What is MPP?

The Security Gap

MCP (Model Context Protocol) is now the dominant standard for connecting AI agents to tools and services. Anthropic introduced it in late 2024, and since then it has been adopted by virtually every major AI framework. As of mid-2025 it is a Linux Foundation standard with thousands of public servers and tens of millions of SDK downloads per month.

But MCP defines the protocol — not the security layer.

When an AI agent loads an MCP server, it has no way to answer the questions that matter most:

• Who wrote this tool? Is it from a trusted source or was it uploaded by an anonymous actor?
• Has it been tampered with? Is the code running today the same code that was reviewed?
• What can it access? Does it stay within its declared permissions, or can it silently escalate?
• What happened during execution? If something goes wrong, is there an immutable audit trail?

Gartner has issued explicit MCP security guidance. OWASP has published threat modelling for MCP servers. The first confirmed malicious MCP server was found in the wild in Q1 2025.

What MPP Provides

The Model Package Protocol (MPP) is a security and attestation layer that wraps MCP servers with production-grade security.

Signed Provenance

Every MPP package is signed with the publisher's Ed25519 private key at publication time. The signature is recorded in the registry alongside the publisher's identity. Before any agent loads a tool, it can verify: the package hash matches the registry record, and the record was signed by the claimed publisher.

If a package is modified after signing, even by one byte, verification fails and the load is rejected.

WASM Sandboxing

Tools run inside a WebAssembly sandbox with a deterministic capability list. The manifest declares what the tool is allowed to do with file paths, network endpoints, environment variables. The runtime enforces these at the system call boundary. A tool that tries to access something outside its declared scope is terminated.

Capability Scoping

Every package has a machine-readable capability manifest. You can read exactly what a tool requires before you install it. No implicit permissions. No surprises.

Immutable Audit Log

Every invocation is recorded to an append-only audit log. The log is write-protected at the database level, no application code can alter or delete it. You get a permanent, forensic record of what ran, when, what it accessed, and what it returned.

The Trust Chain

Publisher signs package → Registry stores hash + signature
Agent downloads package → Runtime verifies hash against registry
Runtime loads tool → WASM sandbox enforces capability manifest
Tool runs → Every call logged to immutable audit log

No step in this chain trusts a previous step without verification.

How MPP Relates to MCP

MPP does not replace MCP. It wraps it.

An MPP package is an MCP server that has been:

1. Packaged with a signed manifest
2. Published to a registry that records its cryptographic identity
3. Wrapped in a WASM runtime that enforces its declared capabilities
4. Integrated with an audit log for every invocation

Any existing MCP server can be wrapped as an MPP package. The MCP protocol itself is unchanged. The agent-facing interface is identical. The difference is everything between the registry and the runtime.

Who is MPP for?

Enterprise teams deploying AI agents in production who need evidence of what ran and what it accessed for compliance, security review, or incident response.

Platform builders embedding MCP tool support who want to enforce signed-package-only policies without building a bespoke signing and verification pipeline.

Tool authors who want their packages to carry cryptographic proof of authenticity and be distinguishable from unsigned alternatives.