Architecting a Privacy-First, Link-Driven AI Research Navigator Using AG-UI

Full report

On this page

The protection of cognitive liberty constitutes a defining civil liberties challenge in the modern digital era. Cognitive liberty safeguards the private spaces where individuals formulate thoughts, conduct research, compare conflicting ideologies, and alter their beliefs without fear of surveillance or algorithmic judgment1. In contemporary search and generative artificial intelligence (AI) ecosystems, this fundamental right is routinely compromised. When search engines interpret user intent and AI assistants retain conversational context to formulate definitive answers, queries effectively become highly sensitive thought data1. For independent educational platforms such as CognitiveLiberties.com, which already maintains a rigorous commitment to avoiding trackers, behavioral advertising, and third-party runtime requests, the challenge is to provide deep, accessible discoverability without subjecting users to behavioral profiling, invisible manipulation, or automated judgments. This comprehensive technical analysis critically evaluates the design, architecture, and threat model of a new paradigm: a privacy-first, link-driven AI research navigator. Rather than generating a synthesized, authoritative final answer that obscures original sources and risks fabricating information, the proposed system utilizes AI to construct a transparent, interactive map of primary materials. By leveraging the Agent-User Interaction Protocol (AG-UI) to handle real-time streaming and human-in-the-loop (HITL) approvals2, alongside the Model Context Protocol (MCP) for secure backend tool invocation4, the architecture fundamentally shifts the locus of control away from the AI and back to the human researcher. The system treats AG-UI as a specialized interaction technology designed to support user autonomy, operating under the strict design requirement that the user retains final control over what to read, which external links to follow, and whether any AI system processes their question.

The Link-Driven Navigation Paradigm

The prevailing architectures of Generative Engine Optimization (GEO) and Answer Engine Optimization (AEO) position the AI as an authoritative oracle. In these models, the system parses numerous sources in the background, strips away the original context, and presents a synthesized conclusion directly to the user. This paradigm inherently risks hallucination, opaque algorithmic bias, and the severe erosion of source provenance, while simultaneously profiling the user based on the inferred ideology of their query. Conversely, a link-driven AI research navigator acts strictly as a cartographer rather than an oracle. When a user submits a broad, complex query regarding a sensitive or highly debated topic, the system does not attempt to resolve the debate or generate a narrative answer. Instead, the AI agent is deployed to retrieve, categorize, and visually map highly relevant primary resources, such as technical standards, scholarly articles, legal briefs, and independent organizational profiles. The human user then explores this structured map, independently choosing which branches of thought to expand and which original URLs to visit in a completely static, unmonitored environment.

Source-Linked Knowledge Graphs and JSON-LD

To function effectively as a cartographer, the backend intelligence must parse structured, machine-readable metadata rather than relying solely on raw, unstructured text extraction. The proposed architecture leverages JSON-LD (JavaScript Object Notation for Linked Data) structured data, adhering strictly to Schema.org standards, to build a verifiable, topological knowledge graph6. When the agent queries the backend repository, it processes entities that are explicitly defined by Schema.org typologies, such as ScholarlyArticle, WebPage, Dataset, and Organization8. Central to preserving source provenance is the strict adherence to the citation property within the Schema.org framework, which allows the explicit declaration of references to other creative works9. By analyzing the @id and identifier properties within the JSON-LD payload13, the AI can establish topological links between opposing arguments, historical context, and technical standards without altering the underlying content. The output generated by the AI is not a prose response, but a structured graph mapping these entities, which the frontend subsequently visualizes for user exploration.

User-Controlled Discovery Modes

A critical requirement of cognitive liberty is the ability to shift perspectives provisionally without being algorithmically siloed into a personalized filter bubble1. The navigator architecture accommodates distinct discovery modes, allowing the user to explicitly constrain the AI's search space and analytical focus. These modes dictate the parameters of the knowledge graph generation.

