Tenantguard

What the tenantguard MCP server does

The tenantguard MCP server audits configuration data from self-hosted, multi-tenant AI-agent platforms for controls that can separate one tenant’s resources, identities, and operations from another’s. It exposes the audit through an MCP tool, while the same project provides a tenantguard command for local scans.

The checks focus on declarations that affect isolation and security boundaries. Examples include tenant-scoped workspace or sandbox mounts, ownership of scheduled-agent bindings, restrictions on command execution, fail-closed sandbox behavior, channel and session identity reuse, signed bridge context headers, and differential channel reload behavior. The scanner also examines SSRF-related declarations for MCP tool URLs and provider connections where applicable.

Results identify passing and failing checks, point to the relevant configuration location when available, and may associate findings with confirmed upstream issues. The sample output also includes provisional HIPAA references; these citations should not be treated as definitive compliance determinations.

How it works

A scan evaluates a deployment or configuration fixture against TenantGuard’s isolation rules. Findings are labeled with identifiers such as TA01, TA02, and TA15, followed by an explanation of the condition that was detected. The output ends with counts for failed and clear checks.

Some rules are entry-dependent. Checks for credential-storage encryption, provider connection SSRF, and per-agent resource-profile isolation only run when the scanned configuration contains the corresponding entries. An empty collection therefore produces no result for that rule, rather than an automatic pass or failure.

The scanner can also flag declarations that it cannot independently verify at runtime. For example, a declared IP-pinning or differential-reload setting may be trusted as configuration evidence even though the tool cannot confirm that the running implementation actually enforces it. Review these caveats alongside the findings.

Setup and configuration

The recommended installation is the tenantguard-cli npm package:

npm install -g tenantguard-cli
tenantguard scan --demo

Go installation is available with:

go install github.com/RudrenduPaul/TenantGuard/cmd/tenantguard@v0.2.0

Python users can install the wrapper with pip install tenantguard-cli or run it through uvx --from tenantguard-cli tenantguard scan --demo. The npm package covers macOS Intel and Apple Silicon, Linux x64 and arm64, and Windows x64 and arm64. Go is the fallback for platforms supported by Go but not covered by the published npm packages.

The Python wrapper downloads the matching release binary on first use, verifies its checksum, and caches the verified binary locally. The repository notes that Python package versions 0.1.3 and later contain the fix for an earlier checksum-certificate parsing issue.

Tools and capabilities

The tenantguard MCP server provides an MCP-based scan capability for agent-native use. The repository excerpt does not specify the MCP tool’s exact name, arguments, transport, or client configuration, so those details should be confirmed in the project’s MCP server documentation before integration.

The CLI’s demonstrated scan --demo command runs against a bundled synthetic deployment fixture. That fixture intentionally contains many failures so users can see the rule output; it is not representative evidence that a real deployment is secure.

Limitations and notes

The tenantguard MCP server checks configuration declarations rather than proving every runtime property. A clean result can still depend on declarations that the scanner cannot validate against the live implementation, including IP-pinning, private-address validation, and differential reload behavior.

The findings shown in the README include provisional HIPAA mappings and references to open issues in the goclaw project. Treat those mappings as contextual references, not as a certification or complete compliance review. The tool is also limited to the rules implemented for the supported configuration structures; absent entries may leave some checks unevaluated.