Questions about mpl

mpl — the Meaning Protocol Layer — is a Rust sidecar proxy for trustworthy AI agent communication. At every hop it validates a payload against a versioned contract, scores it against a quality profile, applies policy, and writes a tamper-evident audit record.

No. Guardrails ask “is this safe?” and filter harmful content. mpl asks “did this meet the contract, and can you prove it?” It is a different layer and should run alongside a guardrail, not instead of one.

A semantic type — a versioned identifier such as org.calendar.Event.v1, backed by a Draft 2020-12 JSON Schema in the registry. Every payload declares its stype so the receiver knows exactly what shape and meaning to expect.

schema_fidelity, instruction_compliance, groundedness, determinism, ontology_adherence, and tool_outcome. You compose the ones you care about into a QoM profile.

Two profiles: qom-basic (schema fidelity only) and qom-strict-argcheck (production-grade). You can author custom profiles as JSON files under registry/profiles/.

MCP (client–server), A2A (peer-to-peer), and plain HTTP. A2A hardening is a Phase 3 item per the README — check current release notes before relying on it in production.

No. The proxy runs as a sidecar. Agents point at the proxy address; it validates, scores, records, and forwards. When you want to read the verdict in code, use the Python or TypeScript SDK.

Each record includes a BLAKE3 content hash (sem_hash) of the canonicalised payload, plus the provenance block and QoM report. Any change to the payload changes the hash, so records cannot be silently rewritten.

No. mpl produces primitives that map to common regulatory asks (SOX, GDPR, HIPAA, EU AI Act) — tamper-evident records, provenance, quality scores — but these are evidence, not certifications. Your compliance program owns the mapping.

Python (pip install mpl-sdk) and TypeScript (npm install @mpl/sdk). Both return valid, qom_passed (or qomPassed), and the response payload.

Yes, MIT licensed. You run the proxy yourself and sink the audit trail wherever you like. There is no hosted service.

Phase 1 (core protocol, Python SDK, sidecar proxy, schema registry) and Phase 2 (TypeScript SDK, registry API, Helm chart, policy engine) are complete. Phase 3 (conformance suite, A2A hardening, production readiness) is in progress. The test suite reports 144 passing as of the README.