1. Academic Evidence: Limits retrieval strictly to ScholarlyArticle entities, peer-reviewed datasets, and institutional repositories, discarding commentary and non-expert analysis.

2. Opposing Arguments: Forces the agent to map resources that topologically represent conflicting viewpoints on a given subject. This mode utilizes semantic clustering to ensure that consensus-forcing is actively avoided, presenting the user with the boundaries of a debate rather than a synthesized middle ground.

3. Technical Standards: Focuses the retrieval exclusively on standard-setting bodies, code repositories, protocol specifications (e.g., IETF, W3C), and architectural documentation.

4. Historical Context: Prioritizes archival material, chronologically mapping the evolution of a topic by heavily weighting the datePublished and dateCreated JSON-LD properties14.

5. Independent Organizations: Surfaces non-governmental organizations, digital rights groups, policy institutes, and human-rights bodies1, utilizing the Organization Schema.org type to map alliances and funding structures15.

These modes are not superficial frontend filters; they fundamentally alter the system prompt and restrict the specific MCP tools available to the backend agent during execution, mathematically guaranteeing that the AI strictly obeys the user's navigational parameters5.

Architectural Delineation and Comparison

To understand the necessity of specialized agentic protocols like AG-UI, it is essential to delineate the boundaries of the technology stack and compare the proposed interactive navigator against standard baseline architectures. The modern agentic ecosystem is rapidly organizing around complementary, open protocols that address distinct layers of interaction17.

The strict compartmentalization of these responsibilities minimizes the attack surface and maximizes portability. A static link navigator offers maximum privacy and zero hallucination risk but suffers from high friction and low discoverability for highly complex, multi-disciplinary queries. Conversely, a first-party generative AI oracle model provides high discoverability but severely compromises privacy, as queries are retained for training and the system infers identity, intent, and ideology to personalize answers1. The AG-UI driven interactive navigator bridges this gap, providing high discoverability by dynamically mapping complex topics, while maintaining high privacy through local execution, zero-retention policies, and strict human-in-the-loop interrupts that prevent autonomous agent actions23.

Backend Architecture: Retrieval, Orchestration, and Zero Data Disclosure

The backend architecture is responsible for orchestrating the AI reasoning loop and executing highly secure retrieval processes. To align with the stringent privacy commitments of CognitiveLiberties.com, the system must be capable of working with self-hosted or local models while minimizing the disclosure of sensitive research questions to external entities.

Local Execution and Vector Search

To ensure zero data disclosure of the user's initial inquiry, the system defaults to running localized, self-hosted Large Language Models (LLMs) using inference engines such as Ollama24. By executing the reasoning steps locally, the user's "thought data" never traverses a third-party API boundary. The system indexes the universe of verified CognitiveLiberties.com resources—and a meticulously curated whitelist of safe external domains—using an offline vector database. Solutions such as LanceDB and Qdrant provide high-performance, local vector search capabilities26. LanceDB, for instance, offers compute-storage separation and allows raw data, embeddings, and features to exist within a single table, facilitating rapid local retrieval without complex operational overhead27. Qdrant provides advanced multi-vector support and built-in compression for high-dimensional vectors, ensuring fast retrieval times critical for real-time map generation26. The local agent uses MCP to query these local vector indices, extracting the structured JSON-LD metadata necessary to build the map5.

Private Information Retrieval (PIR) for External Queries

When a user's discovery process requires accessing federated external databases beyond the local index, traditional queries expose the specific research topic to the external server administrator, violating mental privacy principles. To mitigate this, the architecture implements Private Information Retrieval (PIR) protocols. PIR is a cryptographic protocol that allows a client to retrieve an element of a database without the owner of that database being able to determine which element was selected29. Advanced iterations, such as Computational PIR (CPIR), utilize homomorphic encryption, allowing the client to send an encrypted request vector, which the server processes against its entire database, returning a ciphertext that the client decrypts to reveal only the requested data30. While computationally intensive, integrating PIR into the agent's MCP tool definitions ensures that even if the agent is authorized by the user to query an external library, the external library learns nothing about the specific nature of the user's cognitive inquiry31.

