Tenantguard

TenantGuard

Install • Quickstart • Features • CLI Reference • MCP Server • Compare • FAQ

Find the tenant-isolation gap in your self-hosted, multi-tenant AI-agent platform before an auditor, or an attacker, does.

Install

npm install -g tenantguard-cli

This is the recommended install. The tenantguard-cli npm package (currently 0.2.0, renamed from the old plain tenantguard, which is deprecated) pulls in the matching platform binary as an npm optionalDependency (cosign-verified at publish time, so there's no separate verification step for you) and puts a tenantguard command on your PATH.

Platform coverage: macOS on Intel and Apple Silicon, Linux on x64 and arm64, and Windows on both x64 and arm64.

go install github.com/RudrenduPaul/TenantGuard/cmd/tenantguard@v0.2.0

go install works on every platform Go supports and doesn't depend on any registry publish state, so it's the fallback if your platform isn't covered above.

You can also skip the top-level package and install a single platform binary package directly:

npm install tenantguard-darwin-arm64   # swap for your platform: darwin-x64, linux-x64, linux-arm64, win32-x64, win32-arm64

./node_modules/tenantguard-darwin-arm64/bin/tenantguard scan --demo

Python (pip / uvx)

pip install tenantguard-cli

uvx --from tenantguard-cli tenantguard scan --demo

The PyPI package, tenantguard-cli, lives in this repo under python/ and is built and tested in CI. Its current version is 0.1.6, which downloads and runs the v0.2.0 build of the same GitHub Releases binary the npm packages use, verifying the release's SHA-256 checksums.txt on first run (itself Sigstore-signature-verified before any digest inside it is trusted) and caching the verified binary locally after that. That's a different trust boundary than the npm packages, which embed a cosign-verified binary at publish time and need no runtime download at all; the PyPI wrapper's checksum check is the equivalent guarantee for a path that has to fetch the binary on the end user's machine instead.

PyPI versions up to and including 0.1.2 shipped a bug that made pip install tenantguard-cli succeed but tenantguard scan --demo fail on first run with could not parse checksums.txt.pem as a PEM certificate (the wrapper wasn't base64-decoding the cosign-produced certificate/signature release assets before parsing them). That is fixed in tenantguard-cli 0.1.3, published to PyPI on 2026-08-03; pip install tenantguard-cli now installs a working tool with no extra steps.

Quickstart

tenantguard scan --demo

Real captured output:

TenantGuard: Tenant-Isolation Audit

Target: /var/folders/m0/5tzdd47n6znb166d4w3m2q0c0000gn/T/tenantguard-demo-488625596

[FAIL] TA01 sandbox/workspace mount path is not scoped per-tenant (no ${TENANT_ID} placeholder and no explicit scoped_per_tenant declaration) .../deployment.yaml:12 Maps to: goclaw#1163 | HIPAA Sec164.312(a)(1) Access Control (provisional)

[FAIL] TA02 MCP tool URL targets a private/loopback/reserved address (via real CIDR containment on a literal or DNS-resolved IP) without a verified, IP-pinned SSRF validator or an explicit host allowlist entry. CAVEAT: a PASS trusts the deployment's own pins_resolved_ip/validates_private declaration -- TenantGuard cannot verify the real validator actually pins the resolved IP for the connection itself, so DNS-rebinding/TOCTOU risk persists if that declaration is inaccurate .../deployment.yaml:22 Maps to: goclaw#1070 | HIPAA Sec164.312(e)(1) Transmission Security (provisional)

[FAIL] TA03 cron binding's target agent does not belong to the declaring tenant .../deployment.yaml:35 Maps to: goclaw#1217 | HIPAA Sec164.312(a)(1) Access Control (provisional)

[FAIL] TA04 exec tool denies direct env dump but not indirect env reads (e.g. jq $ENV), or allows credential-chain leakage via allow_chain_exec (goclaw#1033) .../deployment.yaml:25 Maps to: goclaw#1227 | HIPAA Sec164.312(a)(2)(iv) Encryption/Decryption (provisional)

[FAIL] TA05 exec-approval allow-always entry is keyed on basename only, not a full path scope .../deployment.yaml:30 Maps to: goclaw#1216 | HIPAA Sec164.312(a)(1) Access Control (provisional)

[FAIL] TA09 sandbox fail-closed posture not declared (sandbox.on_unavailable must be "fail_closed") .../tenantguard-demo-488625596:0 Maps to: goclaw#246 | HIPAA Sec164.312(a)(1) Access Control (provisional)

