MCP Tenant Isolation
Scanner
57 deterministic rules for MCP server & multi-tenant SaaS security
Static analysis that detects cross-tenant data leakage, IDOR, missing RLS, cache key collisions, and MCP-specific isolation gaps. OWASP-aligned. SARIF output. MCP server for AI agent integration.
General Scanners Miss Tenant Isolation
Snyk, Semgrep, and CodeQL don't understand multi-tenant data models or MCP server architecture. Cross-tenant data leakage goes undetected.
General Security Scanners
- ✗No tenant isolation rule set
- ✗No MCP server code detection
- ✗No Prisma schema tenant field analysis
- ✗No RLS policy detection
- ✗No cache key tenant prefix checks
- ✗No MCP tool visibility scoping rules
mcp-tenant-isolation
- 57 specialized tenant isolation rules
- 15 MCP-specific rules (tool visibility, sessions, vaults)
- Prisma schema parser with tenant field detection
- SQL migration RLS policy detection
- Cache key tenant prefix validation
- MCP server for AI agent integration
Get Started in 30 Seconds
No installation required. Scan your codebase directly with npx.
# Install globally
npm install -g mcp-tenant-isolation
# Or use npx (no install needed)
npx mcp-tenant-isolation scan ./src
# Initialize config
mti initArchitecture
Six-layer deterministic pipeline. No AI in detection. Fully reproducible and auditable. Same engine powers both the CLI and MCP server.
Parsers
Babel AST parser for TypeScript/JavaScript. Dedicated Prisma schema parser. SQL migration parser for RLS detection. MCP SDK import detection.
IR & Flow Graph
Source code is transformed into an Intermediate Representation (IR) capturing sources, sinks, guards, routes, and MCP tool definitions. A Flow Graph tracks data flow paths from sources to sinks.
Rule Engine
57 deterministic rules evaluated against the IR. Each rule defines sources, sinks, required guards, and forbidden flows. No AI, no heuristics — fully reproducible.
False Positive Filter
Context-aware filtering reduces noise. Test file detection, pattern refinement, confidence scoring, and known FP suppression.
Reporters
JSON, SARIF 2.1.0 (GitHub Code Scanning), terminal (human-readable), and MCP structured output for AI agent consumption.
CLI & MCP Server
CLI tool (mti) with scan, init, rules, suppress, baseline commands. MCP server exposes 4 tools for AI agent discovery and usage via stdio or SSE transport.
Scan Pipeline Flow
42 General Multi-Tenant Rules
8 categories covering the full tenant isolation surface — from context management to schema migrations.
Tenant Context Management
TCM-001 to TCM-006Tenant ID derived from authenticated sessions, not client input. Context propagation across async boundaries, background jobs, and error paths.
- •TCM-001: Tenant ID from client input instead of session
- •TCM-002: Missing tenant context in async boundaries
- •TCM-003: No AsyncLocalStorage for tenant context
- •TCM-004: Tenant ID from URL path instead of JWT
- •TCM-005: Missing tenant context in queue handler
- •TCM-006: Tenant context lost in error handling
Database Query Isolation
DBQ-001 to DBQ-010Every database query touching tenant-scoped data must include a tenant filter. Detects missing WHERE clauses, raw SQL without tenant filters, and missing RLS policies.
- •DBQ-001: findMany without organizationId filter
- •DBQ-002: findUnique by ID without tenant ownership
- •DBQ-003: update/delete without tenant field
- •DBQ-004: Raw SQL ($queryRaw) without tenant filter
- •DBQ-005: Drizzle select() without .where(eq(tenantId))
- •DBQ-006: Missing RLS policy on tenant-scoped table
- •DBQ-007: RLS policy uses USING(true)
- •DBQ-008: Prisma include on relation without tenant filter
- •DBQ-009: Aggregate query without tenant filter
- •DBQ-010: upsert without tenant field in where
IDOR Prevention
IDOR-001 to IDOR-005Insecure Direct Object Reference prevention. Every ID-based lookup must verify tenant ownership before returning data.
- •IDOR-001: findUnique by ID only, no tenant check
- •IDOR-002: API route accepts id without tenant ownership
- •IDOR-003: File download by ID without tenant check
- •IDOR-004: Update/Delete by ID without tenant verification
- •IDOR-005: Webhook accepts external ID without tenant mapping
Cache & Session Isolation
CSI-001 to CSI-004Cache keys and session data must be tenant-scoped. Detects missing tenant prefixes in Redis keys and shared session storage.
- •CSI-001: Redis cache key without tenant prefix
- •CSI-002: Session data without tenant scoping
- •CSI-003: Cache key from user input only
- •CSI-004: Cache invalidation not scoped to tenant
API Security
API-001 to API-003Tenant-aware rate limiting, response scoping, and metadata. Prevents over-fetching and per-tenant rate limit bypass.
- •API-001: Rate limiter without tenantId
- •API-002: API response includes cross-tenant data
- •API-003: Missing tenantId in API response metadata
File Storage Isolation
FSI-001 to FSI-004S3, Vercel Blob, and local filesystem access must be tenant-scoped. Detects missing tenant prefixes in object keys and unvalidated file paths.
- •FSI-001: S3/Blob upload without tenant prefix
- •FSI-002: File download without tenant ownership
- •FSI-003: Presigned URL without tenant scoping
- •FSI-004: Static file serving without tenant path validation
Logging & Audit
LOG-001 to LOG-004Audit logs must include tenant context. Detects missing tenantId in log entries and cross-tenant data in error logs.
