Building the security layer
MCP deserves.
Quantum 2x Ltd is a UK-based AI security, architecture and governance organisation. We built the Model Package Protocol to close the trust and attestation gap in the rapidly growing MCP ecosystem.
The Problem We Solve
MCP (Model Context Protocol) is now the dominant standard for connecting AI agents to tools and services — a Linux Foundation standard with thousands of public servers and tens of millions of SDK downloads per month. Gartner has issued explicit MCP security warnings. OWASP has published guidance for securely using third-party MCP servers. The first malicious MCP server has been found in the wild.
MCP defines the protocol. It does not define the security layer. Every organisation deploying MCP servers faces the same unresolved questions: How do you know an MCP server hasn't been tampered with? How do you prevent a server from accessing more than it declared? How do you maintain an audit trail?
MPP (Model Package Protocol) is the answer — a security and attestation layer that brings signed provenance, sandboxed execution, and capability governance to every MCP server package.
Who We Are
Quantum 2x Ltd is an independent UK company, registered in England and Wales. Our team brings together expertise in AI security, protocol design, cryptography, and enterprise software. We operate from London, and our work on MPP is developed with clean-room IP by independent UK researchers.
We are not an academic project. We are a commercial organisation building production-grade infrastructure for the AI era. MPP is our first product, and the MPP Registry is the commercial deployment of the protocol for enterprise teams.
Our Principles
Security by architecture
Security is not bolted on. It is the foundation of every design decision in MPP.
Zero-trust defaults
No tool is assumed safe. Every package is verified on every load, regardless of source.
Transparency
Everything a tool declares — its author, permissions, version — is visible, verifiable, and immutable.
Portability
Tools are self-contained packages that travel with their security guarantees intact, wherever they are deployed.
Contact
For enterprise enquiries, licensing discussions, partnership proposals, or security disclosures, get in touch via the contact form or reach us directly: