Tenantguard

Name: Tenantguard
Author: RudrenduPaul

by RudrenduPaulversion 0.1.5i★ –iRuns on your computer

Registry nameio.github.RudrenduPaul/tenantguard

Install

Overview

Description from the maker (original English)

Scans self-hosted multi-tenant AI-agent platforms for tenant-isolation gaps via an MCP tool.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiVery new↓ 14/wk · ★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: stdio
Category: Other

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on your computer with your user’s permissions (files, network, apps).
The registry lists no key to fill in.

You need

PyPIPython’s uv installed (for the uvx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "tenantguard": {
      "command": "uvx",
      "args": [
        "tenantguard-cli",
        "tenantguard",
        "mcp"
      ]
    }
  }
}

Run this in your terminal

claude mcp add tenantguard -- uvx tenantguard-cli tenantguard mcp

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "tenantguard": {
      "command": "uvx",
      "args": [
        "tenantguard-cli",
        "tenantguard",
        "mcp"
      ]
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "tenantguard": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "tenantguard-cli",
        "tenantguard",
        "mcp"
      ]
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 9, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account RudrenduPaul, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Otheri

More stars than 0% of the other 18722 servers in this category
Published to the registry more recently than 19% of the other 18722 servers in this category
Basic checks equal to or better than 100% of the other 18722 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is Tenantguard safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

The registry does not list a required key, though some servers ask you to sign in on first use.

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed –, and the latest version (0.1.5) reached the registry 3 months ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Python (uv) on your computer.

What can I use instead?

In the same category: Spec Driven Development, Remote Desktop Commander, alalanet — check before you pay

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:↓ Downloads per weeki★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Spec Driven Development

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

by formulahendryEarly↓ 66/wk★ 440Updated 14 months ago

Runs on your computer

Install

Remote Desktop Commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

by desktop-commanderGrowing★ 211Updated 4 days ago

Runs in the cloud✓ desktopcommander.app

Install

alalanet — check before you pay

Check packages, MCP servers and x402 endpoints before agents install or pay. Signed.

by alalanetEarlyUpdated today

Runs in the cloud✓ alalanet.com

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

TenantGuard

Install • Quickstart • Features • CLI Reference • MCP Server • Compare • FAQ

Find the tenant-isolation gap in your self-hosted, multi-tenant AI-agent platform before an auditor, or an attacker, does.

Install

npm install -g tenantguard-cli

This is the recommended install. The tenantguard-cli npm package (currently 0.2.0, renamed from the old plain tenantguard, which is deprecated) pulls in the matching platform binary as an npm optionalDependency (cosign-verified at publish time, so there's no separate verification step for you) and puts a tenantguard command on your PATH.

Platform coverage: macOS on Intel and Apple Silicon, Linux on x64 and arm64, and Windows on both x64 and arm64.

go install github.com/RudrenduPaul/TenantGuard/cmd/tenantguard@v0.2.0

go install works on every platform Go supports and doesn't depend on any registry publish state, so it's the fallback if your platform isn't covered above.

You can also skip the top-level package and install a single platform binary package directly:

npm install tenantguard-darwin-arm64   # swap for your platform: darwin-x64, linux-x64, linux-arm64, win32-x64, win32-arm64

./node_modules/tenantguard-darwin-arm64/bin/tenantguard scan --demo

Python (pip / uvx)

pip install tenantguard-cli

uvx --from tenantguard-cli tenantguard scan --demo

The PyPI package, tenantguard-cli, lives in this repo under python/ and is built and tested in CI. Its current version is 0.1.6, which downloads and runs the v0.2.0 build of the same GitHub Releases binary the npm packages use, verifying the release's SHA-256 checksums.txt on first run (itself Sigstore-signature-verified before any digest inside it is trusted) and caching the verified binary locally after that. That's a different trust boundary than the npm packages, which embed a cosign-verified binary at publish time and need no runtime download at all; the PyPI wrapper's checksum check is the equivalent guarantee for a path that has to fetch the binary on the end user's machine instead.

PyPI versions up to and including 0.1.2 shipped a bug that made pip install tenantguard-cli succeed but tenantguard scan --demo fail on first run with could not parse checksums.txt.pem as a PEM certificate (the wrapper wasn't base64-decoding the cosign-produced certificate/signature release assets before parsing them). That is fixed in tenantguard-cli 0.1.3, published to PyPI on 2026-08-03; pip install tenantguard-cli now installs a working tool with no extra steps.

