Multi-Tenant MCP Server Security

Multi-tenant MCP servers must prevent data, cache, tool, and credential leakage between customers.

Tenant identity comes from auth

Resolve the tenant from validated caller identity or server-side membership data. A model-generated parameter cannot establish tenancy.

Cache isolation

Tool lists, resource reads, and application caches may vary by role or tenant. Use private cache scope and tenant-aware keys unless results are provably identical.

Downstream credentials

Use tenant-scoped or delegated credentials where the business system supports them. Avoid one omnipotent credential shared across all tenants.

Auditability

Record actor, tenant, server, tool, target resource, approval decision, and outcome for high-impact actions while redacting secrets.