- •LOG-001: Log entry missing tenantId
- •LOG-002: Audit log missing tenant context for data access
- •LOG-003: Error log includes cross-tenant data
- •LOG-004: Structured log strips tenantId
Schema & Migration
SCH-001 to SCH-006Prisma models and SQL migrations must include tenant columns. Detects missing tenant fields, missing composite indexes, and missing RLS enablement.
- •SCH-001: Prisma model without tenant field
- •SCH-002: Migration adds table without tenant column
- •SCH-003: Index without tenant column as first field
- •SCH-004: RLS not enabled on tenant-scoped table
- •SCH-005: RLS policy uses USING(true) or WITH CHECK(true)
- •SCH-006: Foreign key without tenant column (cross-tenant ref)
15 MCP Server Isolation Rules
Purpose-built for Model Context Protocol servers. No other scanner detects these vulnerabilities.
Tool Visibility Scoping
MCP server serves all tools to all tenants. Tool handler has no tenant-based allow/deny filter.
Cache Key Tenant Prefix
Tool results cached without tenant prefix in cache key. Cross-tenant cache poisoning possible.
Session Binding to User+Tenant
Session ID used as sole authorization. Not bound to user identity and tenant context.
Token Exchange (RFC 8693)
MCP server forwards original token to downstream API instead of performing token exchange.
Per-Tenant Rate Limiting
No per-tenant rate limiting on MCP tool calls. Single tenant can exhaust shared resources.
Vector Store Tenant Namespace
Shared vector store without tenant-scoped namespaces. Cross-tenant similarity search possible.
Tool Description Injection
Tool description contains instructions that could cross tenant boundaries or bypass isolation.
Credential Vault Tenant Scoping
Credential vault stores tokens without tenant scoping. Wrong tenant can receive wrong credentials.
Shared Service Account
MCP server uses single shared API key for all tenant API calls instead of per-tenant credentials.
Session Cleanup on Disconnect
No deterministic session cleanup on disconnect. Tenant context persists across sessions.
Telemetry Tenant Identifier
Telemetry and logs strip tenant identifier. Impossible to attribute tool calls to tenants.
Local Bind (127.0.0.1)
MCP server binds to 0.0.0.0 instead of 127.0.0.1 for local servers. Exposes to network.
Filesystem Tenant Root
Tool handler accesses filesystem without tenant-scoped root directory. Path traversal risk.
Cross-Tenant Artifact Leakage
Artifact storage (S3, filesystem) without tenant prefix in object key. Cross-tenant access.
Dynamic Tool Namespace
MCP server registers tools dynamically without tenant namespace in tool name. Collisions.
Technology Stack
Built with proven, production-grade tools. No experimental dependencies.
AST Parsing
- @babel/parser (TypeScript, JSX)
- Prisma schema parser
- SQL migration parser
- MCP SDK detection
Rule Engine
- RuleSpec declarative pattern
- Guard detection (pattern + AST)
- Evidence building
- Suppression policy engine
CLI & MCP
- Commander (CLI framework)
- @modelcontextprotocol/sdk
- stdio & SSE transport
- Chalk (terminal output)
Output Formats
- SARIF 2.1.0 (GitHub Code Scanning)
- JSON (CI/CD integration)
- Terminal (human-readable)
- MCP structured (AI agents)
How It Compares
Complements existing scanners. Fills the tenant isolation gap they leave behind.
| Feature | mcp-tenant-isolation | Snyk | Semgrep | CodeQL |
|---|---|---|---|---|
| MCP-specific rules (tool visibility, cache keys, sessions) | — | — | — | |
| Tenant isolation rules (RLS, IDOR, tenant context) | — | — | — | |
| Prisma schema analysis | — | — | — | |
| MCP server for AI agent integration | — | — | — | |
| SARIF output | ||||
| Custom rule packs | — | |||
| Suppression policy with expiration | — | |||
| Open source (MIT) | — | |||
| General vulnerability scanning | — |
AI Agent Integration via MCP
The package includes an MCP server that exposes four tools for AI agents to discover and use. Claude, Cursor, Windsurf, and any MCP-compatible client can scan code for tenant isolation issues.
scan_tenant_isolation
Scan a file path or inline code. Returns structured findings with ruleId, severity, location, and fix suggestions.
list_tenant_isolation_rules
Returns all 57 rules with metadata. Filterable by category. Enables AI agents to understand available checks.
explain_tenant_isolation_rule
Returns rule details, OWASP mapping, CWE IDs, vulnerable code example, and fix suggestion for a specific rule.
suppress_tenant_isolation_finding
Add a suppression with reason and expiration. Enforces policy: no blanket suppressions, mandatory expiration, critical rule protection.
Roadmap
Phased delivery. v1.0.0 focuses on TypeScript/JavaScript with MCP support. Future versions add Python, runtime tests, and IDE integration.
v1.0.0
In Development- 57 rules (42 general + 15 MCP-specific)
- TypeScript & JavaScript support
- Prisma & Drizzle ORM analysis
- CLI (mti) with JSON, SARIF, terminal output
- MCP server for AI agent integration
- Custom rule packs (JSON/YAML)
- Suppression policy with expiration
v1.1.0
Planned- Python support (FastAPI, Django, Flask)
- SQLAlchemy ORM analysis
- Watch mode (mti scan --watch)
- Incremental scanning with AST cache
- VS Code extension
v2.0.0
Future- Runtime two-tenant adversarial test harness
- Go and Ruby language support
- GitHub Action (pre-built)
- Rule severity configuration in .mtirc.json
- Auto-generated rule documentation
Frequently Asked Questions
Start Scanning Your MCP Server Today
Free. Open source. MIT licensed. No account required.