Frontend Architecture: State Synchronization via AG-UI

The frontend of the research navigator functions as an interactive, visual canvas that renders the agent's findings in real-time. It connects to the backend exclusively via the AG-UI 1.0 protocol, which was officially announced in September 2026 as a standard for agent-to-user interaction18. Unlike standard HTTP REST APIs that follow a strict request-response pattern, AG-UI utilizes an event-based architecture transmitted over standard web transports such as Server-Sent Events (SSE) or WebSockets2.

The AG-UI Event Schema

The AG-UI specification defines roughly 16 standardized event types organized into distinct categories to comprehensively capture the lifecycle of an agent's execution3. These events allow the frontend to render, react, and respond in synchronization with the backend agent's reasoning process without manual polling or tight coupling34.

State Deltas and RFC 6902 JSON Patch

Rather than streaming unstructured text tokens that risk hallucination, the frontend relies almost entirely on AG-UI state management events. As the backend agent retrieves sources, validates their Schema.org metadata, and categorizes them according to the selected discovery mode, it emits STATE\_DELTA events. According to the AG-UI specification, these deltas must adhere to the RFC 6902 JSON Patch format36. JSON Patch defines a standardized way to express a sequence of operations (add, remove, replace, move, copy, test) to be applied to a target JSON document39. This mechanism is highly bandwidth-efficient; instead of transmitting the entire node graph every time a new source is discovered, the agent transmits only the incremental changes3. For example, when the agent identifies a new relevant ScholarlyArticle, it emits a StateDeltaEvent containing a JSON Patch operation to add a new node to the /nodes array in the shared state. The frontend, utilizing a JSON Patch library, applies this operation atomically, rendering the new node on the user's screen in real-time39. If inconsistencies are detected, the frontend can request a full STATE\_SNAPSHOT to establish a new baseline3. This collaborative state architecture ensures that the user's visual map is always precisely synchronized with the agent's verified findings40.

AG-UI Event Flow and Human-in-the-Loop Implementation

To maintain strict human autonomy and defend against unauthorized automated actions, the AI agent must not be permitted to autonomously crawl unverified external web pages, execute consequential logic, or transmit data to external servers without explicit consent. AG-UI provides a standardized Human-in-the-Loop (HITL) capability through its canonical interrupt mechanisms23.

The Interrupt and Resume Protocol

When an agent proposes an action that exceeds its local, sandboxed context—such as resolving a broken link on an external domain or utilizing a PIR tool to query an external library—it must request permission. This is achieved by marking specific backend MCP tools with an approval\_mode="always\_require" configuration23.

1. Initiation: The agent begins its run (RUN\_STARTED) and processes the initial local vector search.

2. State Building: The agent retrieves local sources and emits STATE\_DELTA events to incrementally construct the UI's node graph3.

3. Interrupt Triggered: The agent's reasoning loop determines it needs to call an external tool (e.g., query\_external\_ngo\_database). Because this tool requires approval, the agent execution is forcibly suspended by the orchestrator23.

4. Suspension and Notification: The backend emits a RUN\_FINISHED event. Crucially, the outcome payload of this event specifies type: "interrupt" and includes an array of Interrupt objects (detailing the reason: "tool\_call", the tool name, and the proposed arguments)42.

5. User Decision: The frontend AG-UI client parses the interrupt metadata and renders a highly visible dialog box, halting the map generation. The dialog details the exact action the agent wishes to take and the privacy implications of that action.

6. Resumption: The user evaluates the request. If approved, the frontend initiates a new run against the agent endpoint. This new run payload includes a resume array containing a ResumeEntry object23. The ResumeEntry correlates to the original interruptId and contains a status (e.g., "resolved" or "cancelled") along with any necessary approval payload43.

