mcp-tenant-isolationCAUTION
Static analysis scanner for multi-tenant SaaS and MCP server code. 57 deterministic rules for cross-tenant data leakage, IDOR, RLS, and MCP-specific risks. Includes MCP server, SARIF output, and GitHub Action.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Static analysis scanner for multi-tenant SaaS and MCP server code. 57 deterministic rules that catch cross-tenant data leakage before it reaches production.
[](https://www.npmjs.com/package/mcp-tenant-isolation) [](https://www.npmjs.com/package/mcp-tenant-isolation) [](https://github.com/subodhkc/mcp-tenant-isolation/actions/workflows/ci.yml) [](https://hub.docker.com/r/subodhkc/mcp-tenant-isolation) [](https://opensource.org/licenses/MIT)
What it does
If you build multi-tenant software, every query, every cache key, every file access, every API response needs to be scoped to the right tenant. Miss one, and Tenant A sees Tenant B's data. That's not a bug you want to find in production.
This scanner reads your source code and checks whether tenant isolation guards are present where they need to be. It covers 57 patterns across database queries, API routes, cache keys, file storage, schema design, logging, and MCP server architecture. It works with TypeScript, JavaScript, Prisma, Drizzle, raw SQL, Next.js, Express, and Fastify.
The scanner also runs as an MCP server, so you can plug it into Claude Desktop, Cursor, or any MCP-compatible agent and have your AI assistant scan code on demand.
Who uses this
- SaaS engineering teams who need to catch tenant isolation gaps before code ships
- MCP server developers building tools that handle tenant-scoped data
- Security teams who want tenant isolation checks in CI/CD
- AI agent developers who want their agents to scan code for cross-tenant risks
Why this exists
General-purpose security scann
72d39772b316OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-tenant-isolation -- npx -y [email protected]
Exposed tools (5)
5 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
explain_tenant_isolation_rule | read | |
getUserData | read | |
list_tenant_isolation_rules | read | |
scan_tenant_isolation | read | |
suppress_tenant_isolation_finding | read |
Trust audit
CAUTIONgrade B · trust 88/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (7)
/**
/**
/**
/**
/**
import { scan } from '../../src/engine/scanner.js';@babel/parser, @babel/traverse, @babel/types, @modelcontextprotocol/server, commander, fast-glob, zod, @types/babel__traverse
Gates applied: no_behavioural_pass.
72d39772b316full audit observations/trust-audit/mcp-server/subodhkc__mcp-tenant-isolation.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 72d39772b316 | CAUTION | B | 88 | first audit |
Questions
What is the mcp-tenant-isolation MCP server?
Static analysis scanner for multi-tenant SaaS and MCP server code. 57 deterministic rules for cross-tenant data leakage, IDOR, RLS, and MCP-specific risks. Includes MCP server, SARIF output, and GitHub Action.
What tools does mcp-tenant-isolation expose?
5 in total: 5 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is mcp-tenant-isolation safe to connect to an agent?
With care. The audit graded it B (88/100) and found 7 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does mcp-tenant-isolation need?
It reads EXTERNAL_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does mcp-tenant-isolation run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as mcp-tenant-isolation at 2.0.0.
How current is this page?
The grade is for one exact copy of the source (72d39772b316), read on 2026-10-12. The repository is watched and re-audited when it changes.