Quickstart

tenantguard scan --demo

Real captured output:

TenantGuard: Tenant-Isolation Audit

Target: /var/folders/m0/5tzdd47n6znb166d4w3m2q0c0000gn/T/tenantguard-demo-488625596

[FAIL] TA01 sandbox/workspace mount path is not scoped per-tenant (no ${TENANT_ID} placeholder and no explicit scoped_per_tenant declaration) .../deployment.yaml:12 Maps to: goclaw#1163 | HIPAA Sec164.312(a)(1) Access Control (provisional)

[FAIL] TA02 MCP tool URL targets a private/loopback/reserved address (via real CIDR containment on a literal or DNS-resolved IP) without a verified, IP-pinned SSRF validator or an explicit host allowlist entry. CAVEAT: a PASS trusts the deployment's own pins_resolved_ip/validates_private declaration -- TenantGuard cannot verify the real validator actually pins the resolved IP for the connection itself, so DNS-rebinding/TOCTOU risk persists if that declaration is inaccurate .../deployment.yaml:22 Maps to: goclaw#1070 | HIPAA Sec164.312(e)(1) Transmission Security (provisional)

[FAIL] TA03 cron binding's target agent does not belong to the declaring tenant .../deployment.yaml:35 Maps to: goclaw#1217 | HIPAA Sec164.312(a)(1) Access Control (provisional)

[FAIL] TA04 exec tool denies direct env dump but not indirect env reads (e.g. jq $ENV), or allows credential-chain leakage via allow_chain_exec (goclaw#1033) .../deployment.yaml:25 Maps to: goclaw#1227 | HIPAA Sec164.312(a)(2)(iv) Encryption/Decryption (provisional)

[FAIL] TA05 exec-approval allow-always entry is keyed on basename only, not a full path scope .../deployment.yaml:30 Maps to: goclaw#1216 | HIPAA Sec164.312(a)(1) Access Control (provisional)

[FAIL] TA09 sandbox fail-closed posture not declared (sandbox.on_unavailable must be "fail_closed") .../tenantguard-demo-488625596:0 Maps to: goclaw#246 | HIPAA Sec164.312(a)(1) Access Control (provisional)

[FAIL] TA10 agent does not explicitly declare a per-agent config override (workspace restriction or sandbox config), risking silent inheritance of an undeclared global default .../deployment.yaml:40 Maps to: goclaw#145 | HIPAA Sec164.312(a)(1) Access Control (provisional)

[FAIL] TA13 MCP/CLI bridge does not declare HMAC-signed context headers (bridge.hmac_enabled and bridge.context_headers_signed) .../tenantguard-demo-488625596:0 Maps to: goclaw#91 | HIPAA Sec164.312(e)(1) Transmission Security (provisional)

[FAIL] TA06 cron binding does not declare that its store layer captures/replays the human creator's sender identity at fire time .../deployment.yaml:35 Maps to: goclaw#1129 | HIPAA Sec164.312(b) Audit Controls (provisional)

[FAIL] TA07 sandbox container privilege is not hardened (root user by default, full host-env passthrough, tmpfs missing noexec/nosuid/nodev, or a dangerous Linux capability added) .../deployment.yaml:12 Maps to: goclaw#1014 | HIPAA Sec164.312(a)(1) Access Control (provisional)

[FAIL] TA11 channel/session device identity is shared across channel_instances declaring different tenants .../deployment.yaml:54 Maps to: goclaw#1064 | HIPAA Sec164.312(a)(1) Access Control (provisional)

[FAIL] TA11 channel/session device identity is shared across channel_instances declaring different tenants .../deployment.yaml:57 Maps to: goclaw#1064 | HIPAA Sec164.312(a)(1) Access Control (provisional)

[FAIL] TA15 channel_instances entry does not declare reload_strategy: differential, so any single create/update/delete on that entry triggers a full stop/restart of every running channel instance across all tenants (no per-instance fingerprint/diff step). CAVEAT: a PASS trusts the deployment's own reload_strategy declaration -- TenantGuard cannot verify the real InstanceLoader actually performs a differential (fingerprint-diffed) reload rather than the destructive full rebuild, so a mismatched declaration would still scan clean .../deployment.yaml:54 Maps to: goclaw#1147 | HIPAA Sec164.312(a)(1) Access Control (provisional)

