Blog
Insights on AI security, tool execution sandboxing, and the Model Package Protocol specification.
The AI Tool Marketplace is Coming: Here's What the Infrastructure Needs to Look Like
The next phase of AI is not more models — it's a thriving marketplace of specialised tools. But marketplaces need trust infrastructure. Identity, integrity, permissions, and audit trails are not optional features. They are prerequisites.
Why AI Tool Portability Matters More Than You Think
Today's AI tools are tied to specific runtimes, frameworks, and host environments. This fragmentation is not a minor inconvenience — it's an economic barrier that will prevent the AI tool ecosystem from maturing. Here's why portability is the foundation.
From MCP Server to MPP Package: A Migration Guide
You have MCP tools running as live server processes. Here's the practical, step-by-step path to packaging them as signed, sandboxed MPP packages — without rewriting your business logic.
Compliance-Ready AI: How MPP Supports GDPR, HIPAA, and the EU AI Act
Regulatory frameworks are catching up to AI. Enterprises need infrastructure that makes compliance demonstrable — not aspirational. Here's how MPP maps to the specific requirements of GDPR, HIPAA, and the EU AI Act.
MPP Registry Federation: Decentralised Trust for Enterprise AI
Large enterprises don't want to depend on a single public registry. But they also don't want to fork the ecosystem. MPP's federation model lets organisations run private registries that interoperate with the public ecosystem — with configurable trust at every boundary.
Securing the AI Tool Supply Chain: Lessons from npm, PyPI, and Crates.io
The software supply chain has been under sustained attack for a decade. AI tool registries are next. Here's what we learned from npm, PyPI, and crates.io — and how MPP is designed to avoid repeating the same mistakes.
The Human-in-the-Loop Problem: When Should an AI Agent Ask for Permission?
Too many prompts and agents become useless. Too few and they become dangerous. MPP's sensitivity scoring and tiered approval system solves the calibration problem that every AI deployment faces.
How MPP Fits Into Your Existing AI Agent Stack
You have agents running on LangChain, CrewAI, or a custom framework. You're using MCP for tool discovery. Here's exactly where MPP sits in the stack, what it replaces, what it doesn't, and what the migration path looks like.
Audit Logs That Actually Work: Tamper-Evident Logging for AI Agent Actions
When an AI agent acts on behalf of a user, someone needs to answer: what happened, when, and why? Traditional logging falls short. MPP's hash-chained audit logs provide a tamper-evident record that survives scrutiny.
Cryptographic Signing for AI Tools: What Ed25519 Gives You
Supply-chain attacks on package registries are not theoretical — they happen regularly. Here's how MPP uses Ed25519 signatures to close the trust gap for AI tools, and what that means operationally for security teams.
MPP vs. Running Tools in Docker: Why Containers Aren't Enough
Some teams attempt to secure AI tool execution by wrapping tools in Docker containers. It's a reasonable instinct — but containers were designed for a different problem. Here's a direct comparison across the dimensions that matter.
PII Redaction at the Protocol Level: Privacy by Design for AI Workflows
When an AI agent calls a tool that queries customer data, sensitive information flows back into the model context — where it persists, gets logged, and may leak. MPP's privacy filter layer stops it at the boundary.
Capability-Based Permissions: Least Privilege for AI Tools
Traditional access control gives a process broad permissions and hopes for the best. MPP inverts this: tools declare exactly what they need, and the runtime refuses everything else. Here's how the capability model works.
WASM Sandboxing Explained: How MPP Isolates Tool Execution
Most enterprise teams think of WebAssembly as a browser technology. In MPP, it's the execution engine that gives every AI tool its own isolated universe — with no ambient access to anything. Here's how it works.
The Enterprise Case for AI Tool Governance
AI agents are entering production with real system access and zero governance. For enterprise leaders evaluating AI agent platforms, the question is no longer whether to adopt — it's whether your infrastructure can answer the questions your auditors are about to ask.
Inside the Gatekeeper: How MPP Verifies Every Tool Before Execution
Before a single byte of tool code runs, it passes through seven independent verification checks. Here's exactly what the Gatekeeper does, why each step exists, and what class of attack it prevents.
Zero Trust for AI Agents: Why Implicit Trust Will Burn You
Enterprise networks moved to zero trust years ago. AI agent tooling is still running on blind faith. Here's why that gap is closing fast — and what happens to organisations that don't close it first.
MPP and MCP: Two Protocols, One Complete Story
MCP gave AI agents a universal language for tool invocation. MPP gives those tools a security model worthy of production. Here's how they fit together — and why you probably need both.
Introducing MPP: Containerization for AI Tool Execution
The AI tooling ecosystem is growing fast, but the security model hasn't kept pace. MPP brings container-like isolation, cryptographic signing, and fine-grained permissions to AI agent tool artifacts.