Docs

Getting Started

Install the MPP CLI, publish your first signed package, and verify it in under 10 minutes.

Prerequisites

  • Node.js 20 or later
  • An MPP Registry account (sign up at /signup)
  • An existing MCP server project, or start fresh

1. Install the CLI

npm install -g @q2x/mpp-cli

Verify the installation:

mpp --version

2. Authenticate

mpp login

This opens a browser window to authenticate via your MPP Registry account. After login, your API token is stored in ~/.mpp/credentials.

3. Initialise Your Package

In your MCP server project directory:

mpp init

This creates an mpp.manifest.json in your project root. Edit it to declare your package's capabilities:

{
  "name": "@yourorg/your-tool",
  "version": "1.0.0",
  "description": "A brief description of what this tool does",
  "entrypoint": "dist/index.js",
  "capabilities": {
    "filesystem": {
      "read": ["/tmp/mpp-workspace"],
      "write": ["/tmp/mpp-workspace"]
    },
    "network": {
      "outbound": ["api.yourservice.com"]
    },
    "env": []
  }
}

Declare only what your tool genuinely needs. Overly broad capability declarations are a red flag to enterprise buyers reviewing your package.

4. Generate a Signing Key

mpp keys generate

This generates an Ed25519 key pair and stores it in ~/.mpp/keys/. The public key is associated with your account in the registry. The private key never leaves your machine.

Never commit your private key to version control.

5. Build and Sign

npm run build
mpp sign

mpp sign hashes your build artefact and signs the manifest. The signature is written to mpp.manifest.json.sig.

6. Publish

mpp publish

The CLI uploads your package, manifest, and signature to the registry. The registry records:

  • Your package's content hash
  • The Ed25519 signature
  • The signing key fingerprint
  • The publication timestamp

Once published, these records are immutable.

7. Verify a Published Package

Any party with the CLI can verify a package without trusting the downloader:

mpp verify @yourorg/your-tool@1.0.0

Output on success:

✓ Hash matches registry record
✓ Signature valid — signed by key abc123...
✓ Key fingerprint matches publisher account
✓ Published: 2025-06-01T12:00:00Z

8. Install and Use

From a consuming project:

mpp install @yourorg/your-tool

The CLI downloads, verifies, and registers the tool with the local runtime. Any agent framework that supports MCP can then invoke it — the runtime wraps the tool in the WASM sandbox automatically.

Next Steps