Here's the better design: have agents communicate via Mastodon. Take a basic JSON payload, encrypt it using basic public key encryption, and attach it to a DM.

This is far better than designing an entirely new protocol, as ActivityPub and Mastodon already have everything you need, including an API.

Now, that's just transport security. If you expose a server that will execute arbitrary commands, nothing can protect you.