[FAIL] TA10 agent does not explicitly declare a per-agent config override (workspace restriction or sandbox config), risking silent inheritance of an undeclared global default .../deployment.yaml:40 Maps to: goclaw#145 | HIPAA Sec164.312(a)(1) Access Control (provisional)

[FAIL] TA13 MCP/CLI bridge does not declare HMAC-signed context headers (bridge.hmac_enabled and bridge.context_headers_signed) .../tenantguard-demo-488625596:0 Maps to: goclaw#91 | HIPAA Sec164.312(e)(1) Transmission Security (provisional)

[FAIL] TA06 cron binding does not declare that its store layer captures/replays the human creator's sender identity at fire time .../deployment.yaml:35 Maps to: goclaw#1129 | HIPAA Sec164.312(b) Audit Controls (provisional)

[FAIL] TA07 sandbox container privilege is not hardened (root user by default, full host-env passthrough, tmpfs missing noexec/nosuid/nodev, or a dangerous Linux capability added) .../deployment.yaml:12 Maps to: goclaw#1014 | HIPAA Sec164.312(a)(1) Access Control (provisional)

[FAIL] TA11 channel/session device identity is shared across channel_instances declaring different tenants .../deployment.yaml:54 Maps to: goclaw#1064 | HIPAA Sec164.312(a)(1) Access Control (provisional)

[FAIL] TA11 channel/session device identity is shared across channel_instances declaring different tenants .../deployment.yaml:57 Maps to: goclaw#1064 | HIPAA Sec164.312(a)(1) Access Control (provisional)

[FAIL] TA15 channel_instances entry does not declare reload_strategy: differential, so any single create/update/delete on that entry triggers a full stop/restart of every running channel instance across all tenants (no per-instance fingerprint/diff step). CAVEAT: a PASS trusts the deployment's own reload_strategy declaration -- TenantGuard cannot verify the real InstanceLoader actually performs a differential (fingerprint-diffed) reload rather than the destructive full rebuild, so a mismatched declaration would still scan clean .../deployment.yaml:54 Maps to: goclaw#1147 | HIPAA Sec164.312(a)(1) Access Control (provisional)

[FAIL] TA15 channel_instances entry does not declare reload_strategy: differential, so any single create/update/delete on that entry triggers a full stop/restart of every running channel instance across all tenants (no per-instance fingerprint/diff step). CAVEAT: a PASS trusts the deployment's own reload_strategy declaration -- TenantGuard cannot verify the real InstanceLoader actually performs a differential (fingerprint-diffed) reload rather than the destructive full rebuild, so a mismatched declaration would still scan clean .../deployment.yaml:57 Maps to: goclaw#1147 | HIPAA Sec164.312(a)(1) Access Control (provisional)

[PASS] 1 check(s) clear

Summary: 14 FAIL, 1 PASS Findings map to confirmed open goclaw issues where applicable. HIPAA citations are provisional, see README.

The bundled fixture is deliberately noisy: it exists to exercise nearly every rule at once. TA08 (credential-storage encryption) and TA14 (per-agent resource-profile isolation) are per-entry checks that only fire against providers and resource_profiles entries in the scanned config, and this fixture declares zero entries of either kind, so both rules have nothing to evaluate and produce no finding at all, neither PASS nor FAIL. TA16 (provider connection SSRF) is the same kind of per-entry check against providers entries, so it also produces nothing on this fixture. The one line shown as passing, "1 check(s) clear," is TA12 (owner/sysadmin recovery), which the fixture's owner_ids and has_recovery_command values are deliberately set to satisfy. Exit code is 1, since findings are present; see CLI Reference for the full exit-code contract.

Scan a real deployment and emit SARIF for code scanning instead:

tenantguard scan --target ./deployment --format sarif --sarif-out tenantguard-report.sarif

Or emit plain JSON, for a script or agent that would rather parse a flat findings array than a SARIF document:

tenantguard scan --target ./deployment --format json

Features

TenantGuard scans a self-hosted, multi-tenant AI-agent deployment's configuration against 16 rules, each derived from a real, confirmed tenant-isolation failure mode. Every rule is fail-closed: an undeclared or ambiguous setting is a violation, not a silent pass.

Tenant isolation boundaries

Network and credential exposure

| TA04 | Flags an exec tool that denies direct env-dump reads but not indirect reads (e.g. jq $ENV), and independently flags any tool with allow_chain_exec: true, since cr