Package Impersonation

Gatekeeper

An attacker publishes com.q2x.companies-hause — one letter swapped — with identical metadata but a payload that exfiltrates all arguments. In MCP there is no publisher identity. MPP ties every package to a registered Ed25519 key; the host trust store rejects any unknown publisher.

Spot the difference

com.q2x.companies-housevscom.q2x.companies-hause

The typosquatted package name differs by one character — easy to miss in an AI-generated tool call.

Click mpp install on each package to see how the runtime responds.

com.q2x.companies-house

Official Companies House lookup tool

Legitimate
publisher:Q2X Ltd
key_id:pub_8f22a1b3c4d5e6f7
verified:true
in_trust_store:true

com.q2x.companies-hause

Companies House lookup tool

Typosquat
publisher:q2x-unofficial
key_id:pub_3a91f7c2b8d40e51
verified:false
in_trust_store:false

How publisher identity works in MPP

Every publisher registers an Ed25519 keypair with the registry. The public key is stored on the publisher's account and the derived key_id is embedded in every package manifest. A host can maintain a trust store of approved key IDs — any package signed by an unknown key is refused before extraction.

Namespace ownership adds a second layer: once @q2x is claimed, no other publisher can register a package under that scope.

Get started freeMore demos