Morgan Stanley has shifted its API program to an Architecture as Code approach using CALM, embedding the Model Context Protocol (MCP) and Agent‑to‑Agent (A2A) communication patterns while automating governance with deployment gates. This redesign removes manual hand‑offs, enables continuous delivery of AI‑enabled services, and guarantees platform upgrades without downtime, which directly impacts AI engineers, platform teams, SREs and security practitioners.
Integrating MCP and Agent‑to‑Agent Communication
The new stack treats API definitions and the surrounding model context as code artifacts, allowing MCP specifications to travel alongside service contracts. A2A channels are defined in the same repository, making the intent of each agent clear to the deployment system. Practitioners can now version‑control model‑API relationships and propagate changes through the same CI pipeline used for application code.
Automated Governance via Deployment Gates
CALM enforces policy checks before any change reaches production. Deployment gates evaluate compliance with internal standards, ensuring that any MCP or A2A modification satisfies pre‑approved criteria. For DevOps and security engineers this means governance is baked into the pipeline rather than an after‑the‑fact review, reducing the risk of policy drift.
Zero‑Downtime Platform Upgrades
Because the API surface and its agentic extensions are expressed as immutable code, the platform can replace components behind a traffic‑shifting layer without interrupting active sessions. The upgrade path relies on the same deployment gates, so the system only promotes a new version once all automated checks pass. SREs gain a predictable upgrade window, and security teams retain continuous visibility into the exact code being promoted.
Related CloudNinjas coverage: AI engineering.
What This Means For Practitioners
Teams should evaluate their own API lifecycle for opportunities to codify model context and agent interactions, and to insert automated policy gates into existing CI/CD flows. Expect to adjust monitoring to track versioned model‑API artifacts, and to extend security reviews to cover the declarative MCP specifications. Early adoption can reduce release friction and improve confidence when scaling AI‑driven, agent‑centric workloads.