7. Continuation: Upon receiving the ResumeEntry, the backend restores the suspended state, performs the approved action (or gracefully handles the rejection), and continues emitting STATE\_DELTA events to complete the map23.

Illustrative Implementation Pseudocode

The following pseudocode outlines the orchestration of this flow, demonstrating how the backend emits JSON Patch state updates and how the frontend intercepts and processes HITL interrupts. Backend: Emitting a State Delta (Python via AG-UI SDK)

Python from ag\_ui.core import EventType, StateDeltaEvent from pydantic\_ai.ui.ag\_ui import AGUIAdapter

async def map\_source\_to\_ui(source\_data, node\_id): \# Construct an RFC 6902 JSON Patch to add a new node to the map \# Ensuring the data strictly follows the verified Schema.org structure patch\_operations \= \[ { "op": "add", "path": f"/nodes/{node\_id}", "value": { "title": source\_data.title, "url": source\_data.url, "type": source\_data.schema\_type, "summary": source\_data.abstract, "provenance\_verified": True } } \]

\# Emit the state delta to the frontend, syncing the visual map yield StateDeltaEvent( type\=EventType.STATE\_DELTA, delta=patch\_operations )

Frontend: Handling the AG-UI Event Stream and Interrupts (TypeScript)

TypeScript import { EventType, RunFinishedEvent, ResumeEntry, BaseEvent } from "@ag-ui/core"; import { applyPatch } from "fast-json-patch";

function handleAgUiEvent(event: BaseEvent, currentState: MapState) { switch (event.type) { case EventType.STATE\_DELTA: // Apply RFC 6902 patch incrementally to the local state try { const { newDocument } \= applyPatch(currentState, event.delta, true, false); renderMap(newDocument); } catch (error) { console.warn("Patch application failed, requesting full snapshot."); requestStateSnapshot(); } break;

case EventType.RUN\_FINISHED: const finishedEvent \= event as RunFinishedEvent; // Intercept Human-in-the-Loop interrupt requests if (finishedEvent.outcome?.type \=== "interrupt") { const pendingInterrupts \= finishedEvent.outcome.interrupts;

pendingInterrupts.forEach(interrupt \=\> { if (interrupt.reason \=== "tool\_call") { // Halt UI and demand user authorization promptUserForApproval(interrupt).then(approved \=\> { const resumeEntry: ResumeEntry \= { interruptId: interrupt.id, status: approved ? "resolved" : "cancelled", payload: { approved } }; // Send ResumeEntry back to backend to continue or abort submitInterruptResponses(\[resumeEntry\]); }); } }); } break; } }

Example Research Journey

To concretely illustrate the operational flow and user experience of this architecture, consider a researcher accessing CognitiveLiberties.com with a complex, highly sensitive inquiry. Step 1: The Query and Mode Selection The user accesses the navigator and inputs a broad query: "What are the legal precedents protecting mental privacy from consumer neurotechnology interfaces, and how do civil rights groups view these precedents?" Recognizing the complexity of the inquiry, the user explicitly selects the "Opposing Arguments" and "Legal Evidence" discovery modes. Step 2: Backend Orchestration & Private Retrieval The request is routed to a local, air-gapped LLM agent. The agent processes the prompt constraints dictated by the selected discovery modes. It invokes an MCP tool connected to the local LanceDB instance, constructing a highly specific multi-vector search query filtering for Schema.org/ScholarlyArticle, legal datasets, and organizational policy papers9. Step 3: Real-Time Map Generation Rather than drafting an essay synthesizing the legal history, the agent begins organizing the retrieved entities topologically. Via the AG-UI protocol, it streams a series of STATE\_DELTA events utilizing JSON Patch39. On the user's screen, a visual graph organically begins to bloom.

• A central node appears: "Legal Precedents: Mental Privacy & Neurotechnology".
• Two main branches extend representing the "Opposing Arguments" constraint: one branch detailing "Statutory Protections (e.g., Chilean Constitutional Amendment)", and another detailing "Common Law Privacy Torts (e.g., US Fourth Amendment Extensions)".
• Hovering over a node displays the backstory, datePublished, and citation fields parsed directly from the verified JSON-LD metadata, ensuring absolute transparency regarding the source's origin9.

