How to Detect Cross-Tenant Data Leakage in MCP Servers and Multi-Tenant SaaS

The Hidden Security Gap in Multi-Tenant MCP Servers When you build a multi-tenant SaaS application or an MCP (Model Context Protocol) server that serves multiple organizations, cross-tenant data leakage is one of the most dangerous vulnerabilities you can ship. A single missing organizationId filter in a database query can expose one tenant's data to another — and traditional security scanners like Snyk, Semgrep, and CodeQL don't catch these patterns. That's why I built mcp-tenant-isolation — a static analysis scanner with 57 deterministic rules specifically designed to catch tenant isolation failures in multi-tenant codebases. What Is Tenant Isolation? Tenant isolation ensures that data belonging to one organization (tenant) is never accessible to another. In a multi-tenant SaaS app, every database query, cache read, and file access must be scoped to the current tenant's organizationId . The most common failure looks like this: // VULNERABLE: No organizationId filter const users = await prisma . user . findMany ({ where : { role : ' admin ' } }); // SECURE: Tenant-scoped query const users = await prisma . user . findMany ({ where : { role : ' admin ' , organizationId : ctx . orgId } }); It looks obvious in isolation. But in a codebase with 100+ API routes, dozens of lib functions, and complex middleware chains, missing tenant filters are easy to miss in code review and impossible for traditional SAST tools to detect . Why Traditional Scanners Miss This Tools like Snyk and Semgrep are excellent at detecting: SQL injection XSS Dependency vulnerabilities Secret leakage But they don't understand tenant context . They don't know that organizationId is the tenant boundary. They don't track which functions require tenant guards. They can't tell you that prisma.user.findMany({ where: { role: 'admin' } }) is missing a critical tenant filter. mcp-tenant-isolation fills this gap with 57 rules across 7 categories: Rule Categories Category Rules What It Detects Database Queries