mp itself has access to nwm::EXT (more control over the nwm networking stuff?), cfg:nor and ptm:s. But cfg:nor is used to write the DS-mode NVRAM (i.e., the one where you'd write the mset exploit ROP to).
I'm too lazy to actually take a look at the code; none of the strings in the exefs are useful to determine what it does.