Step 4: User-Guided Expansion and the HITL Interrupt The user decides the branch concerning the Chilean Constitutional Amendment is the most relevant and clicks an interface button to "Expand Context." The agent recognizes that its local vector store lacks recent appellate decisions on this specific international statute. It attempts to invoke an MCP tool designated to search an external, federated legal database utilizing a PIR protocol. Because this tool interacts with an external network, it triggers the approval\_mode="always\_require" constraint. The backend emits a RUN\_FINISHED event with an interrupt payload23. A dialog box immediately halts the map expansion: "The navigator requires permission to initiate a Private Information Retrieval query against the external database 'LegalScholar' for terms related to 'Chilean neurorights'. This action involves external network requests. Proceed?" Step 5: Resolution and Direct Access The user approves the interrupt. The frontend dispatches the ResumeEntry payload23. The agent completes the PIR query, processes the cryptographically protected results, and emits new STATE\_DELTA events adding two recent appellate documents to the map. Finally, the user identifies a highly relevant document node. Clicking on this node bypasses the AI system entirely; it opens the verified, original source URL (a static HTML page hosted on CognitiveLiberties.com or the external organization's site). The user is now reading primary literature directly, free from machine interpretation, conversational tracking, or ongoing surveillance. The agent's session is terminated, and no data is retained.

Threat Model and Security Architecture

Introducing autonomous or semi-autonomous agents into a privacy-first web application dramatically expands the attack surface, introducing vectors that do not exist in traditional static architectures. A robust, adversarial threat model—aligned with the MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) framework—is mandatory to ensure the navigator remains a safe tool for lawful inquiry46. MITRE ATLAS extends traditional cybersecurity modeling to capture adversary behaviors specific to machine learning, generative AI, and agentic systems48.

Implementing these defenses requires a defense-in-depth approach, recognizing that no single control is sufficient to secure an agentic system against sophisticated exploitation50. By combining constrained output schemas, strict cryptographic provenance, and immutable human-in-the-loop oversight, the architecture drastically reduces the probability of successful compromise.

Tradeoffs, Phased Prototype, and Evaluation Plan

While the AG-UI driven interactive navigator offers profound improvements in user autonomy, structured discoverability, and privacy, it introduces significant operational tradeoffs that must be systematically evaluated before full-scale deployment.

Operational and Privacy Tradeoffs

• Computational Cost and Hardware Constraints: Running a privacy-first, capable local LLM (via Ollama or similar inference engines)24 requires substantial computational overhead and VRAM. If these models are hosted server-side by CognitiveLiberties.com, GPU infrastructure costs scale linearly with concurrent users, representing a massive financial burden compared to static hosting. If executed client-side (e.g., via WebGPU), it effectively excludes users operating on low-end hardware or mobile devices, raising significant equity and accessibility concerns.
• Maintenance and Complexity Overhead: The agentic protocol stack is in its infancy and is rapidly evolving. The AG-UI protocol, while powerful, requires maintaining strict compatibility between the backend orchestrator (e.g., LangGraph), the MCP tool definitions, and the frontend React/Vue state reducers54. Additionally, keeping the offline vector database meticulously synchronized with the live website library requires continuous, resource-intensive batch processing and embedding generation28.
• Latency vs. User Experience: Utilizing strict Human-in-the-Loop interrupts and Private Information Retrieval introduces highly noticeable latency into the discovery process. The user must actively manage the AI's execution and approve actions, which inherently adds cognitive load. This represents a deliberate tradeoff: sacrificing the seamless, instant gratification of a traditional search engine in exchange for absolute transparency and user control.

Phased Prototype and Evaluation Plan

To mitigate these risks and ensure the system fundamentally serves the goals of cognitive liberty, development must proceed through a carefully structured, phased deployment strategy.

