FAQ
Common questions from teams evaluating MPP Registry for production AI tool deployments.
General
Is MPP a replacement for MCP?
No. MPP is a security and attestation layer that wraps MCP servers. The MCP protocol itself is unchanged. Agent frameworks that support MCP continue to work without modification — MPP adds verification and sandboxing without breaking the interface.
Does MPP require changes to my existing MCP clients?
No, if you use the MPP runtime. The runtime presents the same MCP interface to clients. If you do verify-only integration, you manage verification before passing control to your existing loader.
Can I use MPP with Python-based MCP servers?
Yes. The MPP package format is language-agnostic. The CLI wraps any compiled entrypoint. Python servers need to be bundled (e.g., using PyInstaller or Docker) before signing. Native packaging support for Python will be available in a future CLI release.
Security
What happens if a private key is compromised?
Rotate your key immediately using mpp keys rotate. The rotation cross-signs the new key with the old one to maintain chain of custody. Contact support@quantum2x.com so we can flag the old key as compromised in the registry. Packages signed with the old key will display a warning.
Can a tool escape the WASM sandbox?
The sandbox uses the Wasmtime runtime, which has a strong isolation model. Known escapes are tracked and patched in Wasmtime upstream. We also run the sandbox under a seccomp filter on Linux to add a second isolation layer. No system is perfectly escape-proof, but the attack surface is significantly smaller than an unsandboxed process.
How is the audit log made tamper-evident?
A Postgres trigger rejects any UPDATE or DELETE on the audit log table at the database level. Application code cannot bypass this. Audit entries are also periodically checkpointed with a Merkle hash, allowing you to verify that no entries have been removed from a sequence.
Billing and Plans
How does MPP billing work?
MPP uses a flat monthly subscription model — you pay for access to the registry infrastructure, not per tool invocation. The Free plan is available to anyone publishing public packages. Enterprise plans (starting at £499/month) give your organisation a private namespace, extended audit log retention, SSO, and an SLA.
What does the Enterprise plan include?
Enterprise plans include: a private isolated namespace for your packages, 12-month audit log retention, SSO via Google Workspace or Microsoft Entra, team management, and a 99.5% uptime SLA. See /pricing for a full comparison.
What happens to my data if I cancel?
When you cancel, your account is downgraded to the Free plan immediately. Private packages become inaccessible (not deleted) for 30 days, giving you time to export your data. After 30 days, private packages are deleted per the terms of the DPA. Your audit logs for the paid period are retained for their full retention window even after cancellation.
Are there discounts for non-profits or open-source projects?
Contact us at support@quantum2x.com to discuss your situation. We assess these on a case-by-case basis.
Is the registry open source?
The protocol specification, CLI, runtime, and registry codebase are all open source — anyone can self-host an MPP Registry. Q2X operates the canonical public registry at mpp-protocol.space. The enterprise-tier features — private namespaces, SSO, extended audit log retention, SLA, and support contracts — are proprietary commercial services available only through the hosted registry.