For Host Developers

What is a Host Developer?

A host developer is someone building an AI platform, agent framework, or product that loads MCP tools on behalf of users. If your platform lets users bring their own MCP servers, or if you publish a curated set of tools for your users to run, you are a host developer.

MPP gives you the infrastructure to enforce cryptographic verification of every tool before it runs — without building the signing, registry, and audit infrastructure yourself.

Integration Options

Option 1: Use the MPP Runtime Directly

The MPP runtime handles download, verification, sandboxing, and audit logging. Embed it in your platform:

npm install @q2x/mpp-runtime

import { MppRuntime } from "@q2x/mpp-runtime";

const runtime = new MppRuntime({
  registryUrl: "https://mpp-protocol.space",
  apiToken: process.env.MPP_API_TOKEN,
  tenantId: session.tenantId,
  policyMode: "signed-only", // reject any unverified package
});

// Load and run a tool — verification happens automatically
const result = await runtime.invoke({
  package: "@q2x/sql-guardian@2.1.0",
  method: "analyzeQuery",
  args: { query: userQuery },
});

All invocations are automatically written to your audit log under your tenantId.

Option 2: Verify-Only Integration

If you have an existing tool loading mechanism and only want signature verification:

import { verifyPackage } from "@q2x/mpp-verify";

const result = await verifyPackage({
  name: "@q2x/sql-guardian",
  version: "2.1.0",
  localPath: "/path/to/downloaded/package",
  registryUrl: "https://mpp-protocol.space",
  apiToken: process.env.MPP_API_TOKEN,
});

if (!result.verified) {
  throw new Error(`Package verification failed: ${result.reason}`);
}

// Proceed with loading the tool through your existing mechanism

Option 3: Registry API

Query the registry directly via REST API for custom integrations:

GET /api/v1/packages/{name}/{version}
Authorization: Bearer {apiToken}

Response:

{
  "name": "@q2x/sql-guardian",
  "version": "2.1.0",
  "hash": "sha256:abc123...",
  "signature": "ed25519:xyz789...",
  "publisherKey": "ed25519-pub:123abc...",
  "publishedAt": "2025-06-01T12:00:00Z",
  "capabilities": { ... }
}

Your platform verifies the signature against publisherKey before loading the package.

Enforcing Policies

The policyMode option controls what happens when a tool fails verification:

Mode	Behaviour
signed-only	Reject any package without a valid registry record (default for enterprise)
warn	Log a warning but allow the invocation to proceed
audit-only	Always allow but record the verification result in the audit log

We strongly recommend signed-only for production deployments.

Audit Log Access

Your audit log is accessible via the dashboard or via API:

GET /api/v1/audit?tenantId={id}&from=2025-06-01&to=2025-06-30
Authorization: Bearer {apiToken}

Log entries are retained for the duration of your plan's retention period and cannot be deleted.

Multi-Tenant Considerations

If your platform is itself multi-tenant (you host multiple customer organisations):

• Pass each customer's tenantId when initialising the runtime
• Audit log entries are automatically partitioned by tenantId
• Each tenant's log is only accessible with their own API token
• Row-level security in the database enforces this independently of your application

Support

Enterprise plan customers have a named support contact. Reach us at support@quantum2x.com for integration support.