Phase 1: The Deterministic Foundation (Accessible Fallback)

Before introducing any stochastic AI agents, the core informational library must be rigidly structured and universally accessible.

• Action: Implement comprehensive, exhaustive Schema.org JSON-LD markup (specifically ScholarlyArticle, citation, author, and about) across all resources hosted on CognitiveLiberties.com9.
• Fallback Design: Build a standard, highly optimized non-AI fallback search utilizing standard HTTP form submissions and basic SQL/keyword lookup1. This ensures that users with disabled JavaScript, unsupported browsers, or low-bandwidth connections can still access the core library without any degradation of their fundamental rights to information.

Phase 2: Offline Agent and Local Vectorization

• Action: Implement a local vector database solution such as LanceDB or Qdrant to generate high-dimensional embeddings for the structured library, enabling semantic search26.
• Action: Develop the initial MCP toolset to allow a securely sandboxed, server-side LLM to query this index effectively4.
• Evaluation: Conduct rigorous red-team exercises utilizing the MITRE ATLAS framework. Specifically test for data poisoning (AML.T0020) and prompt injection (AML.T0051) against the isolated backend46. Evaluate whether the agent reliably refuses to output unstructured text, returning only valid, schema-compliant graph nodes.

Phase 3: AG-UI Integration and State Streaming

• Action: Connect the agent backend to the frontend using the AG-UI protocol over SSE or WebSockets.
• Action: Implement the STATE\_DELTA JSON Patch mechanism to render the visual node map dynamically in the browser, ensuring smooth topological transitions39.
• Evaluation: Measure end-to-end synchronization latency. Test the resilience of the application when the SSE connection drops and reconnects, ensuring that full STATE\_SNAPSHOT events successfully recover the user's session without data corruption or loss of visual state39.

Phase 4: Human-in-the-Loop Validation and External Retrieval

• Action: Introduce external MCP tools (e.g., querying external federated libraries via PIR) and mandate strict interrupt handling for these specific tools.
• Evaluation: Conduct extensive User Experience (UX) testing to determine if the AG-UI interrupt dialogs are clear, actionable, and effectively communicate the severe privacy implications of the requested action. Monitor backend logs to guarantee that the ResumeEntry payloads execute deterministically and that rejected interrupts perfectly halt the corresponding tool invocation23.

Conclusions

The deployment of an AG-UI enabled, privacy-first, link-driven AI research navigator represents a viable, highly resilient structural alternative to the prevailing models of surveillance-based search and opaque generative answer engines. By re-architecting the AI's role from an authoritative oracle to a transparent, constrained cartographer, organizations like CognitiveLiberties.com can radically enhance the discoverability of complex human-rights, legal, and technological literature without compromising the fundamental autonomy of the user. The integration of the Agent-User Interaction Protocol (AG-UI) is indispensable to this architecture. Its standardized, event-driven streaming capabilities allow for dynamic, real-time map generation via highly efficient JSON Patch state synchronization. More importantly, its native interrupt mechanisms provide a rigorous, protocol-level enforcement of Human-in-the-Loop approvals, ensuring the machine cannot act independently. When systematically combined with the Model Context Protocol (MCP) for secure, JSON-RPC based data retrieval and Private Information Retrieval (PIR) for cryptographic query protection, the system successfully neutralizes the most pressing vectors identified in modern AI threat models. While the computational overhead, financial cost, and maintenance requirements of this advanced protocol stack are non-trivial, the phased deployment strategy ensures that the system degrades gracefully to a fully functional, highly accessible non-AI fallback. Ultimately, this architecture proves that advanced AI discoverability and absolute mental privacy are not mutually exclusive paradigms, provided the underlying infrastructure is explicitly engineered to keep the human operator firmly, and irrevocably, in control of the interaction.