[FAIL] TA15 channel_instances entry does not declare reload_strategy: differential, so any single create/update/delete on that entry triggers a full stop/restart of every running channel instance across all tenants (no per-instance fingerprint/diff step). CAVEAT: a PASS trusts the deployment's own reload_strategy declaration -- TenantGuard cannot verify the real InstanceLoader actually performs a differential (fingerprint-diffed) reload rather than the destructive full rebuild, so a mismatched declaration would still scan clean .../deployment.yaml:57 Maps to: goclaw#1147 | HIPAA Sec164.312(a)(1) Access Control (provisional)

[PASS] 1 check(s) clear

Summary: 14 FAIL, 1 PASS Findings map to confirmed open goclaw issues where applicable. HIPAA citations are provisional, see README.

The bundled fixture is deliberately noisy: it exists to exercise nearly every rule at once. TA08 (credential-storage encryption) and TA14 (per-agent resource-profile isolation) are per-entry checks that only fire against providers and resource_profiles entries in the scanned config, and this fixture declares zero entries of either kind, so both rules have nothing to evaluate and produce no finding at all, neither PASS nor FAIL. TA16 (provider connection SSRF) is the same kind of per-entry check against providers entries, so it also produces nothing on this fixture. The one line shown as passing, "1 check(s) clear," is TA12 (owner/sysadmin recovery), which the fixture's owner_ids and has_recovery_command values are deliberately set to satisfy. Exit code is 1, since findings are present; see CLI Reference for the full exit-code contract.

Scan a real deployment and emit SARIF for code scanning instead:

tenantguard scan --target ./deployment --format sarif --sarif-out tenantguard-report.sarif

Or emit plain JSON, for a script or agent that would rather parse a flat findings array than a SARIF document:

tenantguard scan --target ./deployment --format json

Features

TenantGuard scans a self-hosted, multi-tenant AI-agent deployment's configuration against 16 rules, each derived from a real, confirmed tenant-isolation failure mode. Every rule is fail-closed: an undeclared or ambiguous setting is a violation, not a silent pass.

Tenant isolation boundaries

Rule	What it catches
TA01	A sandbox/workspace mount is a violation unless its path carries the `${TENANT_ID}` scoping placeholder or `scoped_per_tenant` is explicitly declared true. Maps to goclaw#1163.
TA03	A cron binding's `target_agent` must belong to the tenant that declared the binding; a dangling or cross-tenant reference fails closed. Maps to goclaw#1217.
TA11	Flags two `channel_instances` entries that share the same `device_session_id` but declare different tenants (e.g. a shared WhatsApp device row). Maps to goclaw#1064/#1065.
TA14	A per-agent resource profile (browser/container) is a violation unless its path contains the `${TENANT_ID}` placeholder. Maps to goclaw#778.
TA15	Flags a `channel_instances` entry that doesn't explicitly declare `reload_strategy: differential`; an undeclared value or `full` both mean any single create/update/delete on that entry triggers a destructive full stop/restart of every running channel instance across every tenant. Trusts the deployment's own declaration (TenantGuard cannot verify the real loader actually diffs by fingerprint). Maps to goclaw#1147.

Network and credential exposure

Rule	What it catches
TA02	Flags a saved MCP tool URL targeting a private/loopback/reserved address, using real `net.cidr_contains` on a literal or DNS-resolved IP (not string matching), unless the deployment declares both `validates_private` and `pins_resolved_ip` (or the host is explicitly allowlisted). Documents the DNS-rebinding/TOCTOU limitation explicitly. Maps to goclaw#1070.

| TA04 | Flags an exec tool that denies direct env-dump reads but not indirect reads (e.g. jq $ENV), and independently flags any tool with allow_chain_exec: true, since cr

Only the beginning is shown; read the rest in the repo

Tenantguard

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Otheri

Common questions

Alternatives

Spec Driven Development

Remote Desktop Commander

alalanet — check before you pay

README from the maker

TenantGuard

Install

Python (pip / uvx)

Quickstart

Features

Tenant isolation boundaries

Network and credential exposure