of the manifest is guaranteed by domain ownership. Just as visiting microsoft.com tells you it's Microsoft's official website, whichever domain hosts the manifest is backed by that entity's reputation. This is a simple yet effective trust mechanism.

Registries: The "Search Engine" for AI Agents

Registries actively crawl these public catalogs and build indexes for them. When an agent needs to accomplish a task, it can query using natural language—for example, "I need a tool that can analyze sales data"—and the registry returns a relevance-ranked list of tools, including capability descriptions, providers, and connection methods.

A Complete Discovery and Execution Workflow

Under the ARD framework, the complete process for an AI agent to find and use a tool can be broken down into four steps:

1. Publish: The resource provider creates and publishes an aicatalog.json manifest under their domain, making tool information publicly available
2. Index: Registry services continuously crawl these manifests and index them all
3. Query: When an AI client needs a specific tool, it sends a query directly to the registry
4. Invoke: The client selects an appropriate tool from the search results and invokes it directly through the tool's native protocol (such as MCP or REST API)

There's a key design principle here: the registry is only responsible for discovery, not for actual invocation. This brings several significant advantages:

• Lightweight and flexible: It doesn't concern itself with specific execution methods and can be compatible with any communication protocol
• Decentralized: There's no central control node; anyone can run their own registry
• Easy to integrate: Enterprises can conveniently consolidate internal and external public tools, and independently decide which resources are discoverable

ARD and MCP: Complementary, Not Competing

The relationship between ARD and MCP is complementary, not competitive. MCP solves "how to connect"—how agents and tools communicate; ARD solves "who to connect with"—where agents find these tools.

Think of it this way: ARD sits upstream of MCP, first helping agents find the right tools, then letting MCP handle the actual connection and invocation. One solves the discovery problem, the other solves the communication problem—together they give AI agents a complete autonomous capability loop.

Ecosystem Status and First Product Launches

The ARD specification draft was officially released on June 17, 2026, under the Apache 2.0 open-source license, with the data model maintained by the AI Catalog Working Group under the Linux Foundation.

Apache 2.0 is one of the most enterprise-friendly open-source licenses available. It allows anyone to freely use, modify, and distribute code (including for commercial purposes) while providing explicit patent grant clauses—critical for enterprise adoption of open-source technology, as it eliminates potential patent litigation risks. The Linux Foundation is the world's largest open-source technology organization, hosting the Linux kernel, Kubernetes, CNCF, and many other critical projects under its umbrella. Its neutral, non-profit nature ensures that ARD won't be controlled by any single commercial entity. This "vendor-neutral" governance model is the key factor that enabled ARD to attract 11 competitors to participate simultaneously.

The initial roster of supporters is impressive, including Google, Microsoft, Cisco, NVIDIA, Salesforce, ServiceNow, Databricks, Snowflake, GitHub, Hugging Face, and GoDaddy—11 companies in total.

On launch day, several companies rolled out ARD-based products:

• GitHub launched Agent Finder, enabling Copilot to automatically discover and invoke MCP servers and various skill tools
• Hugging Face released Discover Tool, capable of searching thousands of skills and MCP servers
• Cisco integrated ARD into the AGNTCY Agent Directory
• Google added ARD support to the Gemini enterprise agent platform
• DataRobot announced ARD compatibility and released an AI catalog

You may not have noticed, but OpenAI and Anthropic are currently absent from the initial supporters list. Whether these two companies—both pivotal in the AI field—will join will have a significant impact on ARD's ecosystem adoption.

Looking deeper, Anthropic is the creator of the MCP protocol and has its own strategic plans for the agent infrastructure layer. Joining a discovery-layer protocol primarily driven by Google may involve a power struggle over ecosystem dominance. OpenAI, on the other hand, has consistently leaned toward building its own closed ecosystem—from the GPT Store to Plugins to the latest Responses API—with a strategy that favors platformization over open interoperability. However, it's worth noting that during MCP's rollout, OpenAI also didn't participate initially, but ultimately announced support in March 2025. Historical experience suggests that once an open standard gains sufficient industry momentum, even the most dominant players find it difficult to stay on the sidelines for long.

Security Challenges Cannot Be Ignored

While ARD's open architecture brings convenience, it also introduces new security risks. Since the trust model relies on domain ownership, if a domain is hijacked, DNS is poisoned, or a server is compromised, attackers can upload malicious aicatalog.json files to lure AI agents into connecting to dangerous tools.

These security threats are not merely theoretical. DNS Hijacking involves attackers tampering with DNS records to redirect domains to malicious servers—the 2019 Sea Turtle attack affected over 40 organizations. DNS Cache Poisoning achieves man-in-the-middle attacks by injecting forged responses into DNS resolvers. Additionally, supply chain attacks pose a major threat—if a tool provider's server is compromised, attackers can replace the aicatalog.json file under a legitimate domain, and agents will connect to malicious tools without suspicion because they trust that domain. This type of attack is especially dangerous in AI scenarios, as agents may have permissions to execute code, access sensitive data, or even operate production systems.

Google has also acknowledged that ARD itself is not a security solution. In actual deployments, it needs to be paired with the following security measures:

• Strong authentication and authorization mechanisms
• Resource whitelisting and governance policies
• Code signature verification
• Runtime monitoring and policy enforcement

This means that while embracing ARD, enterprises must establish a supporting security framework—it cannot simply be used "out of the box."

Summary and Outlook

The emergence of the ARD protocol transforms AI agents from isolated systems requiring manual connections into an interconnected ecosystem capable of autonomously exploring and leveraging various capabilities. It fills the critical missing piece after MCP—the discovery layer—addressing the core question of how agents can efficiently and securely discover and use tools amid the explosive growth of AI capabilities.

Of course, ARD still faces considerable challenges in ecosystem adoption (especially in winning over OpenAI and Anthropic) and security practices. But as an important step toward AI interoperability, it marks a new phase in the AI agent ecosystem's evolution from "manual configuration" to "autonomous discovery"—something every AI practitioner should keep a close eye on.