Works cited

1. Cognitive Liberties, https\://cognitiveliberties.com/

2. AG-UI: the Agent-User Interaction Protocol. Bring Agents ... \- GitHub, https\://github.com/ag-ui-protocol/ag-ui

3. Master the 17 AG-UI Event Types for Building Agents the Right Way, https\://webflow.copilotkit.ai/blog/master-the-17-ag-ui-event-types-for-building-agents-the-right-way

4. Developer's Guide to AI Agent Protocols, https\://developers.googleblog.com/developers-guide-to-ai-agent-protocols/

5. How the Model Context Protocol (MCP) Works \- Lucidworks, https\://lucidworks.com/blog/how-the-model-context-protocol-works-a-technical-deep-dive

6. Schema Markup & Structured Data (JSON-LD) \- SEO Strategy Ltd, https\://www\.seostrategy.co.uk/schema-structured-data/

7. Schema.org JSON-LD Topology: Connected Graphs \- 2RUN, https\://2run.dev/blog/schema-org-json-ld-topology-connected-knowledge-graphs/

8. Dataset \- Schema.org Type, https\://schema.org/Dataset

9. ScholarlyArticle \- Schema.org Type, https\://schema.org/ScholarlyArticle

10. WebPage \- Schema.org Type, https\://schema.org/WebPage

11. Article Schema Markup API and JSON-LD Examples \- Unhead, https\://unhead.unjs.io/docs/schema-org/api/schema/article

12. citation \- Schema.org Property, https\://schema.org/citation

13. Using @id in Schema.org Markup for SEO & Knowledge Graphs, https\://momenticmarketing.com/blog/id-schema-for-seo-llms-knowledge-graphs

14. Schema.org JSON-LD \- docs.researchdata.se, https\://docs.researchdata.se/metadata/schema-org-json-ld/

15. Schema Markup Templates — Copy-Paste JSON-LD Examples, https\://whymetadata.com/schema-templates

16. Understanding MCP servers \- Model Context Protocol, https\://modelcontextprotocol.io/docs/2026-07-28/learn/server-concepts

17. MCP, A2A, and AG-UI \- Agent User Interaction Protocol, https\://docs.ag-ui.com/agentic-protocols

18. AG-UI: How the Agent-User Interaction Protocol Works \- Codecademy, https\://www\.codecademy.com/article/ag-ui-agent-user-interaction-protocol

19. AG-UI Overview \- Agent User Interaction Protocol, https\://docs.ag-ui.com/introduction

20. MCP, A2A, and AG-UI: The Agentic Protocol Stack \- Thinktecture AG, https\://www\.thinktecture.com/contributions/mcp-a2a-and-ag-ui-the-agentic-protocol-stack/

21. Architecture overview \- What is the Model Context Protocol (MCP)?, https\://modelcontextprotocol.io/docs/2026-07-28/learn/architecture

22. A2A vs MCP vs AG-UI | A2A Protocol, https\://a2aprotocol.ai/blog/a2a-mcp-ag-ui

23. Human-in-the-Loop with AG-UI \- Microsoft Learn, https\://learn.microsoft.com/en-us/agent-framework/integrations/by-component/ui/ag-ui/human-in-the-loop

24. Retrieval Augmented Generation (RAG) \- Open WebUI, https\://docs.openwebui.com/features/chat-conversations/rag/

25. Local LLM with Retrieval-Augmented Generation, https\://tonisagrista.com/blog/2025/local-llm-rag/

26. RAG Use Case: Advanced Vector Search for AI Applications \- Qdrant, https\://qdrant.tech/rag/

27. vs Qdrant \- LanceDB, https\://www\.lancedb.com/lp/vs-qdrant

28. Embeddings: Quickstart \- LanceDB, https\://docs.lancedb.com/embedding/quickstart

29. Private Information Retrieval, https\://crypto.stanford.edu/pir-library/

30. Private Information Retrieval \- Cryptowiki, https\://cryptowiki.tm.kit.edu/index.php/Private\_Information\_Retrieval

