MCP Tenant Isolation

What mcp-tenant-isolation MCP server does

The mcp-tenant-isolation MCP server provides static analysis for multi-tenant SaaS applications and MCP server implementations. It checks source code for missing tenant guards in database queries, ID-based lookups, API responses, cache and session keys, file access, schema definitions, logging, and MCP tool architecture.

The rule set contains 57 deterministic checks: 42 general multi-tenant checks and 15 MCP-specific checks. Examples include verifying tenant-derived context, tenant filters on Prisma, Drizzle, and raw SQL queries, tenant-aware file and vector-store paths, per-tenant rate limits, tool visibility, session binding, credential storage, and local network binding. The MCP-specific rules are mapped to the OWASP MCP Top 10 for reporting and triage; the mapping does not certify compliance.

How it works

The scanner parses TypeScript and JavaScript with Babel, reads Prisma schemas and SQL migrations, and detects MCP SDK imports. It builds an intermediate representation and flow graph of sources, sinks, guards, routes, and MCP tool definitions before evaluating the rules. Test-file detection, confidence scoring, and pattern refinement are used to filter likely false positives.

The scan_tenant_isolation tool accepts a project path and returns structured results. Output reports completeness as COMPLETE, PARTIAL, or ERROR, along with discovered and parsed files, rule evaluation counts, unsupported file types, concern-family groupings, limitations, and a scan receipt containing engine, rulepack, timestamp, and hash metadata. Findings use semantic fingerprints that remain stable when code moves or formatting changes. Baseline comparisons can label findings as STILL_PRESENT, NEW, or NOT_VERIFIABLE.

Setup and configuration

Install the package globally with npm, run it through npx, or use the published Docker image. Node.js 22 or later is required for the npm and npx approaches; Docker avoids requiring Node.js on the host.

npm install -g mcp-tenant-isolation
npx mcp-tenant-isolation scan ./src
docker run --rm -v $(pwd):/code subodhkc/mcp-tenant-isolation scan /code/src

The included mcp-tenant-isolation MCP server runs locally over stdio, so it does not require hosting or network exposure. The CLI can also produce terminal, SARIF, Markdown, JSON, and AI-oriented JSON output, and includes commands for initialization, rules, suppression, baselines, and MCP operation.

Tools and capabilities

• scan_tenant_isolation: scans a project path and returns findings plus completeness, coverage, concern families, limitations, and a receipt.
• list_tenant_isolation_rules: lists all 57 rules and metadata, with category filtering.
• explain_tenant_isolation_rule: explains a rule, its OWASP mapping, CWE identifiers, and suggested remediation.
• suppress_tenant_isolation_finding: records a suppression with a reason, approver, controls, and expiry.

The CLI supports severity filtering and baseline creation for proof-of-fix tracking. The MCP server is intended for local agent-driven scans, while the CLI is also suitable for scripted or CI workflows.

Limitations and notes

Static analysis cannot establish runtime behavior, database-level enforcement, or dynamic tenant isolation. The scanner reports these boundaries in the limitations field for each run. Parsing failures or rule-evaluation failures reduce completeness to PARTIAL, with reasons included in the result. OWASP mappings are advisory and should be treated as reporting guidance rather than certification.