Glossary

Audit Log

An append-only record of every tool invocation in the MPP runtime. Enforced at the database level — application code cannot modify or delete entries. Retained for a period defined by your subscription plan.

Capability Manifest

A machine-readable JSON declaration in mpp.manifest.json that lists exactly what filesystem paths, network hostnames, and environment variables a tool is allowed to access. The WASM sandbox enforces this at runtime.

Capability Scope

The set of permissions granted to a tool by its capability manifest. A tool operating within its declared scope is said to be within scope. An attempt to access anything outside the scope triggers a sandbox violation.

Content Hash

A SHA-256 hash of a package's build artefact. Stored in the registry at publication time. Recomputed at load time to verify the package has not been modified since publication.

Ed25519

A modern elliptic-curve signature algorithm using the Edwards curve (Curve25519). Fast, small signatures (64 bytes), and resistant to side-channel attacks. Used by MPP for package signing in the local/development KMS provider.

ECDSA

Elliptic Curve Digital Signature Algorithm. Used by MPP for signing via AWS KMS (ECDSA_SHA_256 with P-256). Compatible with hardware security modules (HSMs) that do not support Ed25519 natively.

Host Developer

A developer building a platform or agent framework that loads MCP tools on behalf of users. Contrast with Tool Author.

Invocation

A single call from an AI agent to a function provided by an MPP package at runtime. MPP billing is a flat monthly subscription — you are not charged per invocation. The usage dashboard shows attestation verification calls (registry API calls made to confirm a package's attestation is still valid), not downstream invocation counts.

KMS (Key Management Service)

The component responsible for signing and verifying signatures in MPP. MPP supports two KMS providers: local (Ed25519 seed in environment variable, for development) and aws (ECDSA via AWS KMS, for production).

MCP (Model Context Protocol)

The protocol standard for connecting AI agents to tools and services. Introduced by Anthropic in 2024, now a Linux Foundation standard. MPP is a security layer for MCP — it does not replace MCP.

MPP (Model Package Protocol)

A security and attestation layer for MCP servers. MPP adds signed provenance, WASM sandboxing, capability scoping, and immutable audit logs to any MCP server package.

Package

A self-contained, signed distribution unit in the MPP Registry. A package contains an MCP server entrypoint, a capability manifest, and a cryptographic signature. Once published, a version is immutable.

Private Package

A package visible only to members of the publishing organisation's Enterprise namespace. Available on Enterprise plans. Private packages must be scoped to the publisher's organisation name.

Provenance Attestation

A cryptographically verifiable record of who created a package, when it was published, and that the content has not changed since publication. Provided by the MPP Registry for every published package.

Publisher

An authenticated MPP Registry account that has published one or more packages. Each publisher has a registered Ed25519 public key that consumers use to verify their signatures.

Registry

The central repository of signed package metadata. Stores content hashes, signatures, and publisher key fingerprints. All records are append-only.

Sandbox Violation

An attempt by a running tool to access a resource (file path, network hostname, environment variable) not declared in its capability manifest. The WASM runtime terminates the process immediately and records the violation in the audit log.

Signing Key

An Ed25519 (local) or ECDSA (AWS KMS) private key used to sign package manifests at publication time. The corresponding public key is registered with the MPP Registry and used by consumers to verify signatures. Private keys must never be committed to version control.

Tenant

An organisation with its own isolated namespace in the MPP Registry. All package records, audit log entries, and usage data are partitioned by tenant. Row-level security in the database enforces isolation at the query level.

Tool Author

A developer or organisation that writes and publishes MCP server packages to the MPP Registry. Contrast with Host Developer.

WASM (WebAssembly)

A portable binary instruction format that runs in a deterministic, sandboxed environment. MPP uses the Wasmtime runtime with the WASI 0.2 Component Model to execute tools in isolation.

WASI (WebAssembly System Interface)

A standardised interface for WASM modules to interact with the host operating system in a controlled way. MPP uses WASI 0.2 (the Component Model), which provides a typed interface for filesystem, network, and environment access — and which the MPP sandbox can intercept and enforce.