31. Combining Machine Learning and Homomorphic Encryption in the, https\://machinelearning.apple.com/research/homomorphic-encryption

32. ungovernable.tech/PrivateInformationRetrieval.md at main ... \- GitHub, https\://github.com/aljazceru/ungovernable.tech/blob/main/PrivateInformationRetrieval.md

33. ag-ui-protocol/ag-ui at t01.li · GitHub \- GitHub, https\://github.com/ag-ui-protocol/ag-ui?ref=t01.li

34. AG-UI: The Interface Protocol for Human-Agent Collaboration, https\://medium.com/@jatingargiitk/ag-ui-the-interface-protocol-for-human-agent-collaboration-a93025ab327c

35. SSE is the King. How LLM streaming is changing the… \- Medium, https\://medium.com/@FrankGoortani/sse-is-the-king-0559dcb0cb3d

36. Events \- Agent User Interaction Protocol, https\://docs.ag-ui.com/sdk/js/core/events

37. Events \- Agent User Interaction Protocol, https\://docs.ag-ui.com/sdk/python/core/events

38. Tools \- Agent User Interaction Protocol, https\://docs.ag-ui.com/concepts/tools

39. State Management \- Agent User Interaction Protocol, https\://docs.ag-ui.com/concepts/state

40. AI \- Category | .NET Blog, https\://devblogs.microsoft.com/dotnet/category/ai/feed/

41. State Management with AG-UI | Microsoft Learn, https\://learn.microsoft.com/en-us/agent-framework/integrations/by-component/ui/ag-ui/state-management

42. Runtime options \- assistant-ui, https\://www\.assistant-ui.com/docs/runtimes/ag-ui/runtime-options

43. ag\_ui\_strands : bridge native Strands interrupts to AG-UI \#2205, https\://github.com/ag-ui-protocol/ag-ui/issues/2205

44. Agent Framework AG-UI Integration \- PyPI, https\://pypi.org/project/agent-framework-ag-ui/

45. Types \- Agent User Interaction Protocol, https\://docs.ag-ui.com/sdk/js/core/types

46. MITRE ATLAS Explained: AI Security Framework \- EC-Council, https\://www\.eccouncil.org/cybersecurity-exchange/offensive-ai-security/what-is-mitre-atlas/

47. MITRE ATLAS™, https\://atlas.mitre.org/

48. What is MITRE ATLAS? \- CrowdStrike, https\://www\.crowdstrike.com/en-us/cybersecurity-101/artificial-intelligence/mitre-atlas/

49. MITRE ATLAS: AI Security Framework, Tactics & Techniques, https\://cymulate.com/blog/mitre-atlas-ai-security-framework/

50. Indirect Prompt Injection in AI Agents: How It Works and How ... \- Airia, https\://airia.com/blog/indirect-prompt-injection-in-ai-agents-how-it-works-and-how-to-defend-against-it/

51. From Theory to Practice: Implementing MITRE ATLAS Defenses, https\://medium.com/@michael.hannecke/from-theory-to-practice-implementing-mitre-atlas-defenses-77dde19f9769

52. MITRE ATLAS \- Promptfoo, https\://www\.promptfoo.dev/docs/red-team/mitre-atlas/

53. MITRE ATLAS AI Security and Agentic Threats 2026 Update \- Zenity, https\://zenity.io/blog/mitre-atlas-ai-security

54. Bridging Agents to UI: How AG-UI and CopilotKit Make It Stupidly Easy, https\://practicallyagents.com/articles/the-agent-ui-gap-ag-ui-and-copilotkit/

55. Bridging Agents to UI: How AG-UI and CopilotKit Make It Stupidly Easy, https\://www\.pasmichal.com/post/the-agent-ui-gap-ag-ui-and-copilotkit/

56. The State of Generative UI in 2026: Transports, Formats, and Tradeoffs, https\://www\.openui.com/blog/state-of-generative-ui-report