Catch cross-tenant leaks before production.
57 deterministic rules for tenant boundaries across multi-tenant SaaS and MCP server code.
One security invariant
Tenant A should not become Tenant B.
A tenant boundary can fail even when authentication itself succeeds. The application still needs to preserve tenant context through data access, cache state, storage, sessions and every tool that can act on tenant data.
What the 57 rules cover
Tenant Context Management
Critical
Database Query Isolation
Critical
IDOR Prevention
Critical
Cache & Session Isolation
High
API Security
High
File Storage Isolation
High
Logging & Audit
Medium
Schema & Migration
High
Tool visibility scoping, tenant-prefixed cache keys, session binding to user + tenant, token exchange, per-tenant rate limiting, vector-store namespaces, credential vault scoping, shared service accounts, session cleanup, telemetry tenant identity, local binding, filesystem tenant roots, artifact isolation, dynamic tool namespace checks.
MCP introduced more tenant boundaries.
The tenant boundary now extends into the tools an agent can discover and invoke, the credentials those tools use, and the shared infrastructure behind them.
How the scanner works
This is static analysis with flow-aware guard detection, not formal verification or complete taint proof. The scanner produces deterministic findings: given the same source code, it produces the same results.
The v2 evidence contract
COMPLETENESS
COMPLETE / PARTIAL / ERROR
COVERAGE
Files and rules analyzed, failures accounted for
CONCERN FAMILIES
8 higher-level triage groups
LIMITATIONS
Explicit scope of what static analysis could not verify
SCAN RECEIPT
Engine, rulepack, and provenance digest
EVIDENCE ENVELOPE
Tamper-evident execution context
SEMANTIC FINGERPRINT
Stable across line movement and format changes
PROOF-OF-FIX
STILL_PRESENT / NEW / NOT_VERIFIABLE
Safer MCP defaults in v2
Read Only by Default
Write Tool Opt-In
Project-Root Confinement
Stdio Only
This keeps the MCP interface local and narrows the agent's filesystem authority.
Use it in CI
uses: subodhkc/mcp-tenant-isolation@v2
SARIF
SARIF 2.1.0 output for GitHub Code Scanning integration
OUTPUT FORMATS
Terminal, JSON, SARIF, AI-oriented JSON, Markdown
Use it through MCP
{
"mcpServers": {
"tenant-isolation": {
"command": "npx",
"args": ["-y", "mcp-tenant-isolation", "mcp"]
}
}
}| Tool | Description | Write |
|---|---|---|
| scan_tenant_isolation | Scan a project path. Returns structured findings with completeness, coverage, concern families, and receipt. | no |
| list_tenant_isolation_rules | Returns all 57 rules with metadata. Filterable by category. | no |
| explain_tenant_isolation_rule | Returns rule details, OWASP mapping, CWE IDs, fix suggestions. | no |
| suppress_tenant_isolation_finding | Add a suppression with reason, approver, controls, and expiry. Write-gated. | opt-in |
Limitations
- -Static analysis has inherent limitations
- -Cannot prove runtime behavior
- -Cannot prove database enforcement occurring outside analyzed artifacts
- -Dynamic or generated code may not be visible
- -Unsupported languages are reported
- -Partial scans do not prove absence of findings
- -OWASP mapping is advisory, not compliance certification
- -No compliance certification
Technical identity
HAIEC DEVELOPER SECURITY
SOURCE SECURITY
AI AppSec
Explore ->
BOUNDARY SECURITY
MCP Tenant Isolation
Current page
RUNTIME
LLMVerify
Explore ->
Secure the code. Protect the tenant boundary. Verify the model interaction.
MIT licensed. Powered by HAIEC. Free package, no HAIEC account required.